@zitadel/api 0.1.0-alpha.17 → 0.1.0-alpha.19

package/dist/generated/endpoints/zitadelNextGen.zod.mjs

@@ -8,175 +8,6 @@ import * as zod from "zod";
 * OpenAPI spec version: 0.0.1
 */
 /**
-* Retrieve the OpenID Connect configuration
-* @summary Get OpenID Connect configuration
-*/
-const getOpenIDConfigurationResponseClaimsParameterSupportedDefault = false;
-const getOpenIDConfigurationResponseRequestParameterSupportedDefault = false;
-const getOpenIDConfigurationResponseRequestUriParameterSupportedDefault = true;
-const getOpenIDConfigurationResponseRequireRequestUriRegistrationDefault = false;
-const GetOpenIDConfigurationResponse = zod.object({
-	issuer: zod.url().describe("REQUIRED. URL using the https scheme with no query or fragment components that the OP asserts as its Issuer Identifier."),
-	authorization_endpoint: zod.url().describe("REQUIRED. URL of the OP's OAuth 2.0 Authorization Endpoint."),
-	token_endpoint: zod.url().optional().describe("URL of the OP's OAuth 2.0 Token Endpoint. REQUIRED unless only the Implicit Flow is used."),
-	userinfo_endpoint: zod.url().optional().describe("RECOMMENDED. URL of the OP's UserInfo Endpoint."),
-	jwks_uri: zod.url().describe("REQUIRED. URL of the OP's JWK Set document containing the signing key(s) the RP uses to validate signatures from the OP."),
-	registration_endpoint: zod.url().optional().describe("RECOMMENDED. URL of the OP's Dynamic Client Registration Endpoint."),
-	scopes_supported: zod.array(zod.string()).optional().describe("RECOMMENDED. JSON array containing a list of the OAuth 2.0 scope values that this server supports. The server MUST support the openid scope value."),
-	response_types_supported: zod.array(zod.string()).describe("REQUIRED. JSON array containing a list of the OAuth 2.0 response_type values that this OP supports."),
-	response_modes_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the OAuth 2.0 response_mode values that this OP supports. Default is [\"query\", \"fragment\"]."),
-	grant_types_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the OAuth 2.0 Grant Type values that this OP supports. Default is [\"authorization_code\", \"implicit\"]."),
-	acr_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the Authentication Context Class References that this OP supports."),
-	subject_types_supported: zod.array(zod.enum(["public", "pairwise"])).describe("REQUIRED. JSON array containing a list of the Subject Identifier types that this OP supports. Valid types include pairwise and public."),
-	id_token_signing_alg_values_supported: zod.array(zod.string()).describe("REQUIRED. JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for the ID Token. The algorithm RS256 MUST be included."),
-	id_token_encryption_alg_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token."),
-	id_token_encryption_enc_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token."),
-	userinfo_signing_alg_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWS signing algorithms (alg values) supported by the UserInfo Endpoint."),
-	userinfo_encryption_alg_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWE encryption algorithms (alg values) supported by the UserInfo Endpoint."),
-	userinfo_encryption_enc_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the UserInfo Endpoint."),
-	request_object_signing_alg_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects. Servers SHOULD support none and RS256."),
-	request_object_encryption_alg_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects."),
-	request_object_encryption_enc_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects."),
-	token_endpoint_auth_methods_supported: zod.array(zod.enum([
-		"client_secret_post",
-		"client_secret_basic",
-		"client_secret_jwt",
-		"private_key_jwt"
-	])).optional().describe("OPTIONAL. JSON array containing a list of Client Authentication methods supported by the Token Endpoint. Default is client_secret_basic."),
-	token_endpoint_auth_signing_alg_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWS signing algorithms supported by the Token Endpoint for private_key_jwt and client_secret_jwt authentication. The value none MUST NOT be used."),
-	display_values_supported: zod.array(zod.enum([
-		"page",
-		"popup",
-		"touch",
-		"wap"
-	])).optional().describe("OPTIONAL. JSON array containing a list of the display parameter values that the OpenID Provider supports."),
-	claim_types_supported: zod.array(zod.enum([
-		"normal",
-		"aggregated",
-		"distributed"
-	])).optional().describe("OPTIONAL. JSON array containing a list of the Claim Types that the OpenID Provider supports. Default is normal."),
-	claims_supported: zod.array(zod.string()).optional().describe("RECOMMENDED. JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for."),
-	service_documentation: zod.url().optional().describe("OPTIONAL. URL of a page containing human-readable information for developers using the OpenID Provider."),
-	claims_locales_supported: zod.array(zod.string()).optional().describe("OPTIONAL. Languages and scripts supported for values in Claims being returned, as BCP47 language tag values."),
-	ui_locales_supported: zod.array(zod.string()).optional().describe("OPTIONAL. Languages and scripts supported for the user interface, as BCP47 language tag values."),
-	claims_parameter_supported: zod.boolean().default(false).describe("OPTIONAL. Boolean value specifying whether the OP supports use of the claims parameter. Default is false."),
-	request_parameter_supported: zod.boolean().default(false).describe("OPTIONAL. Boolean value specifying whether the OP supports use of the request parameter. Default is false."),
-	request_uri_parameter_supported: zod.boolean().default(true).describe("OPTIONAL. Boolean value specifying whether the OP supports use of the request_uri parameter. Default is true."),
-	require_request_uri_registration: zod.boolean().default(false).describe("OPTIONAL. Boolean value specifying whether the OP requires any request_uri values used to be pre-registered. Default is false."),
-	op_policy_uri: zod.url().optional().describe("OPTIONAL. URL the OP provides to the person registering the Client about the OP's requirements on how the Relying Party can use the data provided."),
-	op_tos_uri: zod.url().optional().describe("OPTIONAL. URL the OP provides to the person registering the Client about the OpenID Provider's terms of service.")
-}).describe("OpenID Connect configuration according to the OpenID Connect Discovery 1.0 specification.");
-/**
-* @summary Authorize a user
-*/
-const AuthorizeGetQueryParams = zod.strictObject({
-	acr_values: zod.string().optional().describe("A space delimited list of Authentication Class References. This can be\nused to specify certain authentication methods or level of assurance \nthat is required for the authentication. For example, you could use \nthis to require multi-factor authentication.\n"),
-	client_id: zod.string().describe("The client ID of the application that is requesting authorization. \nThis is a required parameter and must match the client ID of a \nregistered application.\n"),
-	code_challenge: zod.string().optional().describe("The code challenge is a cryptographic string used in the PKCE (Proof \nKey for Code Exchange) flow to enhance security.\n"),
-	code_challenge_method: zod.string().optional().describe("The code challenge method is used in conjunction with the code challenge \nin the PKCE flow. It specifies the method used to generate the code \nchallenge. Common values are \"S256\" for SHA-256 hashing and \"plain\" \nfor no hashing.\n"),
-	display: zod.string().optional().describe("The display parameter is used to specify how the authorization server \nshould display the authentication and consent user interface. Common \nvalues include \"page\" for a full-page display, \"popup\" for a popup \nwindow, and \"touch\" for a mobile-optimized display.\n"),
-	id_token_hint: zod.string().optional().describe("The ID token hint is a previously issued ID token that can be used to \npre-fill the authentication form or to provide information about the \nuser to the authorization server. This can be useful for single sign-on \nscenarios or for providing a smoother user experience.\n"),
-	login_hint: zod.string().optional().describe("The login hint is a hint to the authorization server about the login \nidentifier of the user. This can be used to pre-fill the username or \nemail field in the authentication form, making it easier for the user \nto log in.\n"),
-	max_age: zod.number().optional().describe("The max age parameter specifies the maximum amount of time in seconds \nthat has passed since the user last authenticated. If the user has not \nauthenticated within this time frame, they will be required to re-authenticate.\n"),
-	nonce: zod.string().optional().describe("The nonce parameter is a random string that is used to associate a client \nsession with an ID token and to mitigate replay attacks. The authorization \nserver should include this value in the ID token that it issues, and the \nclient should verify that the value in the ID token matches the value it \nsent in the authorization request.\n"),
-	prompt: zod.string().optional().describe("The prompt parameter is used to specify whether the authorization server \nshould prompt the user for re-authentication and consent. Common values \ninclude \"none\" for no prompts, \"login\" to prompt for re-authentication, \n\"consent\" to prompt for user consent, and \"select_account\" to prompt \nthe user to select an account if they are logged in with multiple accounts.\n"),
-	redirect_uri: zod.string().optional().describe("The redirect URI is the URI to which the authorization server will redirect \nthe user after they have authorized or denied the request. This must match \none of the redirect URIs registered for the client application.\n"),
-	response_mode: zod.string().optional().describe("The response mode parameter specifies how the authorization server should \nreturn the authorization response. Common values include \"query\" to return \nparameters in the query string, \"fragment\" to return parameters in the URL \nfragment, and \"form_post\" to return parameters in an HTTP POST request.\n"),
-	response_type: zod.string().describe("The response type parameter specifies the type of response that the client \nis expecting from the authorization server. Common values include \"code\" \nfor the authorization code flow, \"token\" for the implicit flow, and \"id_token\" \nfor OpenID Connect authentication.\n"),
-	scope: zod.string().optional().describe("The scope parameter is used to specify the permissions that the client is \nrequesting from the user. This is a space-delimited list of scope values, \nand the authorization server will use this information to determine what \naccess to grant to the client application.\n"),
-	state: zod.string().optional().describe("The state parameter is a random string that is used to maintain state between \nthe authorization request and the callback. It is used to prevent cross-site \nrequest forgery (CSRF) attacks by ensuring that the response received from the \nauthorization server corresponds to the request that was sent.\n"),
-	ui_locales: zod.string().optional().describe("The ui_locales parameter is used to specify the preferred languages and scripts \nfor the user interface that the authorization server should display. This is a \nspace-delimited list of BCP47 language tag values, and it can be used to provide \na localized user experience for users from different regions and language \npreferences.\n")
-});
-/**
-* @summary Authorize a device
-*/
-const AuthorizeDeviceQueryParams = zod.strictObject({
-	client_id: zod.string().describe("The client ID of the application that is requesting authorization. \nThis is a required parameter and must match the client ID of a \nregistered application.\n"),
-	scope: zod.string().optional().describe("The scope parameter is used to specify the permissions that the client\nis requesting. This is a space delimited list of scopes. For example,\nyou could use this to request access to the user's profile information or\nto request permission to access certain APIs on behalf of the user.\n")
-});
-const AuthorizeDeviceResponse = zod.object({
-	device_code: zod.string().optional().describe("The device code that the client will use to poll for authorization.\n"),
-	expires_in: zod.number().optional().describe("The number of seconds until the device code expires.\n"),
-	interval: zod.number().optional().describe("The minimum amount of time in seconds that the client should wait \nbetween polling requests.\n"),
-	user_code: zod.string().optional().describe("The user code that the user will enter to authorize the device.\n"),
-	verification_uri: zod.string().optional().describe("The URI where the user will enter the user code to authorize the device.\n"),
-	verification_uri_complete: zod.string().optional().describe("The complete URI with the user code included, which the user can visit\nto authorize the device.\n")
-});
-/**
-* @summary End a session
-*/
-const EndSessionQueryParams = zod.strictObject({
-	client_id: zod.string().optional().describe("The client ID is the identifier for the client application that is making \nthe request. This is used by the authorization server to identify the \nclient and to determine whether it is authorized to perform the requested \naction.\n"),
-	id_token_hint: zod.string().optional().describe("The ID token hint is a previously issued ID token that can be used to \npre-fill the authentication form or to provide information about the \nuser to the authorization server. This can be useful for single sign-on \nscenarios or for providing a smoother user experience.\n"),
-	logout_hint: zod.string().optional().describe("The logout hint is a hint to the authorization server about the login \nidentifier of the user. This can be used to pre-fill the username or email\nfield in the logout form, making it easier for the user to log out.\n"),
-	post_logout_redirect_uri: zod.string().optional().describe("The post logout redirect URI is the URI to which the user will be \nredirected after they have logged out. This must be a registered URI \nfor the client application and is used to ensure that the user is \nredirected to a safe location after logging out.\n"),
-	state: zod.string().optional().describe("The state parameter is an opaque value that is used by the client to\nmaintain state between the request and the callback. It is typically used\nto prevent cross-site request forgery (CSRF) attacks by including a unique\nvalue in the request that the client can verify when it receives the callback.\n"),
-	ui_locales: zod.string().optional().describe("The ui_locales parameter is a space-separated list of BCP47 language tags\nthat are used to indicate the preferred languages and scripts for the user\ninterface. This can be used by the authorization server to display the logout\npage in the user's preferred language.\n")
-});
-/**
-* @summary Introspect a token
-*/
-const IntrospectResponse = zod.object({
-	active: zod.boolean().optional().describe("Indicates whether the token is active"),
-	aud: zod.string().optional().describe("The audience of the token (if applicable)"),
-	client_id: zod.string().optional().describe("The client ID associated with the token"),
-	exp: zod.number().optional().describe("The expiration time of the token (in seconds since epoch)"),
-	iat: zod.number().optional().describe("The time the token was issued (in seconds since epoch)"),
-	iss: zod.string().optional().describe("The issuer of the token (if applicable)"),
-	jti: zod.string().optional().describe("The unique identifier for the token (if applicable)"),
-	nbf: zod.number().optional().describe("The time before which the token is not valid (in seconds since epoch)"),
-	scope: zod.string().optional().describe("The scopes associated with the token"),
-	sub: zod.string().optional().describe("The subject of the token (if applicable)"),
-	token_type: zod.string().optional().describe("The type of the token (access_token or refresh_token)"),
-	username: zod.string().optional().describe("The username associated with the token (if applicable)")
-});
-/**
-* @summary Get public keys
-*/
-const GetKeysResponse = zod.object({ keys: zod.array(zod.object({
-	use: zod.string().optional(),
-	kty: zod.string().optional(),
-	kid: zod.string().optional(),
-	crv: zod.string().optional(),
-	alg: zod.string().optional(),
-	k: zod.string().optional(),
-	x: zod.string().optional(),
-	y: zod.string().optional(),
-	n: zod.string().optional(),
-	e: zod.string().optional(),
-	d: zod.string().optional(),
-	p: zod.string().optional(),
-	q: zod.string().optional(),
-	dp: zod.string().optional(),
-	dq: zod.string().optional(),
-	qi: zod.string().optional(),
-	x5c: zod.array(zod.string()).optional(),
-	x5u: zod.string().optional(),
-	x5t: zod.string().optional(),
-	x5tS256: zod.string().optional()
-})).optional() });
-/**
-* @summary Get access token
-*/
-const GetTokenResponse = zod.object({
-	access_token: zod.string().optional().describe("The access token issued by the authorization server."),
-	token_type: zod.string().optional().describe("The type of the token issued (e.g., Bearer)."),
-	expires_in: zod.number().optional().describe("The lifetime in seconds of the access token."),
-	refresh_token: zod.string().optional().describe("The refresh token which can be used to obtain new access tokens.")
-});
-/**
-* @summary Get user info
-*/
-const GetUserInfoResponse = zod.object({
-	sub: zod.string().optional().describe("The unique identifier for the user."),
-	name: zod.string().optional().describe("The full name of the user."),
-	email: zod.email().optional().describe("The email address of the user."),
-	preferred_username: zod.string().optional().describe("The preferred username of the user."),
-	picture: zod.url().optional().describe("The URL of the user's profile picture."),
-	given_name: zod.string().optional().describe("The given name of the user."),
-	family_name: zod.string().optional().describe("The family name of the user.")
-});
-/**
 * @summary Create user
 */
 const createUserQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
@@ -185,54 +16,156 @@ const CreateUserQueryParams = zod.strictObject({
 	project_id: zod.string().regex(createUserQueryProjectIdRegExp).describe("The unique identifier of the project"),
 	team_id: zod.string().regex(createUserQueryTeamIdRegExp).optional().describe("The unique identifier of the team")
 });
-const CreateUserBody = zod.record(zod.string(), zod.unknown()).describe("A user represents an individual identity in the system. It can be used to \nrepresent a human user, but also a service account or any other type of \nidentity. The content of a user is determined by the configured schema for \nusers, this is only a base schema.\n");
+const CreateUserBody = zod.object({
+	schema: zod.string().min(1).describe("The schema that defines the content of `attributes`. These schemas can be\ncreated using the `/schemas` endpoint. A default schema is provided.\n"),
+	attributes: zod.record(zod.string(), zod.unknown()).describe("The user's schema-defined content. Validated against `schema`; a\nproperty the schema does not permit is rejected with `user.invalid`.\n")
+}).describe("`attributes` is the document that must satisfy the user schema named by\n`schema`.\n\nThe resource primary key is server-assigned and returned in the response, so\nthe request carries no `id`; `metadata` is server-owned for the same reason.\nNeither is part of this schema, which is what frees a user schema to declare\nproperties of those names.\n\nA request carrying any other top-level property is rejected rather than\nignored. `attributes` stays open, since the user schema is what determines\nwhat belongs in it.\n");
 /**
 * @summary List users
 */
-const listUsersQueryOffsetDefault = 0;
-const listUsersQueryOffsetMin = 0;
 const listUsersQueryLimitDefault = 20;
 const listUsersQueryLimitMax = 100;
 const ListUsersQueryParams = zod.strictObject({
-	offset: zod.number().min(0).default(0).describe("Number of items to skip before returning results."),
-	limit: zod.number().min(1).max(100).default(20).describe("Maximum number of items to return.")
+	limit: zod.number().min(1).max(100).default(20).describe("Maximum number of items to return."),
+	page_token: zod.string().optional().describe("Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n")
 });
-const ListUsersResponseItem = zod.record(zod.string(), zod.unknown());
-const ListUsersResponse = zod.array(ListUsersResponseItem);
+const listUsersResponseUsersItemIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const ListUsersResponse = zod.object({
+	users: zod.array(zod.object({
+		id: zod.string().regex(listUsersResponseUsersItemIdRegExp),
+		schema: zod.string().describe("The schema that defines the content of `attributes`. These schemas can be\ncreated using the `/schemas` endpoint. A default schema is provided.\nThis schema can be retrieved using the same endpoint.\n"),
+		attributes: zod.record(zod.string(), zod.unknown()).describe("The user's content, satisfying the schema named by `schema`. Property\nnames and types are determined entirely by that schema.\n"),
+		metadata: zod.object({
+			created_at: zod.iso.datetime({ offset: true }).describe("The time when the user was created."),
+			updated_at: zod.iso.datetime({ offset: true }).describe("The time when the user was last updated."),
+			status: zod.enum([
+				"active",
+				"suspended",
+				"deactivated",
+				"pending_purge"
+			]).describe("The status of the user."),
+			lifecycle_owner_team_id: zod.union([zod.string(), zod.null()]).optional().describe("The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team roster: it decides who may deprovision the user, not\nwhich teams the user collaborates in. The roster is its own paginated\nresource — `GET /users/{user_id}/teams`.\n")
+		})
+	}).describe("A user represents an individual identity in the system. It can be used to\nrepresent a human user, but also a service account or any other type of\nidentity.\n\n`attributes` is the document that satisfies the user schema named by\n`schema`: its property names and types are defined entirely by that schema,\nand it is what the schema validates. The rest of the object — `id`,\n`schema`, `metadata` — is the server-owned envelope. Keeping the two apart\nmeans a schema may name a property `id` or `metadata` without colliding with\nthe envelope, and closed-world keywords (`additionalProperties: false`,\n`propertyNames`, `unevaluatedProperties`) behave as their author expects.\n")),
+	next_page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results.\n")
+}).describe("Paginated list of users.");
 /**
 * @summary Get user by ID
 */
 const getUserByIDPathUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const GetUserByIDParams = zod.object({ user_id: zod.string().regex(getUserByIDPathUserIdRegExp) });
-const getUserByIDQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const getUserByIDQueryTeamIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const GetUserByIDQueryParams = zod.strictObject({
-	project_id: zod.string().regex(getUserByIDQueryProjectIdRegExp).describe("The unique identifier of the project"),
-	team_id: zod.string().regex(getUserByIDQueryTeamIdRegExp).optional().describe("The unique identifier of the team")
+const GetUserByIDQueryParams = zod.strictObject({ team_id: zod.string().regex(getUserByIDQueryTeamIdRegExp).optional().describe("The unique identifier of the team") });
+const getUserByIDResponseIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const GetUserByIDResponse = zod.object({
+	id: zod.string().regex(getUserByIDResponseIdRegExp),
+	schema: zod.string().describe("The schema that defines the content of `attributes`. These schemas can be\ncreated using the `/schemas` endpoint. A default schema is provided.\nThis schema can be retrieved using the same endpoint.\n"),
+	attributes: zod.record(zod.string(), zod.unknown()).describe("The user's content, satisfying the schema named by `schema`. Property\nnames and types are determined entirely by that schema.\n"),
+	metadata: zod.object({
+		created_at: zod.iso.datetime({ offset: true }).describe("The time when the user was created."),
+		updated_at: zod.iso.datetime({ offset: true }).describe("The time when the user was last updated."),
+		status: zod.enum([
+			"active",
+			"suspended",
+			"deactivated",
+			"pending_purge"
+		]).describe("The status of the user."),
+		lifecycle_owner_team_id: zod.union([zod.string(), zod.null()]).optional().describe("The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team roster: it decides who may deprovision the user, not\nwhich teams the user collaborates in. The roster is its own paginated\nresource — `GET /users/{user_id}/teams`.\n")
+	})
+}).describe("A user represents an individual identity in the system. It can be used to\nrepresent a human user, but also a service account or any other type of\nidentity.\n\n`attributes` is the document that satisfies the user schema named by\n`schema`: its property names and types are defined entirely by that schema,\nand it is what the schema validates. The rest of the object — `id`,\n`schema`, `metadata` — is the server-owned envelope. Keeping the two apart\nmeans a schema may name a property `id` or `metadata` without colliding with\nthe envelope, and closed-world keywords (`additionalProperties: false`,\n`propertyNames`, `unevaluatedProperties`) behave as their author expects.\n");
+/**
+* @summary Delete user by ID
+*/
+const deleteUserByIDPathUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const DeleteUserByIDParams = zod.object({ user_id: zod.string().regex(deleteUserByIDPathUserIdRegExp) });
+/**
+* @summary List user passkeys
+*/
+const listUserPasskeysPathUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const ListUserPasskeysParams = zod.object({ user_id: zod.string().regex(listUserPasskeysPathUserIdRegExp) });
+const listUserPasskeysQueryLimitDefault = 20;
+const listUserPasskeysQueryLimitMax = 100;
+const ListUserPasskeysQueryParams = zod.strictObject({
+	limit: zod.number().min(1).max(100).default(20).describe("Maximum number of items to return."),
+	page_token: zod.string().optional().describe("Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n")
 });
-const GetUserByIDResponse = zod.record(zod.string(), zod.unknown());
+const ListUserPasskeysResponse = zod.object({
+	passkeys: zod.array(zod.object({
+		id: zod.string().describe("The unique identifier of the passkey."),
+		name: zod.string().describe("The name of the passkey."),
+		created_at: zod.iso.datetime({ offset: true }).describe("The timestamp when the passkey was created.")
+	})),
+	next_page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results.\n")
+}).describe("Response containing the user's passkeys.");
 /**
 * @summary Set user password
 */
 const setUserPasswordPathUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const SetUserPasswordParams = zod.object({ user_id: zod.string().regex(setUserPasswordPathUserIdRegExp) });
-const setUserPasswordQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const SetUserPasswordQueryParams = zod.strictObject({ project_id: zod.string().regex(setUserPasswordQueryProjectIdRegExp).describe("The unique identifier of the project") });
 const SetUserPasswordBody = zod.object({
 	password: zod.string().describe("The new password for the user."),
-	isChangeRequired: zod.boolean().optional().describe("Whether the user is required to change their password on the next login.\nIf not provided, it will default to false.\n")
+	is_change_required: zod.boolean().optional().describe("Whether the user is required to change their password on the next login.\nIf not provided, it will default to false.\n")
 }).describe("Request to update the user's password.");
 /**
+* The user's team roster, ordered by team name. Each entry carries the
+team's name, so a client renders a page without resolving ids one by one.
+
+This is the N:N roster and it is not lifecycle ownership: the single team
+that owns the user's lifecycle is reported as `metadata.lifecycle_owner_team_id`
+on the user read endpoints. Memberships the user was removed from are not
+returned.
+
+* @summary List the teams a user belongs to
+*/
+const listUserTeamsPathUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const ListUserTeamsParams = zod.object({ user_id: zod.string().regex(listUserTeamsPathUserIdRegExp) });
+const listUserTeamsQueryLimitDefault = 20;
+const listUserTeamsQueryLimitMax = 100;
+const ListUserTeamsQueryParams = zod.strictObject({
+	limit: zod.number().min(1).max(100).default(20).describe("Maximum number of items to return."),
+	page_token: zod.string().optional().describe("Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n")
+});
+const ListUserTeamsResponse = zod.object({
+	teams: zod.array(zod.object({
+		id: zod.string().describe("The unique identifier of the team."),
+		name: zod.string().describe("The name of the team."),
+		membership_status: zod.enum([
+			"pending",
+			"active",
+			"inactive"
+		]).describe("The user's participation state on this team. Memberships the user was\nremoved from are not returned.\n"),
+		created_at: zod.iso.datetime({ offset: true }).describe("The time when the user joined this team."),
+		updated_at: zod.iso.datetime({ offset: true }).describe("The time when this membership was last changed.")
+	}).describe("One entry of a user's team roster: a team the user belongs to, with the\nmembership's participation state. The team's `name` travels with the entry, so\na page renders without a follow-up `POST /teams/query` per row.\n\nRoster membership is not lifecycle ownership. A user can belong to many teams\nwhile still owning their own lifecycle — that single owning team is reported\nas `metadata.lifecycle_owner_team_id` on the user itself.\n")),
+	next_page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results.\n")
+}).describe("Paginated list of the teams a user belongs to.");
+/**
 * @summary Get my user information
 */
-const GetMyUserResponse = zod.record(zod.string(), zod.unknown());
+const getMyUserResponseIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const GetMyUserResponse = zod.object({
+	id: zod.string().regex(getMyUserResponseIdRegExp),
+	schema: zod.string().describe("The schema that defines the content of `attributes`. These schemas can be\ncreated using the `/schemas` endpoint. A default schema is provided.\nThis schema can be retrieved using the same endpoint.\n"),
+	attributes: zod.record(zod.string(), zod.unknown()).describe("The user's content, satisfying the schema named by `schema`. Property\nnames and types are determined entirely by that schema.\n"),
+	metadata: zod.object({
+		created_at: zod.iso.datetime({ offset: true }).describe("The time when the user was created."),
+		updated_at: zod.iso.datetime({ offset: true }).describe("The time when the user was last updated."),
+		status: zod.enum([
+			"active",
+			"suspended",
+			"deactivated",
+			"pending_purge"
+		]).describe("The status of the user."),
+		lifecycle_owner_team_id: zod.union([zod.string(), zod.null()]).optional().describe("The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team roster: it decides who may deprovision the user, not\nwhich teams the user collaborates in. The roster is its own paginated\nresource — `GET /users/{user_id}/teams`.\n")
+	})
+}).describe("A user represents an individual identity in the system. It can be used to\nrepresent a human user, but also a service account or any other type of\nidentity.\n\n`attributes` is the document that satisfies the user schema named by\n`schema`: its property names and types are defined entirely by that schema,\nand it is what the schema validates. The rest of the object — `id`,\n`schema`, `metadata` — is the server-owned envelope. Keeping the two apart\nmeans a schema may name a property `id` or `metadata` without colliding with\nthe envelope, and closed-world keywords (`additionalProperties: false`,\n`propertyNames`, `unevaluatedProperties`) behave as their author expects.\n");
 /**
 * Resolves a flow definition based on purpose + audience context and returns
 the first capability step. Creates a new session implicitly unless
 `session_id` is provided (for step-up / reauth on an existing session).
 
 The response contains an `id` field — the flow handle. Use it as the path
-parameter for all subsequent `/flow/{id}/submit` and `/flow/{id}/event` calls.
+parameter for all subsequent `/flow/{id}/submit` calls.
 
 The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
 the flow's orchestration state (current step, collected data, history).
@@ -285,6 +218,7 @@ const getFlowStepResponseStepActionsDefault = [];
 const getFlowStepResponseStepGatesDefault = {};
 const getFlowStepResponseStepSsoProvidersDefault = [];
 const getFlowStepResponseBrandingLayoutDefault = `centered`;
+const getFlowStepResponseBrandingLiquidTemplateMax = 131072;
 const GetFlowStepResponse = zod.object({
 	id: zod.string().describe("Flow handle. Use this as the path parameter for subsequent\nsubmit/event calls. May change between responses when a\nflow pivot or pop occurs.\n"),
 	session_id: zod.string().describe("Underlying session ID. Stable across all stacked flows."),
@@ -356,12 +290,12 @@ const GetFlowStepResponse = zod.object({
 		}).optional().describe("A pending authentication challenge issued by the server. Present when the\nflow engine has issued a challenge via auth_attempts (e.g., after the user\nsubmits `action: \"passkey\"`). The `<zl-passkey>` component reads this and\ntriggers the appropriate WebAuthn ceremony.\n\nThe challenge is NOT present on the initial step — it appears only after\nthe user explicitly selects a ceremony-based action.\n")
 	}).describe("A step contains ordered capability arrays: what to collect (fields),\nwhat the user can do (actions), and what security gates must be satisfied (gates).\nThe LiquidJS template in `branding.liquid_template` iterates these arrays in order\nand builds name-keyed indexes locally for lookup.\n"),
 	branding: zod.object({
-		layout: zod.enum(["centered", "split"]).default(getFlowStepResponseBrandingLayoutDefault).describe("Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely.\n"),
-		liquid_template: zod.string().optional().describe("The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n"),
+		layout: zod.enum(["centered", "split"]).default(getFlowStepResponseBrandingLayoutDefault).describe("Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely; it also serves as the degrade target\nwhen a custom template fails component-side validation.\n"),
+		liquid_template: zod.string().max(getFlowStepResponseBrandingLiquidTemplateMax).optional().describe("The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n"),
 		logo_url: zod.url().optional().describe("Team logo URL."),
-		font_url: zod.url().optional().describe("Custom font URL (e.g., Google Fonts CSS)."),
+		font_url: zod.url().optional().describe("Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in\nv1: `POST /branding` rejects a non-empty value, because the login\ncomponent loads this stylesheet at document level (shadow-scoped\n`@font-face` rules never register faces) and an arbitrary URL would\ngrant `branding.write` page-wide CSS control over the embedding\napplication. Safe tenant font delivery is an ADR 040 follow-up;\nuntil then, load fonts from the embedding page.\n"),
 		hero_url: zod.url().optional().describe("Hero/background image URL (used by split layout).")
-	}).optional().describe("Resolved branding configuration. Inherited from the app → team → project\nhierarchy at flow creation time (most specific wins). Read-only projection —\nbranding is configured via the Team/App Branding API, not the Flow API.\n"),
+	}).optional().describe("Branding configuration. Appears in two places with one shape:\n\n- On flow responses as a read-only projection: the server resolves the\n  latest branding revision for the project per step response (falling\n  back to built-in defaults when none is stored). Branding is configured\n  via the Branding API / `zitadel apply`, not the Flow API.\n- As the request body of `POST /branding`, which publishes the same\n  shape as a new immutable revision (see ADR 040).\n"),
 	redirect_uri: zod.url().optional().describe("Present when `step.complete` is `redirect`."),
 	handoff_token: zod.string().optional().describe("Short-lived, audience-bound token produced on flow completion.\nExchange it for a session via `POST /sessions/exchange`.\nOnly present when `step.complete` is set.\n"),
 	handoff_token_expires_at: zod.iso.datetime({ offset: true }).optional().describe("Expiry timestamp for `handoff_token`. Only present when\n`handoff_token` is set.\n")
@@ -420,6 +354,7 @@ const submitFlowStepResponseStepActionsDefault = [];
 const submitFlowStepResponseStepGatesDefault = {};
 const submitFlowStepResponseStepSsoProvidersDefault = [];
 const submitFlowStepResponseBrandingLayoutDefault = `centered`;
+const submitFlowStepResponseBrandingLiquidTemplateMax = 131072;
 const SubmitFlowStepResponse = zod.object({
 	id: zod.string().describe("Flow handle. Use this as the path parameter for subsequent\nsubmit/event calls. May change between responses when a\nflow pivot or pop occurs.\n"),
 	session_id: zod.string().describe("Underlying session ID. Stable across all stacked flows."),
@@ -491,29 +426,17 @@ const SubmitFlowStepResponse = zod.object({
 		}).optional().describe("A pending authentication challenge issued by the server. Present when the\nflow engine has issued a challenge via auth_attempts (e.g., after the user\nsubmits `action: \"passkey\"`). The `<zl-passkey>` component reads this and\ntriggers the appropriate WebAuthn ceremony.\n\nThe challenge is NOT present on the initial step — it appears only after\nthe user explicitly selects a ceremony-based action.\n")
 	}).describe("A step contains ordered capability arrays: what to collect (fields),\nwhat the user can do (actions), and what security gates must be satisfied (gates).\nThe LiquidJS template in `branding.liquid_template` iterates these arrays in order\nand builds name-keyed indexes locally for lookup.\n"),
 	branding: zod.object({
-		layout: zod.enum(["centered", "split"]).default(submitFlowStepResponseBrandingLayoutDefault).describe("Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely.\n"),
-		liquid_template: zod.string().optional().describe("The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n"),
+		layout: zod.enum(["centered", "split"]).default(submitFlowStepResponseBrandingLayoutDefault).describe("Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely; it also serves as the degrade target\nwhen a custom template fails component-side validation.\n"),
+		liquid_template: zod.string().max(submitFlowStepResponseBrandingLiquidTemplateMax).optional().describe("The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n"),
 		logo_url: zod.url().optional().describe("Team logo URL."),
-		font_url: zod.url().optional().describe("Custom font URL (e.g., Google Fonts CSS)."),
+		font_url: zod.url().optional().describe("Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in\nv1: `POST /branding` rejects a non-empty value, because the login\ncomponent loads this stylesheet at document level (shadow-scoped\n`@font-face` rules never register faces) and an arbitrary URL would\ngrant `branding.write` page-wide CSS control over the embedding\napplication. Safe tenant font delivery is an ADR 040 follow-up;\nuntil then, load fonts from the embedding page.\n"),
 		hero_url: zod.url().optional().describe("Hero/background image URL (used by split layout).")
-	}).optional().describe("Resolved branding configuration. Inherited from the app → team → project\nhierarchy at flow creation time (most specific wins). Read-only projection —\nbranding is configured via the Team/App Branding API, not the Flow API.\n"),
+	}).optional().describe("Branding configuration. Appears in two places with one shape:\n\n- On flow responses as a read-only projection: the server resolves the\n  latest branding revision for the project per step response (falling\n  back to built-in defaults when none is stored). Branding is configured\n  via the Branding API / `zitadel apply`, not the Flow API.\n- As the request body of `POST /branding`, which publishes the same\n  shape as a new immutable revision (see ADR 040).\n"),
 	redirect_uri: zod.url().optional().describe("Present when `step.complete` is `redirect`."),
 	handoff_token: zod.string().optional().describe("Short-lived, audience-bound token produced on flow completion.\nExchange it for a session via `POST /sessions/exchange`.\nOnly present when `step.complete` is set.\n"),
 	handoff_token_expires_at: zod.iso.datetime({ offset: true }).optional().describe("Expiry timestamp for `handoff_token`. Only present when\n`handoff_token` is set.\n")
 });
 /**
-* Submits telemetry or fingerprint data from the frontend.
-Does not advance the state machine. Used for risk evaluation.
-
-* @summary Submit client-side event
-*/
-const SubmitFlowEventParams = zod.object({ id: zod.string().describe("Flow ID returned by POST /flow or the latest POST /flow/{id}/submit.\nUsed to look up the correct flow state from the encrypted cookie,\nwhich can hold multiple concurrent flows. May change between responses\nwhen a flow pivot or pop occurs — always use the `id` from the latest response.\n") });
-const SubmitFlowEventBody = zod.object({
-	session_token: zod.string().optional().describe("Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today."),
-	type: zod.enum(["fingerprint", "telemetry"]),
-	payload: zod.record(zod.string(), zod.unknown()).optional().describe("Event payload (fingerprint hash, timing data, etc.).")
-});
-/**
 * Starts a new authentication attempt. This is the entry point for the auth_attempts state machine.
 
 An attempt is an ephemeral (15-minute TTL) state machine that drives a single authentication round.
@@ -525,11 +448,11 @@ also include session_id to add factors to an existing session.
 * @summary Create a new authentication attempt
 */
 const createAuthAttemptBodyProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const createAuthAttemptBodySessionIdOneRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const createAuthAttemptBodySessionIdOneRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const CreateAuthAttemptBody = zod.object({
 	project_id: zod.string().regex(createAuthAttemptBodyProjectIdRegExp),
 	challenge_nonce: zod.string().optional().describe("Origin-bound, single-use nonce obtained from `POST /bootstrap/challenge`.\nBinds the request to the browser that initiated the flow, preventing\ncross-origin replay.\n"),
-	session_id: zod.union([zod.string().regex(createAuthAttemptBodySessionIdOneRegExp).describe("Unique identifier for this session."), zod.null()]).optional().describe("Optional. If provided, this attempt adds factors to an existing session (step-up auth).\nIf omitted, a new session is created implicitly on successful handoff.\n")
+	session_id: zod.union([zod.string().regex(createAuthAttemptBodySessionIdOneRegExp).describe("Unique identifier for this session (dialect-minted prefixed opaque string)."), zod.null()]).optional().describe("Optional. If provided, this attempt adds factors to an existing session (step-up auth).\nIf omitted, a new session is created implicitly on successful handoff.\n")
 }).describe("Request to create a new authentication attempt");
 /**
 * Polls the current state of an authentication attempt.
@@ -542,16 +465,16 @@ a federated IdP callback or a device flow).
 
 * @summary Get authentication attempt state
 */
-const getAuthAttemptPathAttemptIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getAuthAttemptPathAttemptIdRegExp = /* @__PURE__ */ new RegExp("^att_[a-zA-Z0-9_-]+$");
 const GetAuthAttemptParams = zod.object({ attempt_id: zod.string().regex(getAuthAttemptPathAttemptIdRegExp).describe("The unique identifier of the authentication attempt") });
-const getAuthAttemptResponseAttemptIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getAuthAttemptResponseAttemptIdRegExp = /* @__PURE__ */ new RegExp("^att_[a-zA-Z0-9_-]+$");
 const getAuthAttemptResponseProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const getAuthAttemptResponseSessionIdOneRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getAuthAttemptResponseSessionIdOneRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const getAuthAttemptResponseUserIdOneRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const getAuthAttemptResponseCompletedFactorsItemPayloadOneUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
-const getAuthAttemptResponseChallengesItemChallengeIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getAuthAttemptResponseChallengesItemChallengeIdRegExp = /* @__PURE__ */ new RegExp("^ch_[a-zA-Z0-9_-]+$");
 const GetAuthAttemptResponse = zod.object({
-	attempt_id: zod.string().regex(getAuthAttemptResponseAttemptIdRegExp).describe("Unique identifier for this authentication attempt"),
+	attempt_id: zod.string().regex(getAuthAttemptResponseAttemptIdRegExp).describe("Unique identifier for this authentication attempt (dialect-minted prefixed opaque string)."),
 	project_id: zod.string().regex(getAuthAttemptResponseProjectIdRegExp),
 	state: zod.enum([
 		"in_progress",
@@ -559,7 +482,7 @@ const GetAuthAttemptResponse = zod.object({
 		"failed",
 		"expired"
 	]).describe("Overall state of the authentication attempt:\n- `in_progress`: factors are still being collected; continue issuing challenges.\n- `completed`: all required factors have been verified; the attempt is ready for handoff.\n- `failed`: the attempt has failed (e.g. too many failed proofs) and cannot be continued.\n- `expired`: the 15-minute TTL has been exceeded.\n"),
-	session_id: zod.union([zod.string().regex(getAuthAttemptResponseSessionIdOneRegExp).describe("Unique identifier for this session."), zod.null()]).optional().describe("The session being authenticated into. Either newly created or passed in on POST.\nFor step-up (re-auth), this is the existing session_id provided on creation.\n"),
+	session_id: zod.union([zod.string().regex(getAuthAttemptResponseSessionIdOneRegExp).describe("Unique identifier for this session (dialect-minted prefixed opaque string)."), zod.null()]).optional().describe("The session being authenticated into. Either newly created or passed in on POST.\nFor step-up (re-auth), this is the existing session_id provided on creation.\n"),
 	user_id: zod.union([zod.string().regex(getAuthAttemptResponseUserIdOneRegExp), zod.null()]).optional().describe("The user ID, if known at this point in the flow.\nNull until an identifier challenge has been verified.\n"),
 	required_factors: zod.array(zod.enum([
 		"identifier",
@@ -586,7 +509,7 @@ const GetAuthAttemptResponse = zod.object({
 		]).optional().describe("Method-specific factor metadata. Structure depends on the `method` field.\n- `identifier`: includes user_id\n- `password`: no additional data\n- `passkey`: includes credential details and verification flags\n")
 	}).describe("A successfully verified authentication factor with verification metadata.\nMethod-specific details are included in the `payload` field.\n")).optional().describe("The factors that have been successfully verified in this attempt so far.\nEach item includes method-specific metadata in the payload field.\n\nThe flow engine uses verified_at timestamps to enforce time-based policies, such as\nrequiring password verification within the last 5 minutes for step-up auth to\naccess sensitive operations.\n\nA factor appears here once its challenge reaches `verified` state.\n"),
 	challenges: zod.array(zod.object({
-		challenge_id: zod.string().regex(getAuthAttemptResponseChallengesItemChallengeIdRegExp).describe("Unique identifier for this challenge"),
+		challenge_id: zod.string().regex(getAuthAttemptResponseChallengesItemChallengeIdRegExp).describe("Unique identifier for this challenge (dialect-minted prefixed opaque string)."),
 		method: zod.enum([
 			"identifier",
 			"password",
@@ -630,7 +553,7 @@ by calling POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.
 
 * @summary Issue a factor challenge
 */
-const issueChallengePathAttemptIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const issueChallengePathAttemptIdRegExp = /* @__PURE__ */ new RegExp("^att_[a-zA-Z0-9_-]+$");
 const IssueChallengeParams = zod.object({ attempt_id: zod.string().regex(issueChallengePathAttemptIdRegExp).describe("The unique identifier of the authentication attempt") });
 const IssueChallengeBody = zod.object({
 	method: zod.enum([
@@ -662,8 +585,8 @@ The attempt moves to the next pending challenge or completes if all required fac
 
 * @summary Verify a factor proof
 */
-const verifyChallengeProofPathAttemptIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const verifyChallengeProofPathChallengeIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const verifyChallengeProofPathAttemptIdRegExp = /* @__PURE__ */ new RegExp("^att_[a-zA-Z0-9_-]+$");
+const verifyChallengeProofPathChallengeIdRegExp = /* @__PURE__ */ new RegExp("^ch_[a-zA-Z0-9_-]+$");
 const VerifyChallengeProofParams = zod.object({
 	attempt_id: zod.string().regex(verifyChallengeProofPathAttemptIdRegExp).describe("The unique identifier of the authentication attempt"),
 	challenge_id: zod.string().regex(verifyChallengeProofPathChallengeIdRegExp).describe("The unique identifier of this challenge.")
@@ -674,14 +597,14 @@ const VerifyChallengeProofBody = zod.union([
 	zod.object({ password: zod.string().describe("The password being verified") }).describe("Proof for `password` method"),
 	zod.object({ passkey: zod.object({ assertion: zod.record(zod.string(), zod.unknown()).describe("The WebAuthn AssertionResponse object") }).describe("WebAuthn passkey assertion") }).describe("Proof for `passkey` method")
 ]).describe("Proof for verifying a factor challenge.\n\nThe exact format depends on the challenge method. The proof object should contain\nonly the credential/code/assertion relevant to the challenge method being verified.\n");
-const verifyChallengeProofResponseAttemptIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const verifyChallengeProofResponseAttemptIdRegExp = /* @__PURE__ */ new RegExp("^att_[a-zA-Z0-9_-]+$");
 const verifyChallengeProofResponseProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const verifyChallengeProofResponseSessionIdOneRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const verifyChallengeProofResponseSessionIdOneRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const verifyChallengeProofResponseUserIdOneRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const verifyChallengeProofResponseCompletedFactorsItemPayloadOneUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
-const verifyChallengeProofResponseChallengesItemChallengeIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const verifyChallengeProofResponseChallengesItemChallengeIdRegExp = /* @__PURE__ */ new RegExp("^ch_[a-zA-Z0-9_-]+$");
 const VerifyChallengeProofResponse = zod.object({
-	attempt_id: zod.string().regex(verifyChallengeProofResponseAttemptIdRegExp).describe("Unique identifier for this authentication attempt"),
+	attempt_id: zod.string().regex(verifyChallengeProofResponseAttemptIdRegExp).describe("Unique identifier for this authentication attempt (dialect-minted prefixed opaque string)."),
 	project_id: zod.string().regex(verifyChallengeProofResponseProjectIdRegExp),
 	state: zod.enum([
 		"in_progress",
@@ -689,7 +612,7 @@ const VerifyChallengeProofResponse = zod.object({
 		"failed",
 		"expired"
 	]).describe("Overall state of the authentication attempt:\n- `in_progress`: factors are still being collected; continue issuing challenges.\n- `completed`: all required factors have been verified; the attempt is ready for handoff.\n- `failed`: the attempt has failed (e.g. too many failed proofs) and cannot be continued.\n- `expired`: the 15-minute TTL has been exceeded.\n"),
-	session_id: zod.union([zod.string().regex(verifyChallengeProofResponseSessionIdOneRegExp).describe("Unique identifier for this session."), zod.null()]).optional().describe("The session being authenticated into. Either newly created or passed in on POST.\nFor step-up (re-auth), this is the existing session_id provided on creation.\n"),
+	session_id: zod.union([zod.string().regex(verifyChallengeProofResponseSessionIdOneRegExp).describe("Unique identifier for this session (dialect-minted prefixed opaque string)."), zod.null()]).optional().describe("The session being authenticated into. Either newly created or passed in on POST.\nFor step-up (re-auth), this is the existing session_id provided on creation.\n"),
 	user_id: zod.union([zod.string().regex(verifyChallengeProofResponseUserIdOneRegExp), zod.null()]).optional().describe("The user ID, if known at this point in the flow.\nNull until an identifier challenge has been verified.\n"),
 	required_factors: zod.array(zod.enum([
 		"identifier",
@@ -716,7 +639,7 @@ const VerifyChallengeProofResponse = zod.object({
 		]).optional().describe("Method-specific factor metadata. Structure depends on the `method` field.\n- `identifier`: includes user_id\n- `password`: no additional data\n- `passkey`: includes credential details and verification flags\n")
 	}).describe("A successfully verified authentication factor with verification metadata.\nMethod-specific details are included in the `payload` field.\n")).optional().describe("The factors that have been successfully verified in this attempt so far.\nEach item includes method-specific metadata in the payload field.\n\nThe flow engine uses verified_at timestamps to enforce time-based policies, such as\nrequiring password verification within the last 5 minutes for step-up auth to\naccess sensitive operations.\n\nA factor appears here once its challenge reaches `verified` state.\n"),
 	challenges: zod.array(zod.object({
-		challenge_id: zod.string().regex(verifyChallengeProofResponseChallengesItemChallengeIdRegExp).describe("Unique identifier for this challenge"),
+		challenge_id: zod.string().regex(verifyChallengeProofResponseChallengesItemChallengeIdRegExp).describe("Unique identifier for this challenge (dialect-minted prefixed opaque string)."),
 		method: zod.enum([
 			"identifier",
 			"password",
@@ -764,7 +687,7 @@ The handoff token is:
 
 * @summary Complete authentication and create handoff token
 */
-const createHandoffPathAttemptIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const createHandoffPathAttemptIdRegExp = /* @__PURE__ */ new RegExp("^att_[a-zA-Z0-9_-]+$");
 const CreateHandoffParams = zod.object({ attempt_id: zod.string().regex(createHandoffPathAttemptIdRegExp).describe("The unique identifier of the authentication attempt") });
 const CreateHandoffHeader = zod.strictObject({ "Idempotency-Key": zod.string().optional().describe("Optional retry key for safe retries of the call.\nRetries carrying the same key within the call window return the cached\npayload without creating a new resource. See details in the endpoint description.\n") });
 const CreateHandoffResponse = zod.object({
@@ -777,8 +700,8 @@ const CreateHandoffResponse = zod.object({
 const createProjectBodySeedDefaultsDefault = true;
 const CreateProjectBody = zod.object({
 	name: zod.string().describe("The name of the project."),
-	previewOrigins: zod.array(zod.string()).optional().describe("Origins which are allowed for previewing and testing the project.\n"),
-	seedDefaults: zod.boolean().default(true).describe("Whether the server should provision fallback default user schema and flow\nresources for the project. CLI-managed projects set this to false and\nupload their local .zitadel config files through the schema and flow APIs.\n")
+	preview_origins: zod.array(zod.string()).optional().describe("Origins which are allowed for previewing and testing the project.\n"),
+	seed_defaults: zod.boolean().default(true).describe("Whether the server should provision fallback default user schema and flow\nresources for the project. CLI-managed projects set this to false and\nupload their local .zitadel config files through the schema and flow APIs.\n")
 });
 /**
 * @summary Query projects
@@ -787,13 +710,13 @@ const queryProjectsBodyLimitDefault = 20;
 const queryProjectsBodyLimitMax = 100;
 const QueryProjectsBody = zod.object({
 	limit: zod.number().min(1).max(100).default(20),
-	page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to retrieve the next page of results."),
+	page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to retrieve the next page of results. Must be sent with the same\n`sorting` as the request that issued the token. Omitting `sorting` reuses\nthe default sort and only succeeds when that default matches the token.\n"),
 	sorting: zod.object({
-		field: zod.enum(["name", "createdAt"]),
+		field: zod.enum(["created_at"]),
 		direction: zod.enum(["asc", "desc"])
 	}).optional(),
 	filter: zod.array(zod.object({
-		field: zod.enum(["name", "createdAt"]),
+		field: zod.enum(["created_at"]),
 		value: zod.union([
 			zod.string(),
 			zod.number(),
@@ -809,18 +732,18 @@ const QueryProjectsBody = zod.object({
 			"less_than_or_equal",
 			"greater_than",
 			"greater_than_or_equal"
-		]).describe("Filter operation defines the operations which can be used when filtering on a\nquery endpoint.\n")
+		]).describe("Filter operation defines the operations which can be used when filtering on a\nquery endpoint.\n\nOn text fields, `contains` is a case-insensitive substring match. `equals`\ncompares the whole value and is case-sensitive unless the field documents\notherwise.\n")
 	})).optional().describe("Filter criteria for querying projects.")
 }).describe("Request to query projects.");
 const QueryProjectsResponse = zod.object({
 	projects: zod.array(zod.object({
 		id: zod.string().describe("The unique identifier of the project."),
 		name: zod.string().describe("The name of the project."),
-		previewOrigins: zod.array(zod.string()).optional().describe("Origins which are allowed for previewing and testing the project.\n"),
-		createdAt: zod.iso.datetime({ offset: true }).describe("The time when the project was created."),
-		updatedAt: zod.iso.datetime({ offset: true }).describe("The time when the project was last updated.")
+		preview_origins: zod.array(zod.string()).optional().describe("Origins which are allowed for previewing and testing the project.\n"),
+		created_at: zod.iso.datetime({ offset: true }).describe("The time when the project was created."),
+		updated_at: zod.iso.datetime({ offset: true }).describe("The time when the project was last updated.")
 	}).describe("The current state of a project.")),
-	next_page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results.\n")
+	next_page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results. The follow-up request must repeat the\nsame `sorting` that produced this token (omit only when both pages use the default).\n")
 }).describe("Paginated list of projects.");
 /**
 * Returns the current state of a project.
@@ -832,9 +755,9 @@ const GetProjectParams = zod.object({ project_id: zod.string().regex(getProjectP
 const GetProjectResponse = zod.object({
 	id: zod.string().describe("The unique identifier of the project."),
 	name: zod.string().describe("The name of the project."),
-	previewOrigins: zod.array(zod.string()).optional().describe("Origins which are allowed for previewing and testing the project.\n"),
-	createdAt: zod.iso.datetime({ offset: true }).describe("The time when the project was created."),
-	updatedAt: zod.iso.datetime({ offset: true }).describe("The time when the project was last updated.")
+	preview_origins: zod.array(zod.string()).optional().describe("Origins which are allowed for previewing and testing the project.\n"),
+	created_at: zod.iso.datetime({ offset: true }).describe("The time when the project was created."),
+	updated_at: zod.iso.datetime({ offset: true }).describe("The time when the project was last updated.")
 }).describe("The current state of a project.");
 /**
 * Updates the state of a project.
@@ -847,11 +770,60 @@ const PatchProjectBody = zod.object({ name: zod.union([zod.null(), zod.string()]
 const PatchProjectResponse = zod.object({
 	id: zod.string().describe("The unique identifier of the project."),
 	name: zod.string().describe("The name of the project."),
-	previewOrigins: zod.array(zod.string()).optional().describe("Origins which are allowed for previewing and testing the project.\n"),
-	createdAt: zod.iso.datetime({ offset: true }).describe("The time when the project was created."),
-	updatedAt: zod.iso.datetime({ offset: true }).describe("The time when the project was last updated.")
+	preview_origins: zod.array(zod.string()).optional().describe("Origins which are allowed for previewing and testing the project.\n"),
+	created_at: zod.iso.datetime({ offset: true }).describe("The time when the project was created."),
+	updated_at: zod.iso.datetime({ offset: true }).describe("The time when the project was last updated.")
 }).describe("The current state of a project.");
 /**
+* Starts a claim challenge for an unclaimed project. Authenticated by the
+project secret, this mints a single-use, short-lived challenge and returns
+the `claim_url` the developer opens in a browser to complete the claim,
+together with the `challenge_id` the CLI polls with. The exact expiry is
+carried by `expires_at` on the response.
+
+* @summary Initialize a project claim
+*/
+const initClaimPathProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const InitClaimParams = zod.object({ project_id: zod.string().regex(initClaimPathProjectIdRegExp) });
+/**
+* Polled by the CLI while a browser completes the claim. Authorized by the
+project secret that initiated the challenge. Returns `pending`, or
+`completed` with the owning team, the claim timestamp, and the dashboard
+URL once the browser leg has finished.
+
+* @summary Get claim status
+*/
+const getClaimStatusPathProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const GetClaimStatusParams = zod.object({ project_id: zod.string().regex(getClaimStatusPathProjectIdRegExp) });
+const getClaimStatusQueryChallengeIdRegExp = /* @__PURE__ */ new RegExp("^ch_[a-zA-Z0-9_-]+$");
+const GetClaimStatusQueryParams = zod.strictObject({ challenge_id: zod.string().regex(getClaimStatusQueryChallengeIdRegExp).describe("The challenge minted by the matching claim init.") });
+const getClaimStatusResponseTwoTeamIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const GetClaimStatusResponse = zod.union([zod.object({ status: zod.enum(["pending"]).describe("The claim has not completed yet.") }).describe("A claim challenge that is still awaiting the browser leg."), zod.object({
+	status: zod.enum(["completed"]).describe("The claim has completed."),
+	team_id: zod.string().regex(getClaimStatusResponseTwoTeamIdRegExp),
+	claimed_at: zod.iso.datetime({ offset: true }).describe("The time when the project was claimed."),
+	dashboard_url: zod.url().describe("The dashboard URL for the owning team.")
+}).describe("A completed claim. Carries the owning team, when the claim landed, and the\ndashboard where it can be managed, so a generated client can rely on those\nfields being present whenever `status` is `completed`.\n")]).describe("The state of a claim challenge. While pending it carries only `status`; once\ncompleted it also carries the owning team, the claim timestamp, and the\ndashboard URL. Modelled as discriminated variants so a `pending` response can\nnever carry stale completion fields and a `completed` response always carries\nthem.\n");
+/**
+* Called by the browser after the developer authenticates on the claim page.
+Authenticated by the `__nextgen_session` cookie, it attaches the project to
+the developer's personal team using the `challenge_id` from the claim URL as
+its single-use, browser-safe authorization.
+
+* @summary Complete a project claim
+*/
+const completeClaimPathProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const CompleteClaimParams = zod.object({ project_id: zod.string().regex(completeClaimPathProjectIdRegExp) });
+const completeClaimBodyChallengeIdRegExp = /* @__PURE__ */ new RegExp("^ch_[a-zA-Z0-9_-]+$");
+const CompleteClaimBody = zod.object({ challenge_id: zod.string().regex(completeClaimBodyChallengeIdRegExp).describe("Unique identifier for this challenge (dialect-minted prefixed opaque string).") }).describe("The request to complete a project claim.");
+const completeClaimResponseProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const completeClaimResponseTeamIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const CompleteClaimResponse = zod.object({
+	project_id: zod.string().regex(completeClaimResponseProjectIdRegExp),
+	team_id: zod.string().regex(completeClaimResponseTeamIdRegExp),
+	claimed_at: zod.iso.datetime({ offset: true }).describe("The time when the project was claimed.")
+}).describe("The result of a completed project claim.");
+/**
 * Creates an anonymous session shell with no user and no factors (`state: building`).
 
 This is optional — an `auth_attempt` will create a session implicitly if none is provided.
@@ -860,8 +832,16 @@ Use this explicitly when you want to:
 can be correlated with the eventual authenticated session from the start.
 - Track anonymous state (bot detection, device fingerprint) that survives until authentication.
 
-The returned `session_token` authorises GET and DELETE on this session.
-It is superseded when a handoff exchange completes — clients must replace it at that point.
+Creating a session is an app-plane operation on the project credential
+(`session.write`). The returned `session_token` is a session credential for the
+end-user client, not a management scope: it is delivered as the
+`__nextgen_session` cookie and authorises the self-service operations
+`GET /sessions/me` and `DELETE /sessions/me` (`nextgenSession` scheme). The
+by-id operations `GET /sessions/{session_id}` and `DELETE /sessions/{session_id}`
+are operator endpoints and require `session.read` / `session.delete` instead.
+
+The `session_token` is superseded when a handoff exchange completes — clients must
+replace it at that point.
 
 Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
 full session TTL when the first authentication factor is written via a completing `auth_attempt`.
@@ -877,42 +857,61 @@ const CreateSessionBody = zod.object({
 	}).optional().describe("Optional user agent / device context to attach to the session.\nUseful for correlating telemetry and device signals with the eventual\nauthenticated session from the start.\n")
 }).describe("Request to create an anonymous session shell.");
 /**
-* Returns a paginated list of sessions for a project.
-Requires a project service key (OAuth2 client credentials).
+* Returns the sessions of a project, paginated with a cursor.
+Sessions of every lifecycle state are returned; each carries its `state`.
+Requires `session.read` permission.
 
-* @summary List sessions
+* @summary Query sessions
 */
-const listSessionsQueryLimitDefault = 20;
-const listSessionsQueryLimitMax = 100;
-const listSessionsQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const listSessionsQueryUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
-const ListSessionsQueryParams = zod.strictObject({
-	limit: zod.number().min(1).max(100).default(20).describe("Maximum number of items to return."),
-	page_token: zod.string().optional().describe("Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n"),
-	project_id: zod.string().regex(listSessionsQueryProjectIdRegExp).describe("The unique identifier of the project"),
-	state: zod.enum([
-		"building",
-		"active",
-		"expired",
-		"revoked"
-	]).optional().describe("Filter sessions by lifecycle state."),
-	user_id: zod.string().regex(listSessionsQueryUserIdRegExp).optional().describe("Filter sessions by user.")
-});
-const listSessionsResponseSessionsItemSessionIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const listSessionsResponseSessionsItemProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const listSessionsResponseSessionsItemUserIdOneRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
-const listSessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
-const ListSessionsResponse = zod.object({
+const querySessionsQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const QuerySessionsQueryParams = zod.strictObject({ project_id: zod.string().regex(querySessionsQueryProjectIdRegExp).describe("The unique identifier of the project") });
+const querySessionsBodyLimitDefault = 20;
+const querySessionsBodyLimitMax = 100;
+const QuerySessionsBody = zod.object({
+	limit: zod.number().min(1).max(100).default(20),
+	page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to retrieve the next page of results."),
+	sorting: zod.object({
+		field: zod.enum(["created_at", "user_id"]).describe("Field to sort sessions by. Only stored columns are sortable: the keyset\ncursor holds the last row's sort values, so a computed value such as\n`state` would skip or duplicate rows between pages.\n"),
+		direction: zod.enum(["asc", "desc"])
+	}).optional(),
+	filter: zod.array(zod.object({
+		field: zod.enum([
+			"created_at",
+			"user_id",
+			"state"
+		]).describe("Field to filter sessions by:\n- `created_at`: RFC3339 timestamp\n- `user_id`: user id\n- `state`: one of `building`, `active`, `expired`. State is computed at read\n  time, so a session expiring mid-request can match `active` but return `expired`.\n"),
+		value: zod.union([
+			zod.string(),
+			zod.number(),
+			zod.boolean(),
+			zod.null()
+		]).optional().describe("Filter-value specifies which values can be filtered by a query endpoint. This\nis a union of types. When a value is specified which is not assignable to the\nfield which is being filtered, a 400 error will be returned.\n"),
+		operation: zod.enum([
+			"equals",
+			"not_equals",
+			"contains",
+			"not_contains",
+			"less_than",
+			"less_than_or_equal",
+			"greater_than",
+			"greater_than_or_equal"
+		]).describe("Filter operation defines the operations which can be used when filtering on a\nquery endpoint.\n\nOn text fields, `contains` is a case-insensitive substring match. `equals`\ncompares the whole value and is case-sensitive unless the field documents\notherwise.\n")
+	})).optional().describe("Filter criteria for querying sessions.")
+}).describe("Request to query the sessions of a project.");
+const querySessionsResponseSessionsItemSessionIdRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
+const querySessionsResponseSessionsItemProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const querySessionsResponseSessionsItemUserIdOneRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const querySessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const QuerySessionsResponse = zod.object({
 	sessions: zod.array(zod.object({
-		session_id: zod.string().regex(listSessionsResponseSessionsItemSessionIdRegExp).describe("Unique identifier for this session."),
-		project_id: zod.string().regex(listSessionsResponseSessionsItemProjectIdRegExp),
+		session_id: zod.string().regex(querySessionsResponseSessionsItemSessionIdRegExp).describe("Unique identifier for this session (dialect-minted prefixed opaque string)."),
+		project_id: zod.string().regex(querySessionsResponseSessionsItemProjectIdRegExp),
 		state: zod.enum([
 			"building",
 			"active",
-			"expired",
-			"revoked"
-		]).describe("Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n- `revoked`: explicitly revoked via DELETE\n"),
-		user_id: zod.union([zod.string().regex(listSessionsResponseSessionsItemUserIdOneRegExp), zod.null()]).optional().describe("The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n"),
+			"expired"
+		]).describe("Current lifecycle state of the session:\n- `building`: no verified authentication factors yet\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n"),
+		user_id: zod.union([zod.string().regex(querySessionsResponseSessionsItemUserIdOneRegExp), zod.null()]).optional().describe("The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n"),
 		name: zod.string().optional().describe("Human-readable name of the authenticated user, resolved from the\nconventional user-schema properties: `name` when defined, otherwise\nthe given and family name parts joined — `givenName`/`familyName`\n(the shipped presets' spelling) or `given_name`/`family_name`. Only\npresent on reads that hydrate the user's identity\n(`GET /sessions/me`) and only when the session has an authenticated\nuser whose schema carries those properties; clients fall back to\n`email`, then `user_id`.\n"),
 		email: zod.string().optional().describe("Email address of the authenticated user, resolved from the\nconventional `email` user-schema property. Only present on reads\nthat hydrate the user's identity (`GET /sessions/me`) and only when\nthe session has an authenticated user whose schema carries that\nproperty.\n"),
 		factors: zod.array(zod.object({
@@ -923,7 +922,7 @@ const ListSessionsResponse = zod.object({
 			]).describe("An authentication factor method."),
 			verified_at: zod.iso.datetime({ offset: true }).describe("When this factor was successfully verified"),
 			payload: zod.union([
-				zod.object({ user_id: zod.string().regex(listSessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp) }).describe("Identifier-specific factor metadata"),
+				zod.object({ user_id: zod.string().regex(querySessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp) }).describe("Identifier-specific factor metadata"),
 				zod.object({}).describe("Password authentication has no additional metadata beyond the base factor fields"),
 				zod.object({
 					credential_id: zod.string().describe("The credential ID that was used"),
@@ -973,20 +972,19 @@ const ExchangeHandoffBody = zod.object({
 	handoff_token: zod.string().describe("The one-time handoff token minted by `POST /auth_attempts/{id}/handoff`.\nSingle-use — replaying it after a successful exchange returns `410 Gone`.\n"),
 	ttl: zod.string().optional().describe("Optional session lifetime after exchange as an ISO-8601 duration. When omitted, the server\nuses the configured default. Must not exceed the configured maximum.\n")
 }).describe("Request to exchange a handoff token for a session and session_token.");
-const exchangeHandoffResponseSessionSessionIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const exchangeHandoffResponseSessionSessionIdRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const exchangeHandoffResponseSessionProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const exchangeHandoffResponseSessionUserIdOneRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const exchangeHandoffResponseSessionFactorsItemPayloadOneUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const ExchangeHandoffResponse = zod.object({
 	session: zod.object({
-		session_id: zod.string().regex(exchangeHandoffResponseSessionSessionIdRegExp).describe("Unique identifier for this session."),
+		session_id: zod.string().regex(exchangeHandoffResponseSessionSessionIdRegExp).describe("Unique identifier for this session (dialect-minted prefixed opaque string)."),
 		project_id: zod.string().regex(exchangeHandoffResponseSessionProjectIdRegExp),
 		state: zod.enum([
 			"building",
 			"active",
-			"expired",
-			"revoked"
-		]).describe("Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n- `revoked`: explicitly revoked via DELETE\n"),
+			"expired"
+		]).describe("Current lifecycle state of the session:\n- `building`: no verified authentication factors yet\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n"),
 		user_id: zod.union([zod.string().regex(exchangeHandoffResponseSessionUserIdOneRegExp), zod.null()]).optional().describe("The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n"),
 		name: zod.string().optional().describe("Human-readable name of the authenticated user, resolved from the\nconventional user-schema properties: `name` when defined, otherwise\nthe given and family name parts joined — `givenName`/`familyName`\n(the shipped presets' spelling) or `given_name`/`family_name`. Only\npresent on reads that hydrate the user's identity\n(`GET /sessions/me`) and only when the session has an authenticated\nuser whose schema carries those properties; clients fall back to\n`email`, then `user_id`.\n"),
 		email: zod.string().optional().describe("Email address of the authenticated user, resolved from the\nconventional `email` user-schema property. Only present on reads\nthat hydrate the user's identity (`GET /sessions/me`) and only when\nthe session has an authenticated user whose schema carries that\nproperty.\n"),
@@ -1030,23 +1028,20 @@ against the same `session_id`) to restore a dropped assurance level.
 
 * @summary Get session state
 */
-const getSessionPathSessionIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getSessionPathSessionIdRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const GetSessionParams = zod.object({ session_id: zod.string().regex(getSessionPathSessionIdRegExp).describe("The unique identifier of the session.") });
-const getSessionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const GetSessionQueryParams = zod.strictObject({ project_id: zod.string().regex(getSessionQueryProjectIdRegExp).describe("The unique identifier of the project") });
-const getSessionResponseSessionIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getSessionResponseSessionIdRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const getSessionResponseProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const getSessionResponseUserIdOneRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const getSessionResponseFactorsItemPayloadOneUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const GetSessionResponse = zod.object({
-	session_id: zod.string().regex(getSessionResponseSessionIdRegExp).describe("Unique identifier for this session."),
+	session_id: zod.string().regex(getSessionResponseSessionIdRegExp).describe("Unique identifier for this session (dialect-minted prefixed opaque string)."),
 	project_id: zod.string().regex(getSessionResponseProjectIdRegExp),
 	state: zod.enum([
 		"building",
 		"active",
-		"expired",
-		"revoked"
-	]).describe("Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n- `revoked`: explicitly revoked via DELETE\n"),
+		"expired"
+	]).describe("Current lifecycle state of the session:\n- `building`: no verified authentication factors yet\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n"),
 	user_id: zod.union([zod.string().regex(getSessionResponseUserIdOneRegExp), zod.null()]).optional().describe("The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n"),
 	name: zod.string().optional().describe("Human-readable name of the authenticated user, resolved from the\nconventional user-schema properties: `name` when defined, otherwise\nthe given and family name parts joined — `givenName`/`familyName`\n(the shipped presets' spelling) or `given_name`/`family_name`. Only\npresent on reads that hydrate the user's identity\n(`GET /sessions/me`) and only when the session has an authenticated\nuser whose schema carries those properties; clients fall back to\n`email`, then `user_id`.\n"),
 	email: zod.string().optional().describe("Email address of the authenticated user, resolved from the\nconventional `email` user-schema property. Only present on reads\nthat hydrate the user's identity (`GET /sessions/me`) and only when\nthe session has an authenticated user whose schema carries that\nproperty.\n"),
@@ -1079,17 +1074,20 @@ const GetSessionResponse = zod.object({
 	expires_at: zod.iso.datetime({ offset: true }).describe("When this session expires. Short TTL (10 min) for anonymous sessions;\nreset to the full configured session TTL once the first authentication factor is written.\n")
 }).describe("The current state of a session.\n\nA session is the durable post-auth primitive. It accumulates verified authentication\nfactors and exposes `assurance_levels[]` — the set of assurance profiles its current\nfactors satisfy. Sessions are read-only from the client's perspective: factors flow\nin through `auth_attempts`.\n");
 /**
-* Revokes the session immediately (`state: revoked`). This is the logout operation.
+* Permanently deletes the session, terminating it immediately.
+
+This is the operator revoke path and requires the `session.delete` scope on a
+project-bound credential. End-user logout with the `__nextgen_session` cookie is
+`DELETE /sessions/me` (`nextgenSession` scheme).
 
-The session_token issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated.
+Idempotent: deleting a session that does not exist (or was already deleted)
+still returns 204. After deletion, any tokens derived from the session are
+invalidated.
 
 * @summary Revoke session
 */
-const revokeSessionPathSessionIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const revokeSessionPathSessionIdRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const RevokeSessionParams = zod.object({ session_id: zod.string().regex(revokeSessionPathSessionIdRegExp).describe("The unique identifier of the session.") });
-const revokeSessionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const RevokeSessionQueryParams = zod.strictObject({ project_id: zod.string().regex(revokeSessionQueryProjectIdRegExp).describe("The unique identifier of the project") });
 /**
 * Returns the current state of the current session including its factors and all currently
 satisfied assurance levels.
@@ -1100,19 +1098,18 @@ against the same `session_id`) to restore a dropped assurance level.
 
 * @summary Get my session state
 */
-const getMySessionResponseSessionIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getMySessionResponseSessionIdRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const getMySessionResponseProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const getMySessionResponseUserIdOneRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const getMySessionResponseFactorsItemPayloadOneUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const GetMySessionResponse = zod.object({
-	session_id: zod.string().regex(getMySessionResponseSessionIdRegExp).describe("Unique identifier for this session."),
+	session_id: zod.string().regex(getMySessionResponseSessionIdRegExp).describe("Unique identifier for this session (dialect-minted prefixed opaque string)."),
 	project_id: zod.string().regex(getMySessionResponseProjectIdRegExp),
 	state: zod.enum([
 		"building",
 		"active",
-		"expired",
-		"revoked"
-	]).describe("Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n- `revoked`: explicitly revoked via DELETE\n"),
+		"expired"
+	]).describe("Current lifecycle state of the session:\n- `building`: no verified authentication factors yet\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n"),
 	user_id: zod.union([zod.string().regex(getMySessionResponseUserIdOneRegExp), zod.null()]).optional().describe("The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n"),
 	name: zod.string().optional().describe("Human-readable name of the authenticated user, resolved from the\nconventional user-schema properties: `name` when defined, otherwise\nthe given and family name parts joined — `givenName`/`familyName`\n(the shipped presets' spelling) or `given_name`/`family_name`. Only\npresent on reads that hydrate the user's identity\n(`GET /sessions/me`) and only when the session has an authenticated\nuser whose schema carries those properties; clients fall back to\n`email`, then `user_id`.\n"),
 	email: zod.string().optional().describe("Email address of the authenticated user, resolved from the\nconventional `email` user-schema property. Only present on reads\nthat hydrate the user's identity (`GET /sessions/me`) and only when\nthe session has an authenticated user whose schema carries that\nproperty.\n"),
@@ -1145,10 +1142,12 @@ const GetMySessionResponse = zod.object({
 	expires_at: zod.iso.datetime({ offset: true }).describe("When this session expires. Short TTL (10 min) for anonymous sessions;\nreset to the full configured session TTL once the first authentication factor is written.\n")
 }).describe("The current state of a session.\n\nA session is the durable post-auth primitive. It accumulates verified authentication\nfactors and exposes `assurance_levels[]` — the set of assurance profiles its current\nfactors satisfy. Sessions are read-only from the client's perspective: factors flow\nin through `auth_attempts`.\n");
 /**
-* Create a new schema. The schema definition must include a unique $id field,
-which will be used to identify the schema in future requests. The $id must
-be a valid URI and should ideally point to the location where the schema
-can be accessed.
+* Create a new schema. The optional `$id` field is the JSON Schema document
+URI used to identify the schema in future requests (GitOps-stable identity,
+not a free-form resource primary key). When `$id` is omitted, the server
+generates a `sch_*` URL. When provided, `$id` must be unique within the
+project and should ideally be a valid URI pointing at where the schema can
+be accessed.
 
 The schema can either be a concrete schema, e.g. a user schema, or a
 schema-url which will be resolved by the server.
@@ -1162,53 +1161,28 @@ const CreateSchemaQueryParams = zod.strictObject({
 	team_id: zod.string().regex(createSchemaQueryTeamIdRegExp).optional().describe("The unique identifier of the team")
 });
 const createSchemaBodyOneObjectTypeMax = 256;
-const createSchemaBodyOneXAuthMethodsPasswordPositionMin = 0;
-const createSchemaBodyOneXAuthMethodsPasskeyPositionMin = 0;
-const createSchemaBodyOneXAuthMethodsMagicLinkPositionMin = 0;
-const createSchemaBodyOneXAuthMethodsSsoPositionMin = 0;
-const createSchemaBodyOneXAuthMethodsOtpPositionMin = 0;
-const createSchemaBodyOnePropertiesXEditableDefault = true;
-const createSchemaBodyOnePropertiesXSensitiveDefault = false;
-const createSchemaBodyOnePropertiesXMfaDefault = false;
+const createSchemaBodyOnePropertiesXAuditDefault = false;
 const CreateSchemaBody = zod.union([zod.object({
 	objectType: zod.string().max(256).optional().describe("The type of user this schema describes. This is a customer chosen name.\n"),
 	kind: zod.literal("user-schema").describe("Discriminator value for a user schema create request."),
 	metaSchema: zod.url().describe("The user Schema version used for this schema."),
 	"x-auth-methods": zod.object({
-		password: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional(),
-		passkey: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional(),
-		magic_link: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional(),
-		sso: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional(),
-		otp: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional()
+		password: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional(),
+		passkey: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional(),
+		magic_link: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional(),
+		sso: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional(),
+		otp: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional()
 	}).describe("A list of authentication methods supported by the user definition."),
 	properties: zod.record(zod.string(), zod.object({
-		"x-verify": zod.union([zod.string(), zod.null()]).optional().describe("The verification method for this property, if applicable"),
 		"x-unique": zod.union([zod.enum([
 			"unspecified",
 			"project",
 			"team"
 		]), zod.null()]).optional().describe("The level of uniqueness for this property, if applicable"),
 		"x-claim": zod.union([zod.string(), zod.null()]).optional().describe("The claim name for this property, if applicable"),
-		"x-editable": zod.boolean().default(true).describe("Whether this property is editable by the user or not"),
-		"x-sensitive": zod.boolean().default(false).describe("Whether this property contains sensitive information or not"),
-		"x-mfa": zod.boolean().default(false).describe("Whether this property is used for multi-factor authentication or not"),
-		properties: zod.record(zod.string(), zod.unknown()).optional().describe("A map of additional properties for the user definition, where the key is the property name and the value is the property schema")
-	}).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n")).optional().describe("A map of additional properties for the user definition, where the\nkey is the property name and the value is the property schema\n")
+		"x-audit": zod.boolean().default(false).describe("Whether this property's value may appear in audit event payloads. Audit\npayloads are deny-by-default: a property without this annotation\ncontributes its key but never its value.\n"),
+		properties: zod.record(zod.string(), zod.unknown()).optional().describe("A map of additional properties for the user definition, where the key is\nthe property name and the value is the property schema.\n")
+	}).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`.\nThis is done because a lot of code generators cannot handle that.\n\nNative JSON Schema keywords such as `type`, `format`, `title` and `writeOnly`\nare accepted without being listed below. `writeOnly: true` is reserved for a\nvalue that may be written but is never returned by the read API; nothing\nenforces it today, so responses still include write-only properties.\n")).optional().describe("A map of additional properties for the user definition, where the\nkey is the property name and the value is the property schema\n")
 }).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n"), zod.object({
 	kind: zod.literal("schema-url").describe("Discriminator value for a user schema create request."),
 	url: zod.url().describe("URL to the schema definition.")
@@ -1231,7 +1205,7 @@ const ListSchemasQueryParams = zod.strictObject({
 });
 const ListSchemasResponseItem = zod.object({
 	id: zod.string().describe("The unique identifier for this schema."),
-	createdAt: zod.iso.datetime({ offset: true })
+	created_at: zod.iso.datetime({ offset: true })
 });
 const ListSchemasResponse = zod.array(ListSchemasResponseItem);
 /**
@@ -1239,60 +1213,31 @@ const ListSchemasResponse = zod.array(ListSchemasResponseItem);
 * @summary Get schema by ID
 */
 const GetSchemaByIdParams = zod.object({ id: zod.string() });
-const getSchemaByIdQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const getSchemaByIdQueryTeamIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const GetSchemaByIdQueryParams = zod.strictObject({
-	project_id: zod.string().regex(getSchemaByIdQueryProjectIdRegExp).describe("The unique identifier of the project"),
-	team_id: zod.string().regex(getSchemaByIdQueryTeamIdRegExp).optional().describe("The unique identifier of the team")
-});
+const GetSchemaByIdQueryParams = zod.strictObject({ team_id: zod.string().regex(getSchemaByIdQueryTeamIdRegExp).optional().describe("The unique identifier of the team") });
 const getSchemaByIdResponseOneObjectTypeMax = 256;
-const getSchemaByIdResponseOneXAuthMethodsPasswordPositionMin = 0;
-const getSchemaByIdResponseOneXAuthMethodsPasskeyPositionMin = 0;
-const getSchemaByIdResponseOneXAuthMethodsMagicLinkPositionMin = 0;
-const getSchemaByIdResponseOneXAuthMethodsSsoPositionMin = 0;
-const getSchemaByIdResponseOneXAuthMethodsOtpPositionMin = 0;
-const getSchemaByIdResponseOnePropertiesXEditableDefault = true;
-const getSchemaByIdResponseOnePropertiesXSensitiveDefault = false;
-const getSchemaByIdResponseOnePropertiesXMfaDefault = false;
+const getSchemaByIdResponseOnePropertiesXAuditDefault = false;
 const GetSchemaByIdResponse = zod.object({
 	objectType: zod.string().max(256).optional().describe("The type of user this schema describes. This is a customer chosen name.\n"),
 	kind: zod.literal("user-schema").describe("Discriminator value for a user schema create request."),
 	metaSchema: zod.url().describe("The user Schema version used for this schema."),
 	"x-auth-methods": zod.object({
-		password: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional(),
-		passkey: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional(),
-		magic_link: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional(),
-		sso: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional(),
-		otp: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional()
+		password: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional(),
+		passkey: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional(),
+		magic_link: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional(),
+		sso: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional(),
+		otp: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional()
 	}).describe("A list of authentication methods supported by the user definition."),
 	properties: zod.record(zod.string(), zod.object({
-		"x-verify": zod.union([zod.string(), zod.null()]).optional().describe("The verification method for this property, if applicable"),
 		"x-unique": zod.union([zod.enum([
 			"unspecified",
 			"project",
 			"team"
 		]), zod.null()]).optional().describe("The level of uniqueness for this property, if applicable"),
 		"x-claim": zod.union([zod.string(), zod.null()]).optional().describe("The claim name for this property, if applicable"),
-		"x-editable": zod.boolean().default(true).describe("Whether this property is editable by the user or not"),
-		"x-sensitive": zod.boolean().default(false).describe("Whether this property contains sensitive information or not"),
-		"x-mfa": zod.boolean().default(false).describe("Whether this property is used for multi-factor authentication or not"),
-		properties: zod.record(zod.string(), zod.unknown()).optional().describe("A map of additional properties for the user definition, where the key is the property name and the value is the property schema")
-	}).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n")).optional().describe("A map of additional properties for the user definition, where the\nkey is the property name and the value is the property schema\n")
+		"x-audit": zod.boolean().default(false).describe("Whether this property's value may appear in audit event payloads. Audit\npayloads are deny-by-default: a property without this annotation\ncontributes its key but never its value.\n"),
+		properties: zod.record(zod.string(), zod.unknown()).optional().describe("A map of additional properties for the user definition, where the key is\nthe property name and the value is the property schema.\n")
+	}).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`.\nThis is done because a lot of code generators cannot handle that.\n\nNative JSON Schema keywords such as `type`, `format`, `title` and `writeOnly`\nare accepted without being listed below. `writeOnly: true` is reserved for a\nvalue that may be written but is never returned by the read API; nothing\nenforces it today, so responses still include write-only properties.\n")).optional().describe("A map of additional properties for the user definition, where the\nkey is the property name and the value is the property schema\n")
 }).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n");
 /**
 * Creates a new flow definition.
@@ -1351,7 +1296,15 @@ const CreateFlowDefinitionBody = zod.object({
 			complete: zod.enum(["redirect", "show"]).optional().describe("Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC/SAML callback done)\n- show: render as a success/info screen\n"),
 			transitions: zod.record(zod.string(), zod.object({
 				target: zod.string().describe("Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n"),
-				action: zod.union([zod.enum(["switch", "pivot"]), zod.null()]).optional().describe("How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n")
+				action: zod.union([zod.enum(["switch", "pivot"]), zod.null()]).optional().describe("How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n"),
+				purpose: zod.union([zod.enum([
+					"login",
+					"register",
+					"recovery",
+					"profiling",
+					"reauth",
+					"link_account"
+				]), zod.null()]).optional().describe("Local re-purposing. When set, taking this transition changes the\nflow's current purpose to this value — the dispatch mode a step's\nchallenges run under — while the flow's original purpose stays\npinned. Must be a purpose this definition serves, and `target`\nmust be that purpose's entry step. Mutually exclusive with\n`action`: a transition either re-purposes within this flow or\ntargets another flow, never both.\nExample: a \"Sign up\" navigation on the login identifier step\n(`{ target: register, purpose: register }`).\n")
 			})).optional().describe("Maps action/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n")
 		}).describe("A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n")).min(1).describe("Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n")
 	}).describe("A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST /flow.\n")
@@ -1396,8 +1349,6 @@ const ListFlowDefinitionsResponse = zod.object({
 * @summary Get a flow definition by id
 */
 const GetFlowDefinitionParams = zod.object({ id: zod.string().describe("The id returned by the POST /flow_definitions endpoint.\n") });
-const getFlowDefinitionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const GetFlowDefinitionQueryParams = zod.strictObject({ project_id: zod.string().regex(getFlowDefinitionQueryProjectIdRegExp).describe("The project id to filter by.") });
 const getFlowDefinitionResponseFlowDefinitionNameRegExp = /* @__PURE__ */ new RegExp("^[a-z][a-z0-9-]*$");
 const getFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault = [];
 const getFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault = false;
@@ -1445,7 +1396,15 @@ const GetFlowDefinitionResponse = zod.object({
 			complete: zod.enum(["redirect", "show"]).optional().describe("Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC/SAML callback done)\n- show: render as a success/info screen\n"),
 			transitions: zod.record(zod.string(), zod.object({
 				target: zod.string().describe("Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n"),
-				action: zod.union([zod.enum(["switch", "pivot"]), zod.null()]).optional().describe("How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n")
+				action: zod.union([zod.enum(["switch", "pivot"]), zod.null()]).optional().describe("How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n"),
+				purpose: zod.union([zod.enum([
+					"login",
+					"register",
+					"recovery",
+					"profiling",
+					"reauth",
+					"link_account"
+				]), zod.null()]).optional().describe("Local re-purposing. When set, taking this transition changes the\nflow's current purpose to this value — the dispatch mode a step's\nchallenges run under — while the flow's original purpose stays\npinned. Must be a purpose this definition serves, and `target`\nmust be that purpose's entry step. Mutually exclusive with\n`action`: a transition either re-purposes within this flow or\ntargets another flow, never both.\nExample: a \"Sign up\" navigation on the login identifier step\n(`{ target: register, purpose: register }`).\n")
 			})).optional().describe("Maps action/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n")
 		}).describe("A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n")).min(1).describe("Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n")
 	}).describe("A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST /flow.\n"),
@@ -1459,8 +1418,6 @@ If `flow_definition.status` is omitted, the current status is preserved
 * @summary Update a flow definition by id
 */
 const UpdateFlowDefinitionParams = zod.object({ id: zod.string().describe("The id returned by the POST /flow_definitions endpoint.\n") });
-const updateFlowDefinitionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const UpdateFlowDefinitionQueryParams = zod.strictObject({ project_id: zod.string().regex(updateFlowDefinitionQueryProjectIdRegExp).describe("The project id to filter by.") });
 const updateFlowDefinitionBodyFlowDefinitionNameRegExp = /* @__PURE__ */ new RegExp("^[a-z][a-z0-9-]*$");
 const updateFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault = [];
 const updateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault = false;
@@ -1507,7 +1464,15 @@ const UpdateFlowDefinitionBody = zod.object({
 			complete: zod.enum(["redirect", "show"]).optional().describe("Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC/SAML callback done)\n- show: render as a success/info screen\n"),
 			transitions: zod.record(zod.string(), zod.object({
 				target: zod.string().describe("Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n"),
-				action: zod.union([zod.enum(["switch", "pivot"]), zod.null()]).optional().describe("How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n")
+				action: zod.union([zod.enum(["switch", "pivot"]), zod.null()]).optional().describe("How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n"),
+				purpose: zod.union([zod.enum([
+					"login",
+					"register",
+					"recovery",
+					"profiling",
+					"reauth",
+					"link_account"
+				]), zod.null()]).optional().describe("Local re-purposing. When set, taking this transition changes the\nflow's current purpose to this value — the dispatch mode a step's\nchallenges run under — while the flow's original purpose stays\npinned. Must be a purpose this definition serves, and `target`\nmust be that purpose's entry step. Mutually exclusive with\n`action`: a transition either re-purposes within this flow or\ntargets another flow, never both.\nExample: a \"Sign up\" navigation on the login identifier step\n(`{ target: register, purpose: register }`).\n")
 			})).optional().describe("Maps action/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n")
 		}).describe("A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n")).min(1).describe("Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n")
 	}).describe("A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST /flow.\n")
@@ -1559,7 +1524,15 @@ const UpdateFlowDefinitionResponse = zod.object({
 			complete: zod.enum(["redirect", "show"]).optional().describe("Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC/SAML callback done)\n- show: render as a success/info screen\n"),
 			transitions: zod.record(zod.string(), zod.object({
 				target: zod.string().describe("Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n"),
-				action: zod.union([zod.enum(["switch", "pivot"]), zod.null()]).optional().describe("How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n")
+				action: zod.union([zod.enum(["switch", "pivot"]), zod.null()]).optional().describe("How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n"),
+				purpose: zod.union([zod.enum([
+					"login",
+					"register",
+					"recovery",
+					"profiling",
+					"reauth",
+					"link_account"
+				]), zod.null()]).optional().describe("Local re-purposing. When set, taking this transition changes the\nflow's current purpose to this value — the dispatch mode a step's\nchallenges run under — while the flow's original purpose stays\npinned. Must be a purpose this definition serves, and `target`\nmust be that purpose's entry step. Mutually exclusive with\n`action`: a transition either re-purposes within this flow or\ntargets another flow, never both.\nExample: a \"Sign up\" navigation on the login identifier step\n(`{ target: register, purpose: register }`).\n")
 			})).optional().describe("Maps action/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n")
 		}).describe("A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n")).min(1).describe("Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n")
 	}).describe("A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST /flow.\n"),
@@ -1574,48 +1547,2658 @@ If the flow definition is the last active flow definition for a given purpose, t
 * @summary Delete a flow definition by id
 */
 const DeleteFlowDefinitionParams = zod.object({ id: zod.string().describe("The id returned by the POST /flow_definitions endpoint.\n") });
-const deleteFlowDefinitionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const DeleteFlowDefinitionQueryParams = zod.strictObject({ project_id: zod.string().regex(deleteFlowDefinitionQueryProjectIdRegExp).describe("The project id to filter by.") });
-/**
-* Activate a flow definition by transitioning it from a `draft` state to an `active` state.
-Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
-
-* @summary Activate a flow definition by ID.
-*/
-const ActivateFlowDefinitionParams = zod.object({ id: zod.string().describe("The id returned by the POST /flow_definitions endpoint.\n") });
-const activateFlowDefinitionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const ActivateFlowDefinitionQueryParams = zod.strictObject({ project_id: zod.string().regex(activateFlowDefinitionQueryProjectIdRegExp).describe("The unique identifier of the project") });
-/**
-* Deactivates a flow definition in the `active` state by transitioning it to the `draft` state.
-Flow definitions in `draft` state cannot be used to start new flows. Existing flows that use the deactivated flow definition must gracefully handle this.
-Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
-
-* @summary Deactivate a flow definition by ID.
-*/
-const DeactivateFlowDefinitionParams = zod.object({ id: zod.string().describe("The id returned by the POST /flow_definitions endpoint.\n") });
-const deactivateFlowDefinitionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const DeactivateFlowDefinitionQueryParams = zod.strictObject({ project_id: zod.string().regex(deactivateFlowDefinitionQueryProjectIdRegExp).describe("The unique identifier of the project") });
 /**
 * @summary Create team
 */
 const createTeamQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const CreateTeamQueryParams = zod.strictObject({ project_id: zod.string().regex(createTeamQueryProjectIdRegExp).describe("The unique identifier of the project") });
-const CreateTeamBody = zod.looseObject({});
+const createTeamBodyNameMax = 200;
+const CreateTeamBody = zod.object({ name: zod.string().min(1).max(200).describe("The name of the team. Must be unique within the project.") });
+/**
+* Returns the teams of a project, paginated with a cursor.
+
+* @summary Query teams
+*/
+const queryTeamsQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const QueryTeamsQueryParams = zod.strictObject({ project_id: zod.string().regex(queryTeamsQueryProjectIdRegExp).describe("The unique identifier of the project") });
+const queryTeamsBodyLimitDefault = 20;
+const queryTeamsBodyLimitMax = 100;
+const QueryTeamsBody = zod.object({
+	limit: zod.number().min(1).max(100).default(20),
+	page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to retrieve the next page of results. Must be sent with the same\n`sorting` as the request that issued the token. Omitting `sorting` reuses\nthe default sort and only succeeds when that default matches the token.\n"),
+	sorting: zod.object({
+		field: zod.enum([
+			"created_at",
+			"name",
+			"status"
+		]).describe("Field to filter or sort teams by.\n\nTeam names are unique per project case-insensitively, so `name` is matched\ncase-insensitively by `equals` as well as by `contains`.\n"),
+		direction: zod.enum(["asc", "desc"])
+	}).optional(),
+	filter: zod.array(zod.object({
+		field: zod.enum([
+			"created_at",
+			"name",
+			"status"
+		]).describe("Field to filter or sort teams by.\n\nTeam names are unique per project case-insensitively, so `name` is matched\ncase-insensitively by `equals` as well as by `contains`.\n"),
+		value: zod.union([
+			zod.string(),
+			zod.number(),
+			zod.boolean(),
+			zod.null()
+		]).optional().describe("Filter-value specifies which values can be filtered by a query endpoint. This\nis a union of types. When a value is specified which is not assignable to the\nfield which is being filtered, a 400 error will be returned.\n"),
+		operation: zod.enum([
+			"equals",
+			"not_equals",
+			"contains",
+			"not_contains",
+			"less_than",
+			"less_than_or_equal",
+			"greater_than",
+			"greater_than_or_equal"
+		]).describe("Filter operation defines the operations which can be used when filtering on a\nquery endpoint.\n\nOn text fields, `contains` is a case-insensitive substring match. `equals`\ncompares the whole value and is case-sensitive unless the field documents\notherwise.\n")
+	})).optional().describe("Filter criteria for querying teams.")
+}).describe("Request to query the teams of a project.");
+const QueryTeamsResponse = zod.object({
+	teams: zod.array(zod.object({
+		id: zod.string().describe("The unique identifier of the team."),
+		name: zod.string().describe("The name of the team."),
+		status: zod.enum(["active", "deactivated"]).describe("The lifecycle state of a team.\n\nactive: The team is available for use.\ndeactivated: The team is no longer active but is retained for historical and audit purposes.\n"),
+		created_at: zod.iso.datetime({ offset: true }).describe("The time when the team was created."),
+		updated_at: zod.iso.datetime({ offset: true }).describe("The time when the team was last updated.")
+	}).describe("Details of a team.")),
+	next_page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results. The follow-up request must repeat the\nsame `sorting` that produced this token (omit only when both pages use the default).\n")
+}).describe("Paginated list of teams.");
 /**
-* Returns the current state of a team.
+* Returns a Team by its id.
 
 * @summary Get team
 */
 const getTeamPathTeamIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const GetTeamParams = zod.object({ team_id: zod.string().regex(getTeamPathTeamIdRegExp) });
-const getTeamQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const GetTeamQueryParams = zod.strictObject({ project_id: zod.string().regex(getTeamQueryProjectIdRegExp).describe("The unique identifier of the project") });
 const GetTeamResponse = zod.object({
 	id: zod.string().describe("The unique identifier of the team."),
-	createdAt: zod.iso.datetime({ offset: true }).describe("The time when the team was created."),
-	updatedAt: zod.iso.datetime({ offset: true }).describe("The time when the team was last updated.")
-}).describe("The current state of a team.");
+	name: zod.string().describe("The name of the team."),
+	status: zod.enum(["active", "deactivated"]).describe("The lifecycle state of a team.\n\nactive: The team is available for use.\ndeactivated: The team is no longer active but is retained for historical and audit purposes.\n"),
+	created_at: zod.iso.datetime({ offset: true }).describe("The time when the team was created."),
+	updated_at: zod.iso.datetime({ offset: true }).describe("The time when the team was last updated.")
+}).describe("Details of a team.");
+/**
+* Deactivates the team.
+
+The team is tombstoned rather than erased: it stays readable through
+getTeam with status `deactivated`. Its memberships are removed and the
+users whose lifecycle it owns are deactivated with it.
+
+The request is idempotent. Deleting a team that is already deactivated
+or doesn't exist succeeds without changing anything.
+
+* @summary Delete team
+*/
+const deleteTeamPathTeamIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const DeleteTeamParams = zod.object({ team_id: zod.string().regex(deleteTeamPathTeamIdRegExp) });
+/**
+* Update team. Only active teams can be updated.
+
+* @summary Update team
+*/
+const updateTeamPathTeamIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const UpdateTeamParams = zod.object({ team_id: zod.string().regex(updateTeamPathTeamIdRegExp) });
+const updateTeamBodyNameMax = 200;
+const UpdateTeamBody = zod.object({ name: zod.string().min(1).max(200).optional().describe("The name of the team. Must be unique within the project.") });
+const UpdateTeamResponse = zod.object({
+	id: zod.string().describe("The unique identifier of the team."),
+	name: zod.string().describe("The name of the team."),
+	status: zod.enum(["active", "deactivated"]).describe("The lifecycle state of a team.\n\nactive: The team is available for use.\ndeactivated: The team is no longer active but is retained for historical and audit purposes.\n"),
+	created_at: zod.iso.datetime({ offset: true }).describe("The time when the team was created."),
+	updated_at: zod.iso.datetime({ offset: true }).describe("The time when the team was last updated.")
+}).describe("Details of a team.");
+/**
+* Publishes a new immutable branding revision for the project. Branding
+revisions cannot be updated or deleted; every edit publishes a new
+revision, and flow responses resolve the latest revision per project
+(see ADR 040).
+
+The `liquid_template` is validated lexically on save (size, encoding,
+banned patterns such as `<script>` tags, inline event handlers, and the
+`| raw` filter). Authoritative LiquidJS validation runs at authoring
+time via `zitadel plan` / `zitadel apply`.
+
+* @summary Publish a new branding revision
+*/
+const createBrandingQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const CreateBrandingQueryParams = zod.strictObject({ project_id: zod.string().regex(createBrandingQueryProjectIdRegExp).describe("The unique identifier of the project") });
+const createBrandingBodyLayoutDefault = `centered`;
+const createBrandingBodyLiquidTemplateMax = 131072;
+const CreateBrandingBody = zod.object({
+	layout: zod.enum(["centered", "split"]).default(createBrandingBodyLayoutDefault).describe("Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely; it also serves as the degrade target\nwhen a custom template fails component-side validation.\n"),
+	liquid_template: zod.string().max(createBrandingBodyLiquidTemplateMax).optional().describe("The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n"),
+	logo_url: zod.url().optional().describe("Team logo URL."),
+	font_url: zod.url().optional().describe("Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in\nv1: `POST /branding` rejects a non-empty value, because the login\ncomponent loads this stylesheet at document level (shadow-scoped\n`@font-face` rules never register faces) and an arbitrary URL would\ngrant `branding.write` page-wide CSS control over the embedding\napplication. Safe tenant font delivery is an ADR 040 follow-up;\nuntil then, load fonts from the embedding page.\n"),
+	hero_url: zod.url().optional().describe("Hero/background image URL (used by split layout).")
+}).describe("Branding configuration. Appears in two places with one shape:\n\n- On flow responses as a read-only projection: the server resolves the\n  latest branding revision for the project per step response (falling\n  back to built-in defaults when none is stored). Branding is configured\n  via the Branding API / `zitadel apply`, not the Flow API.\n- As the request body of `POST /branding`, which publishes the same\n  shape as a new immutable revision (see ADR 040).\n");
+/**
+* Lists branding revisions for the project, newest first, capped at the
+100 most recent. The first entry is the revision flow responses
+currently resolve. Deliberately unpaginated in v1 — list endpoints
+gain a real query mechanism together (ADR 031); advertising pagination
+parameters the server ignores would be worse than none.
+
+* @summary List branding revisions
+*/
+const listBrandingQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const ListBrandingQueryParams = zod.strictObject({ project_id: zod.string().regex(listBrandingQueryProjectIdRegExp).describe("The unique identifier of the project") });
+const ListBrandingResponseItem = zod.object({
+	id: zod.string().describe("The unique identifier of this branding revision."),
+	created_at: zod.iso.datetime({ offset: true }).describe("When this revision was published.")
+});
+const ListBrandingResponse = zod.array(ListBrandingResponseItem);
+/**
+* Retrieves a single branding revision, including its stored configuration.
+* @summary Get a branding revision by ID
+*/
+const GetBrandingByIdParams = zod.object({ id: zod.string() });
+const getBrandingByIdResponseBrandingLayoutDefault = `centered`;
+const getBrandingByIdResponseBrandingLiquidTemplateMax = 131072;
+const GetBrandingByIdResponse = zod.object({
+	id: zod.string().describe("The unique identifier of this branding revision."),
+	created_at: zod.iso.datetime({ offset: true }).describe("When this revision was published."),
+	branding: zod.object({
+		layout: zod.enum(["centered", "split"]).default(getBrandingByIdResponseBrandingLayoutDefault).describe("Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely; it also serves as the degrade target\nwhen a custom template fails component-side validation.\n"),
+		liquid_template: zod.string().max(getBrandingByIdResponseBrandingLiquidTemplateMax).optional().describe("The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n"),
+		logo_url: zod.url().optional().describe("Team logo URL."),
+		font_url: zod.url().optional().describe("Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in\nv1: `POST /branding` rejects a non-empty value, because the login\ncomponent loads this stylesheet at document level (shadow-scoped\n`@font-face` rules never register faces) and an arbitrary URL would\ngrant `branding.write` page-wide CSS control over the embedding\napplication. Safe tenant font delivery is an ADR 040 follow-up;\nuntil then, load fonts from the embedding page.\n"),
+		hero_url: zod.url().optional().describe("Hero/background image URL (used by split layout).")
+	}).describe("Branding configuration. Appears in two places with one shape:\n\n- On flow responses as a read-only projection: the server resolves the\n  latest branding revision for the project per step response (falling\n  back to built-in defaults when none is stored). Branding is configured\n  via the Branding API / `zitadel apply`, not the Flow API.\n- As the request body of `POST /branding`, which publishes the same\n  shape as a new immutable revision (see ADR 040).\n")
+}).describe("A stored branding revision. `branding` echoes the canonical stored\nconfiguration so clients (e.g. the CLI sync engine) can reconcile local\nfiles with the server's stored state.\n");
+/**
+* Returns project-scoped audit events, newest-first by keyset on
+`(created_at, id)` (ADR 027 / ADR 049). Pass `order=asc` for oldest-first.
+Requires `events.read`.
+
+Pre-claim projects return an empty list (events are stored but not
+visible until claim succeeds). Team-scoped credentials see only events
+whose emit-time `team_id` matches the credential team (enforced when
+team-scoped tokens exist).
+
+Clients discriminate each item via `event_type` (OpenAPI Event oneOf) —
+see docs/design/api/events-catalog.md.
+
+* @summary List events
+*/
+const listEventsQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsQueryOrderDefault = `desc`;
+const listEventsQueryLimitDefault = 20;
+const listEventsQueryLimitMax = 100;
+const ListEventsQueryParams = zod.strictObject({
+	project_id: zod.string().regex(listEventsQueryProjectIdRegExp).describe("The unique identifier of the project"),
+	category: zod.array(zod.enum([
+		"request",
+		"auth",
+		"session",
+		"admin",
+		"entity",
+		"signal"
+	])).optional().describe("Filter by wide-event category. Repeatable (OR within the parameter).\n"),
+	event_type: zod.array(zod.string()).optional().describe("Exact-match filter on `event_type`. Repeatable (OR within the parameter).\n"),
+	actor_id: zod.string().optional(),
+	client_id: zod.string().optional(),
+	session_id: zod.string().optional(),
+	flow_id: zod.string().optional(),
+	request_id: zod.string().optional(),
+	fingerprint: zod.string().optional(),
+	entity_type: zod.string().optional(),
+	entity_id: zod.string().optional(),
+	team_id: zod.string().optional().describe("Filter by emit-time team scope stored on the event."),
+	created_after: zod.iso.datetime({ offset: true }).optional().describe("Inclusive lower bound on `created_at` (RFC 3339)."),
+	created_before: zod.iso.datetime({ offset: true }).optional().describe("Exclusive upper bound on `created_at` (RFC 3339)."),
+	order: zod.enum(["asc", "desc"]).default(listEventsQueryOrderDefault).describe("Sort direction on `(created_at, id)`. Default `desc` (newest first)\nfor audit UI. Pass `asc` for oldest-first.\n"),
+	page_token: zod.string().optional().describe("Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n"),
+	limit: zod.number().min(1).max(100).default(20).describe("Maximum number of items to return.")
+});
+const listEventsResponseDataItemOneOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemTwoOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemThreeOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemFourOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemFiveOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemSixOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemSevenOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemEightOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemNineOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnezeroOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOneoneOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnetwoOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnethreeOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnefourOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnefiveOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnesixOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnesevenOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnesevenTwoPayloadStatusMin = 100;
+const listEventsResponseDataItemOnesevenTwoPayloadStatusMax = 599;
+const listEventsResponseDataItemOnesevenTwoPayloadDurationMsMin = 0;
+const listEventsResponseDataItemOneeightOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnenineOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemTwozeroOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemTwooneOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemTwotwoOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemTwothreeOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemTwofourOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemTwofiveOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemTwosixOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const ListEventsResponse = zod.object({
+	data: zod.array(zod.union([
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOneOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("auth.attempt.created"),
+			payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+		})).describe("Wide event with event_type=auth.attempt.created.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemTwoOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("auth.attempt.handed_off"),
+			payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+		})).describe("Wide event with event_type=auth.attempt.handed_off.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemThreeOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("auth.check.failed"),
+			payload: zod.object({
+				check_id: zod.string(),
+				check_type: zod.string().optional(),
+				auth_attempt_id: zod.string().optional()
+			}).describe("Payload for `auth.check.failed` / `auth.check.succeeded`.\n`auth_attempt_id` joins the check to its attempt for SIEM correlation.\n")
+		})).describe("Wide event with event_type=auth.check.failed.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemFourOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("auth.check.succeeded"),
+			payload: zod.object({
+				check_id: zod.string(),
+				check_type: zod.string().optional(),
+				auth_attempt_id: zod.string().optional()
+			}).describe("Payload for `auth.check.failed` / `auth.check.succeeded`.\n`auth_attempt_id` joins the check to its attempt for SIEM correlation.\n")
+		})).describe("Wide event with event_type=auth.check.succeeded.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemFiveOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("auth.factor.passkey.enrolled"),
+			payload: zod.object({
+				user_id: zod.string(),
+				factor_id: zod.string().optional()
+			}).describe("Payload for `auth.factor.*` events.")
+		})).describe("Wide event with event_type=auth.factor.passkey.enrolled.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemSixOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("auth.factor.password.set"),
+			payload: zod.object({
+				user_id: zod.string(),
+				factor_id: zod.string().optional()
+			}).describe("Payload for `auth.factor.*` events.")
+		})).describe("Wide event with event_type=auth.factor.password.set.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemSevenOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("auth.token.issued"),
+			payload: zod.object({ scopes: zod.array(zod.string()).optional() }).describe("Payload for `auth.token.issued` events.")
+		})).describe("Wide event with event_type=auth.token.issued.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemEightOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("auth.token.revoked"),
+			payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+		})).describe("Wide event with event_type=auth.token.revoked.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemNineOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("authz.granted"),
+			payload: zod.object({
+				principal_type: zod.string().optional(),
+				principal_id: zod.string().optional(),
+				relation: zod.string().optional()
+			}).describe("Payload for `authz.granted` events.")
+		})).describe("Wide event with event_type=authz.granted.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOnezeroOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("branding.created"),
+			payload: zod.object({
+				layout: zod.string().optional(),
+				logo_url: zod.string().optional(),
+				font_url: zod.string().optional(),
+				hero_url: zod.string().optional()
+			}).describe("Allowlisted fields for `branding.created`. Omits `liquid_template`.\n")
+		})).describe("Wide event with event_type=branding.created.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOneoneOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("flowdef.created"),
+			payload: zod.object({
+				name: zod.string().optional(),
+				status: zod.string().optional(),
+				user_schema: zod.string().optional(),
+				purposes: zod.record(zod.string(), zod.string()).optional(),
+				audience: zod.object({
+					app_ids: zod.array(zod.string()).optional(),
+					team_ids: zod.array(zod.string()).optional()
+				}).optional()
+			}).describe("Shared allowlisted fields for `flowdef.created` (full snapshot) and\n`flowdef.updated` (delta: only changed fields present). Steps are omitted.\n")
+		})).describe("Wide event with event_type=flowdef.created.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOnetwoOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("flowdef.deleted"),
+			payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+		})).describe("Wide event with event_type=flowdef.deleted.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOnethreeOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("flowdef.updated"),
+			payload: zod.object({
+				name: zod.string().optional(),
+				status: zod.string().optional(),
+				user_schema: zod.string().optional(),
+				purposes: zod.record(zod.string(), zod.string()).optional(),
+				audience: zod.object({
+					app_ids: zod.array(zod.string()).optional(),
+					team_ids: zod.array(zod.string()).optional()
+				}).optional()
+			}).describe("Shared allowlisted fields for `flowdef.created` (full snapshot) and\n`flowdef.updated` (delta: only changed fields present). Steps are omitted.\n")
+		})).describe("Wide event with event_type=flowdef.updated.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOnefourOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("project.created"),
+			payload: zod.object({
+				name: zod.string().optional(),
+				preview_origins: zod.array(zod.string()).optional()
+			}).describe("Shared allowlisted fields for `project.created` (full snapshot) and\n`project.updated` (delta: only changed fields present).\n")
+		})).describe("Wide event with event_type=project.created.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOnefiveOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("project.deleted"),
+			payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+		})).describe("Wide event with event_type=project.deleted.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOnesixOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("project.updated"),
+			payload: zod.object({
+				name: zod.string().optional(),
+				preview_origins: zod.array(zod.string()).optional()
+			}).describe("Shared allowlisted fields for `project.created` (full snapshot) and\n`project.updated` (delta: only changed fields present).\n")
+		})).describe("Wide event with event_type=project.updated.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOnesevenOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("request.api"),
+			payload: zod.object({
+				operation_id: zod.string(),
+				method: zod.enum([
+					"GET",
+					"POST",
+					"PUT",
+					"PATCH",
+					"DELETE",
+					"HEAD",
+					"OPTIONS"
+				]).describe("HTTP method."),
+				route_template: zod.string(),
+				status: zod.number().min(100).max(599),
+				duration_ms: zod.number().min(0)
+			}).describe("Payload for `request.api` events.")
+		})).describe("Wide event with event_type=request.api.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOneeightOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("schema.created"),
+			payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+		})).describe("Wide event with event_type=schema.created.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOnenineOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("session.deleted"),
+			payload: zod.object({ reason: zod.string().optional() }).describe("Payload for `session.deleted` events.")
+		})).describe("Wide event with event_type=session.deleted.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemTwozeroOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("session.established"),
+			payload: zod.object({ user_id: zod.string().optional() }).describe("Payload for `session.established` events.")
+		})).describe("Wide event with event_type=session.established.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemTwooneOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("team.created"),
+			payload: zod.object({ name: zod.string().optional() }).describe("Shared allowlisted fields for `team.created` (snapshot) and\n`team.updated` (delta: only changed fields present).\n")
+		})).describe("Wide event with event_type=team.created.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemTwotwoOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("team.deactivated"),
+			payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+		})).describe("Wide event with event_type=team.deactivated.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemTwothreeOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("team.updated"),
+			payload: zod.object({ name: zod.string().optional() }).describe("Shared allowlisted fields for `team.created` (snapshot) and\n`team.updated` (delta: only changed fields present).\n")
+		})).describe("Wide event with event_type=team.updated.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemTwofourOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("user.create.failed"),
+			payload: zod.object({ key_name: zod.string().optional() }).describe("Payload for `user.create.failed` events.")
+		})).describe("Wide event with event_type=user.create.failed.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemTwofiveOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("user.created"),
+			payload: zod.object({
+				schema_id: zod.string().optional(),
+				attribute_keys: zod.array(zod.string()).optional(),
+				attributes: zod.record(zod.string(), zod.unknown()).optional()
+			}).describe("Payload for `user.created`. Identity is `entity_id`; attribute values\nappear only for schema fields marked `x-audit`.\n")
+		})).describe("Wide event with event_type=user.created.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemTwosixOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("user.deleted"),
+			payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+		})).describe("Wide event with event_type=user.deleted.\n")
+	]).describe("Discriminated wide-event union (ADR 048 / ADR 049). Clients select the\nmember via event_type; each member carries a typed payload.\n")),
+	next_page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results.\n")
+}).describe("Paginated list of events (ADR 027 / ADR 049).");
+/**
+* Loads a single event by `(project_id, id)`. Requires `events.read`.
+Events are not registered in `resource_scope_index`; project scope is
+required on the query (ADR 049). Misses and cross-project ids return 404.
+
+Pre-claim projects return 404 (stored events stay invisible until claim).
+
+* @summary Get event by ID
+*/
+const GetEventParams = zod.object({ id: zod.string().describe("Managed event id (`evt_<opaque>`).") });
+const getEventQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const GetEventQueryParams = zod.strictObject({ project_id: zod.string().regex(getEventQueryProjectIdRegExp).describe("The unique identifier of the project") });
+const getEventResponseOneOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseTwoOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseThreeOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseFourOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseFiveOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseSixOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseSevenOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseEightOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseNineOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnezeroOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOneoneOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnetwoOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnethreeOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnefourOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnefiveOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnesixOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnesevenOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnesevenTwoPayloadStatusMin = 100;
+const getEventResponseOnesevenTwoPayloadStatusMax = 599;
+const getEventResponseOnesevenTwoPayloadDurationMsMin = 0;
+const getEventResponseOneeightOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnenineOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseTwozeroOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseTwooneOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseTwotwoOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseTwothreeOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseTwofourOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseTwofiveOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseTwosixOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const GetEventResponse = zod.union([
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOneOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("auth.attempt.created"),
+		payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+	})).describe("Wide event with event_type=auth.attempt.created.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseTwoOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("auth.attempt.handed_off"),
+		payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+	})).describe("Wide event with event_type=auth.attempt.handed_off.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseThreeOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("auth.check.failed"),
+		payload: zod.object({
+			check_id: zod.string(),
+			check_type: zod.string().optional(),
+			auth_attempt_id: zod.string().optional()
+		}).describe("Payload for `auth.check.failed` / `auth.check.succeeded`.\n`auth_attempt_id` joins the check to its attempt for SIEM correlation.\n")
+	})).describe("Wide event with event_type=auth.check.failed.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseFourOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("auth.check.succeeded"),
+		payload: zod.object({
+			check_id: zod.string(),
+			check_type: zod.string().optional(),
+			auth_attempt_id: zod.string().optional()
+		}).describe("Payload for `auth.check.failed` / `auth.check.succeeded`.\n`auth_attempt_id` joins the check to its attempt for SIEM correlation.\n")
+	})).describe("Wide event with event_type=auth.check.succeeded.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseFiveOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("auth.factor.passkey.enrolled"),
+		payload: zod.object({
+			user_id: zod.string(),
+			factor_id: zod.string().optional()
+		}).describe("Payload for `auth.factor.*` events.")
+	})).describe("Wide event with event_type=auth.factor.passkey.enrolled.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseSixOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("auth.factor.password.set"),
+		payload: zod.object({
+			user_id: zod.string(),
+			factor_id: zod.string().optional()
+		}).describe("Payload for `auth.factor.*` events.")
+	})).describe("Wide event with event_type=auth.factor.password.set.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseSevenOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("auth.token.issued"),
+		payload: zod.object({ scopes: zod.array(zod.string()).optional() }).describe("Payload for `auth.token.issued` events.")
+	})).describe("Wide event with event_type=auth.token.issued.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseEightOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("auth.token.revoked"),
+		payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+	})).describe("Wide event with event_type=auth.token.revoked.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseNineOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("authz.granted"),
+		payload: zod.object({
+			principal_type: zod.string().optional(),
+			principal_id: zod.string().optional(),
+			relation: zod.string().optional()
+		}).describe("Payload for `authz.granted` events.")
+	})).describe("Wide event with event_type=authz.granted.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOnezeroOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("branding.created"),
+		payload: zod.object({
+			layout: zod.string().optional(),
+			logo_url: zod.string().optional(),
+			font_url: zod.string().optional(),
+			hero_url: zod.string().optional()
+		}).describe("Allowlisted fields for `branding.created`. Omits `liquid_template`.\n")
+	})).describe("Wide event with event_type=branding.created.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOneoneOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("flowdef.created"),
+		payload: zod.object({
+			name: zod.string().optional(),
+			status: zod.string().optional(),
+			user_schema: zod.string().optional(),
+			purposes: zod.record(zod.string(), zod.string()).optional(),
+			audience: zod.object({
+				app_ids: zod.array(zod.string()).optional(),
+				team_ids: zod.array(zod.string()).optional()
+			}).optional()
+		}).describe("Shared allowlisted fields for `flowdef.created` (full snapshot) and\n`flowdef.updated` (delta: only changed fields present). Steps are omitted.\n")
+	})).describe("Wide event with event_type=flowdef.created.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOnetwoOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("flowdef.deleted"),
+		payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+	})).describe("Wide event with event_type=flowdef.deleted.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOnethreeOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("flowdef.updated"),
+		payload: zod.object({
+			name: zod.string().optional(),
+			status: zod.string().optional(),
+			user_schema: zod.string().optional(),
+			purposes: zod.record(zod.string(), zod.string()).optional(),
+			audience: zod.object({
+				app_ids: zod.array(zod.string()).optional(),
+				team_ids: zod.array(zod.string()).optional()
+			}).optional()
+		}).describe("Shared allowlisted fields for `flowdef.created` (full snapshot) and\n`flowdef.updated` (delta: only changed fields present). Steps are omitted.\n")
+	})).describe("Wide event with event_type=flowdef.updated.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOnefourOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("project.created"),
+		payload: zod.object({
+			name: zod.string().optional(),
+			preview_origins: zod.array(zod.string()).optional()
+		}).describe("Shared allowlisted fields for `project.created` (full snapshot) and\n`project.updated` (delta: only changed fields present).\n")
+	})).describe("Wide event with event_type=project.created.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOnefiveOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("project.deleted"),
+		payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+	})).describe("Wide event with event_type=project.deleted.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOnesixOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("project.updated"),
+		payload: zod.object({
+			name: zod.string().optional(),
+			preview_origins: zod.array(zod.string()).optional()
+		}).describe("Shared allowlisted fields for `project.created` (full snapshot) and\n`project.updated` (delta: only changed fields present).\n")
+	})).describe("Wide event with event_type=project.updated.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOnesevenOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("request.api"),
+		payload: zod.object({
+			operation_id: zod.string(),
+			method: zod.enum([
+				"GET",
+				"POST",
+				"PUT",
+				"PATCH",
+				"DELETE",
+				"HEAD",
+				"OPTIONS"
+			]).describe("HTTP method."),
+			route_template: zod.string(),
+			status: zod.number().min(100).max(599),
+			duration_ms: zod.number().min(0)
+		}).describe("Payload for `request.api` events.")
+	})).describe("Wide event with event_type=request.api.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOneeightOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("schema.created"),
+		payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+	})).describe("Wide event with event_type=schema.created.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOnenineOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("session.deleted"),
+		payload: zod.object({ reason: zod.string().optional() }).describe("Payload for `session.deleted` events.")
+	})).describe("Wide event with event_type=session.deleted.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseTwozeroOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("session.established"),
+		payload: zod.object({ user_id: zod.string().optional() }).describe("Payload for `session.established` events.")
+	})).describe("Wide event with event_type=session.established.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseTwooneOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("team.created"),
+		payload: zod.object({ name: zod.string().optional() }).describe("Shared allowlisted fields for `team.created` (snapshot) and\n`team.updated` (delta: only changed fields present).\n")
+	})).describe("Wide event with event_type=team.created.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseTwotwoOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("team.deactivated"),
+		payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+	})).describe("Wide event with event_type=team.deactivated.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseTwothreeOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("team.updated"),
+		payload: zod.object({ name: zod.string().optional() }).describe("Shared allowlisted fields for `team.created` (snapshot) and\n`team.updated` (delta: only changed fields present).\n")
+	})).describe("Wide event with event_type=team.updated.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseTwofourOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("user.create.failed"),
+		payload: zod.object({ key_name: zod.string().optional() }).describe("Payload for `user.create.failed` events.")
+	})).describe("Wide event with event_type=user.create.failed.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseTwofiveOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("user.created"),
+		payload: zod.object({
+			schema_id: zod.string().optional(),
+			attribute_keys: zod.array(zod.string()).optional(),
+			attributes: zod.record(zod.string(), zod.unknown()).optional()
+		}).describe("Payload for `user.created`. Identity is `entity_id`; attribute values\nappear only for schema fields marked `x-audit`.\n")
+	})).describe("Wide event with event_type=user.created.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseTwosixOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("user.deleted"),
+		payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+	})).describe("Wide event with event_type=user.deleted.\n")
+]).describe("Discriminated wide-event union (ADR 048 / ADR 049). Clients select the\nmember via event_type; each member carries a typed payload.\n");
 //#endregion
-export { ActivateFlowDefinitionParams, ActivateFlowDefinitionQueryParams, AuthorizeDeviceQueryParams, AuthorizeDeviceResponse, AuthorizeGetQueryParams, CreateAuthAttemptBody, CreateFlowBody, CreateFlowDefinitionBody, CreateHandoffHeader, CreateHandoffParams, CreateHandoffResponse, CreateProjectBody, CreateSchemaBody, CreateSchemaQueryParams, CreateSessionBody, CreateTeamBody, CreateTeamQueryParams, CreateUserBody, CreateUserQueryParams, DeactivateFlowDefinitionParams, DeactivateFlowDefinitionQueryParams, DeleteFlowDefinitionParams, DeleteFlowDefinitionQueryParams, EndSessionQueryParams, ExchangeHandoffBody, ExchangeHandoffHeader, ExchangeHandoffQueryParams, ExchangeHandoffResponse, GetAuthAttemptParams, GetAuthAttemptResponse, GetFlowDefinitionParams, GetFlowDefinitionQueryParams, GetFlowDefinitionResponse, GetFlowStepParams, GetFlowStepResponse, GetKeysResponse, GetMySessionResponse, GetMyUserResponse, GetOpenIDConfigurationResponse, GetProjectParams, GetProjectResponse, GetSchemaByIdParams, GetSchemaByIdQueryParams, GetSchemaByIdResponse, GetSessionParams, GetSessionQueryParams, GetSessionResponse, GetTeamParams, GetTeamQueryParams, GetTeamResponse, GetTokenResponse, GetUserByIDParams, GetUserByIDQueryParams, GetUserByIDResponse, GetUserInfoResponse, IntrospectResponse, IssueChallengeBody, IssueChallengeParams, ListFlowDefinitionsQueryParams, ListFlowDefinitionsResponse, ListSchemasQueryParams, ListSchemasResponse, ListSchemasResponseItem, ListSessionsQueryParams, ListSessionsResponse, ListUsersQueryParams, ListUsersResponse, ListUsersResponseItem, PatchProjectBody, PatchProjectParams, PatchProjectResponse, QueryProjectsBody, QueryProjectsResponse, RevokeSessionParams, RevokeSessionQueryParams, SetUserPasswordBody, SetUserPasswordParams, SetUserPasswordQueryParams, SubmitFlowEventBody, SubmitFlowEventParams, SubmitFlowStepBody, SubmitFlowStepHeader, SubmitFlowStepParams, SubmitFlowStepResponse, UpdateFlowDefinitionBody, UpdateFlowDefinitionParams, UpdateFlowDefinitionQueryParams, UpdateFlowDefinitionResponse, VerifyChallengeProofBody, VerifyChallengeProofHeader, VerifyChallengeProofParams, VerifyChallengeProofResponse, activateFlowDefinitionQueryProjectIdRegExp, createAuthAttemptBodyProjectIdRegExp, createAuthAttemptBodySessionIdOneRegExp, createFlowBodyDryRunDefault, createFlowBodyFlowDefinitionNameRegExp, createFlowBodyProjectIdRegExp, createFlowBodySchemaVersionRegExp, createFlowDefinitionBodyFlowDefinitionNameRegExp, createFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault, createFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault, createFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault, createFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault, createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault, createFlowDefinitionBodyProjectIdRegExp, createHandoffPathAttemptIdRegExp, createProjectBodySeedDefaultsDefault, createSchemaBodyOneObjectTypeMax, createSchemaBodyOnePropertiesXEditableDefault, createSchemaBodyOnePropertiesXMfaDefault, createSchemaBodyOnePropertiesXSensitiveDefault, createSchemaBodyOneXAuthMethodsMagicLinkPositionMin, createSchemaBodyOneXAuthMethodsOtpPositionMin, createSchemaBodyOneXAuthMethodsPasskeyPositionMin, createSchemaBodyOneXAuthMethodsPasswordPositionMin, createSchemaBodyOneXAuthMethodsSsoPositionMin, createSchemaQueryProjectIdRegExp, createSchemaQueryTeamIdRegExp, createSessionBodyProjectIdRegExp, createTeamQueryProjectIdRegExp, createUserQueryProjectIdRegExp, createUserQueryTeamIdRegExp, deactivateFlowDefinitionQueryProjectIdRegExp, deleteFlowDefinitionQueryProjectIdRegExp, exchangeHandoffQueryProjectIdRegExp, exchangeHandoffResponseSessionFactorsItemPayloadOneUserIdRegExp, exchangeHandoffResponseSessionProjectIdRegExp, exchangeHandoffResponseSessionSessionIdRegExp, exchangeHandoffResponseSessionUserIdOneRegExp, getAuthAttemptPathAttemptIdRegExp, getAuthAttemptResponseAttemptIdRegExp, getAuthAttemptResponseChallengesItemChallengeIdRegExp, getAuthAttemptResponseCompletedFactorsItemPayloadOneUserIdRegExp, getAuthAttemptResponseProjectIdRegExp, getAuthAttemptResponseSessionIdOneRegExp, getAuthAttemptResponseUserIdOneRegExp, getFlowDefinitionQueryProjectIdRegExp, getFlowDefinitionResponseFlowDefinitionNameRegExp, getFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault, getFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault, getFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault, getFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault, getFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault, getFlowStepResponseBrandingLayoutDefault, getFlowStepResponseStepActionsDefault, getFlowStepResponseStepActionsItemPrimaryDefault, getFlowStepResponseStepFieldsDefault, getFlowStepResponseStepFieldsItemRequiredDefault, getFlowStepResponseStepFieldsItemValidationMaxLengthMin, getFlowStepResponseStepFieldsItemValidationMinLengthMin, getFlowStepResponseStepGatesDefault, getFlowStepResponseStepSsoProvidersDefault, getMySessionResponseFactorsItemPayloadOneUserIdRegExp, getMySessionResponseProjectIdRegExp, getMySessionResponseSessionIdRegExp, getMySessionResponseUserIdOneRegExp, getOpenIDConfigurationResponseClaimsParameterSupportedDefault, getOpenIDConfigurationResponseRequestParameterSupportedDefault, getOpenIDConfigurationResponseRequestUriParameterSupportedDefault, getOpenIDConfigurationResponseRequireRequestUriRegistrationDefault, getProjectPathProjectIdRegExp, getSchemaByIdQueryProjectIdRegExp, getSchemaByIdQueryTeamIdRegExp, getSchemaByIdResponseOneObjectTypeMax, getSchemaByIdResponseOnePropertiesXEditableDefault, getSchemaByIdResponseOnePropertiesXMfaDefault, getSchemaByIdResponseOnePropertiesXSensitiveDefault, getSchemaByIdResponseOneXAuthMethodsMagicLinkPositionMin, getSchemaByIdResponseOneXAuthMethodsOtpPositionMin, getSchemaByIdResponseOneXAuthMethodsPasskeyPositionMin, getSchemaByIdResponseOneXAuthMethodsPasswordPositionMin, getSchemaByIdResponseOneXAuthMethodsSsoPositionMin, getSessionPathSessionIdRegExp, getSessionQueryProjectIdRegExp, getSessionResponseFactorsItemPayloadOneUserIdRegExp, getSessionResponseProjectIdRegExp, getSessionResponseSessionIdRegExp, getSessionResponseUserIdOneRegExp, getTeamPathTeamIdRegExp, getTeamQueryProjectIdRegExp, getUserByIDPathUserIdRegExp, getUserByIDQueryProjectIdRegExp, getUserByIDQueryTeamIdRegExp, issueChallengePathAttemptIdRegExp, listFlowDefinitionsQueryLimitDefault, listFlowDefinitionsQueryLimitMax, listFlowDefinitionsQueryProjectIdRegExp, listFlowDefinitionsResponseFlowDefinitionsItemNameRegExp, listSchemasQueryObjectTypeMax, listSchemasQueryOffsetDefault, listSchemasQueryOffsetMin, listSchemasQueryProjectIdRegExp, listSessionsQueryLimitDefault, listSessionsQueryLimitMax, listSessionsQueryProjectIdRegExp, listSessionsQueryUserIdRegExp, listSessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp, listSessionsResponseSessionsItemProjectIdRegExp, listSessionsResponseSessionsItemSessionIdRegExp, listSessionsResponseSessionsItemUserIdOneRegExp, listUsersQueryLimitDefault, listUsersQueryLimitMax, listUsersQueryOffsetDefault, listUsersQueryOffsetMin, patchProjectPathProjectIdRegExp, queryProjectsBodyLimitDefault, queryProjectsBodyLimitMax, revokeSessionPathSessionIdRegExp, revokeSessionQueryProjectIdRegExp, setUserPasswordPathUserIdRegExp, setUserPasswordQueryProjectIdRegExp, submitFlowStepResponseBrandingLayoutDefault, submitFlowStepResponseStepActionsDefault, submitFlowStepResponseStepActionsItemPrimaryDefault, submitFlowStepResponseStepFieldsDefault, submitFlowStepResponseStepFieldsItemRequiredDefault, submitFlowStepResponseStepFieldsItemValidationMaxLengthMin, submitFlowStepResponseStepFieldsItemValidationMinLengthMin, submitFlowStepResponseStepGatesDefault, submitFlowStepResponseStepSsoProvidersDefault, updateFlowDefinitionBodyFlowDefinitionNameRegExp, updateFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault, updateFlowDefinitionQueryProjectIdRegExp, updateFlowDefinitionResponseFlowDefinitionNameRegExp, updateFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault, verifyChallengeProofPathAttemptIdRegExp, verifyChallengeProofPathChallengeIdRegExp, verifyChallengeProofResponseAttemptIdRegExp, verifyChallengeProofResponseChallengesItemChallengeIdRegExp, verifyChallengeProofResponseCompletedFactorsItemPayloadOneUserIdRegExp, verifyChallengeProofResponseProjectIdRegExp, verifyChallengeProofResponseSessionIdOneRegExp, verifyChallengeProofResponseUserIdOneRegExp };
+export { CompleteClaimBody, CompleteClaimParams, CompleteClaimResponse, CreateAuthAttemptBody, CreateBrandingBody, CreateBrandingQueryParams, CreateFlowBody, CreateFlowDefinitionBody, CreateHandoffHeader, CreateHandoffParams, CreateHandoffResponse, CreateProjectBody, CreateSchemaBody, CreateSchemaQueryParams, CreateSessionBody, CreateTeamBody, CreateTeamQueryParams, CreateUserBody, CreateUserQueryParams, DeleteFlowDefinitionParams, DeleteTeamParams, DeleteUserByIDParams, ExchangeHandoffBody, ExchangeHandoffHeader, ExchangeHandoffQueryParams, ExchangeHandoffResponse, GetAuthAttemptParams, GetAuthAttemptResponse, GetBrandingByIdParams, GetBrandingByIdResponse, GetClaimStatusParams, GetClaimStatusQueryParams, GetClaimStatusResponse, GetEventParams, GetEventQueryParams, GetEventResponse, GetFlowDefinitionParams, GetFlowDefinitionResponse, GetFlowStepParams, GetFlowStepResponse, GetMySessionResponse, GetMyUserResponse, GetProjectParams, GetProjectResponse, GetSchemaByIdParams, GetSchemaByIdQueryParams, GetSchemaByIdResponse, GetSessionParams, GetSessionResponse, GetTeamParams, GetTeamResponse, GetUserByIDParams, GetUserByIDQueryParams, GetUserByIDResponse, InitClaimParams, IssueChallengeBody, IssueChallengeParams, ListBrandingQueryParams, ListBrandingResponse, ListBrandingResponseItem, ListEventsQueryParams, ListEventsResponse, ListFlowDefinitionsQueryParams, ListFlowDefinitionsResponse, ListSchemasQueryParams, ListSchemasResponse, ListSchemasResponseItem, ListUserPasskeysParams, ListUserPasskeysQueryParams, ListUserPasskeysResponse, ListUserTeamsParams, ListUserTeamsQueryParams, ListUserTeamsResponse, ListUsersQueryParams, ListUsersResponse, PatchProjectBody, PatchProjectParams, PatchProjectResponse, QueryProjectsBody, QueryProjectsResponse, QuerySessionsBody, QuerySessionsQueryParams, QuerySessionsResponse, QueryTeamsBody, QueryTeamsQueryParams, QueryTeamsResponse, RevokeSessionParams, SetUserPasswordBody, SetUserPasswordParams, SubmitFlowStepBody, SubmitFlowStepHeader, SubmitFlowStepParams, SubmitFlowStepResponse, UpdateFlowDefinitionBody, UpdateFlowDefinitionParams, UpdateFlowDefinitionResponse, UpdateTeamBody, UpdateTeamParams, UpdateTeamResponse, VerifyChallengeProofBody, VerifyChallengeProofHeader, VerifyChallengeProofParams, VerifyChallengeProofResponse, completeClaimBodyChallengeIdRegExp, completeClaimPathProjectIdRegExp, completeClaimResponseProjectIdRegExp, completeClaimResponseTeamIdRegExp, createAuthAttemptBodyProjectIdRegExp, createAuthAttemptBodySessionIdOneRegExp, createBrandingBodyLayoutDefault, createBrandingBodyLiquidTemplateMax, createBrandingQueryProjectIdRegExp, createFlowBodyDryRunDefault, createFlowBodyFlowDefinitionNameRegExp, createFlowBodyProjectIdRegExp, createFlowBodySchemaVersionRegExp, createFlowDefinitionBodyFlowDefinitionNameRegExp, createFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault, createFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault, createFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault, createFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault, createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault, createFlowDefinitionBodyProjectIdRegExp, createHandoffPathAttemptIdRegExp, createProjectBodySeedDefaultsDefault, createSchemaBodyOneObjectTypeMax, createSchemaBodyOnePropertiesXAuditDefault, createSchemaQueryProjectIdRegExp, createSchemaQueryTeamIdRegExp, createSessionBodyProjectIdRegExp, createTeamBodyNameMax, createTeamQueryProjectIdRegExp, createUserQueryProjectIdRegExp, createUserQueryTeamIdRegExp, deleteTeamPathTeamIdRegExp, deleteUserByIDPathUserIdRegExp, exchangeHandoffQueryProjectIdRegExp, exchangeHandoffResponseSessionFactorsItemPayloadOneUserIdRegExp, exchangeHandoffResponseSessionProjectIdRegExp, exchangeHandoffResponseSessionSessionIdRegExp, exchangeHandoffResponseSessionUserIdOneRegExp, getAuthAttemptPathAttemptIdRegExp, getAuthAttemptResponseAttemptIdRegExp, getAuthAttemptResponseChallengesItemChallengeIdRegExp, getAuthAttemptResponseCompletedFactorsItemPayloadOneUserIdRegExp, getAuthAttemptResponseProjectIdRegExp, getAuthAttemptResponseSessionIdOneRegExp, getAuthAttemptResponseUserIdOneRegExp, getBrandingByIdResponseBrandingLayoutDefault, getBrandingByIdResponseBrandingLiquidTemplateMax, getClaimStatusPathProjectIdRegExp, getClaimStatusQueryChallengeIdRegExp, getClaimStatusResponseTwoTeamIdRegExp, getEventQueryProjectIdRegExp, getEventResponseEightOneProjectIdRegExp, getEventResponseFiveOneProjectIdRegExp, getEventResponseFourOneProjectIdRegExp, getEventResponseNineOneProjectIdRegExp, getEventResponseOneOneProjectIdRegExp, getEventResponseOneeightOneProjectIdRegExp, getEventResponseOnefiveOneProjectIdRegExp, getEventResponseOnefourOneProjectIdRegExp, getEventResponseOnenineOneProjectIdRegExp, getEventResponseOneoneOneProjectIdRegExp, getEventResponseOnesevenOneProjectIdRegExp, getEventResponseOnesevenTwoPayloadDurationMsMin, getEventResponseOnesevenTwoPayloadStatusMax, getEventResponseOnesevenTwoPayloadStatusMin, getEventResponseOnesixOneProjectIdRegExp, getEventResponseOnethreeOneProjectIdRegExp, getEventResponseOnetwoOneProjectIdRegExp, getEventResponseOnezeroOneProjectIdRegExp, getEventResponseSevenOneProjectIdRegExp, getEventResponseSixOneProjectIdRegExp, getEventResponseThreeOneProjectIdRegExp, getEventResponseTwoOneProjectIdRegExp, getEventResponseTwofiveOneProjectIdRegExp, getEventResponseTwofourOneProjectIdRegExp, getEventResponseTwooneOneProjectIdRegExp, getEventResponseTwosixOneProjectIdRegExp, getEventResponseTwothreeOneProjectIdRegExp, getEventResponseTwotwoOneProjectIdRegExp, getEventResponseTwozeroOneProjectIdRegExp, getFlowDefinitionResponseFlowDefinitionNameRegExp, getFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault, getFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault, getFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault, getFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault, getFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault, getFlowStepResponseBrandingLayoutDefault, getFlowStepResponseBrandingLiquidTemplateMax, getFlowStepResponseStepActionsDefault, getFlowStepResponseStepActionsItemPrimaryDefault, getFlowStepResponseStepFieldsDefault, getFlowStepResponseStepFieldsItemRequiredDefault, getFlowStepResponseStepFieldsItemValidationMaxLengthMin, getFlowStepResponseStepFieldsItemValidationMinLengthMin, getFlowStepResponseStepGatesDefault, getFlowStepResponseStepSsoProvidersDefault, getMySessionResponseFactorsItemPayloadOneUserIdRegExp, getMySessionResponseProjectIdRegExp, getMySessionResponseSessionIdRegExp, getMySessionResponseUserIdOneRegExp, getMyUserResponseIdRegExp, getProjectPathProjectIdRegExp, getSchemaByIdQueryTeamIdRegExp, getSchemaByIdResponseOneObjectTypeMax, getSchemaByIdResponseOnePropertiesXAuditDefault, getSessionPathSessionIdRegExp, getSessionResponseFactorsItemPayloadOneUserIdRegExp, getSessionResponseProjectIdRegExp, getSessionResponseSessionIdRegExp, getSessionResponseUserIdOneRegExp, getTeamPathTeamIdRegExp, getUserByIDPathUserIdRegExp, getUserByIDQueryTeamIdRegExp, getUserByIDResponseIdRegExp, initClaimPathProjectIdRegExp, issueChallengePathAttemptIdRegExp, listBrandingQueryProjectIdRegExp, listEventsQueryLimitDefault, listEventsQueryLimitMax, listEventsQueryOrderDefault, listEventsQueryProjectIdRegExp, listEventsResponseDataItemEightOneProjectIdRegExp, listEventsResponseDataItemFiveOneProjectIdRegExp, listEventsResponseDataItemFourOneProjectIdRegExp, listEventsResponseDataItemNineOneProjectIdRegExp, listEventsResponseDataItemOneOneProjectIdRegExp, listEventsResponseDataItemOneeightOneProjectIdRegExp, listEventsResponseDataItemOnefiveOneProjectIdRegExp, listEventsResponseDataItemOnefourOneProjectIdRegExp, listEventsResponseDataItemOnenineOneProjectIdRegExp, listEventsResponseDataItemOneoneOneProjectIdRegExp, listEventsResponseDataItemOnesevenOneProjectIdRegExp, listEventsResponseDataItemOnesevenTwoPayloadDurationMsMin, listEventsResponseDataItemOnesevenTwoPayloadStatusMax, listEventsResponseDataItemOnesevenTwoPayloadStatusMin, listEventsResponseDataItemOnesixOneProjectIdRegExp, listEventsResponseDataItemOnethreeOneProjectIdRegExp, listEventsResponseDataItemOnetwoOneProjectIdRegExp, listEventsResponseDataItemOnezeroOneProjectIdRegExp, listEventsResponseDataItemSevenOneProjectIdRegExp, listEventsResponseDataItemSixOneProjectIdRegExp, listEventsResponseDataItemThreeOneProjectIdRegExp, listEventsResponseDataItemTwoOneProjectIdRegExp, listEventsResponseDataItemTwofiveOneProjectIdRegExp, listEventsResponseDataItemTwofourOneProjectIdRegExp, listEventsResponseDataItemTwooneOneProjectIdRegExp, listEventsResponseDataItemTwosixOneProjectIdRegExp, listEventsResponseDataItemTwothreeOneProjectIdRegExp, listEventsResponseDataItemTwotwoOneProjectIdRegExp, listEventsResponseDataItemTwozeroOneProjectIdRegExp, listFlowDefinitionsQueryLimitDefault, listFlowDefinitionsQueryLimitMax, listFlowDefinitionsQueryProjectIdRegExp, listFlowDefinitionsResponseFlowDefinitionsItemNameRegExp, listSchemasQueryObjectTypeMax, listSchemasQueryOffsetDefault, listSchemasQueryOffsetMin, listSchemasQueryProjectIdRegExp, listUserPasskeysPathUserIdRegExp, listUserPasskeysQueryLimitDefault, listUserPasskeysQueryLimitMax, listUserTeamsPathUserIdRegExp, listUserTeamsQueryLimitDefault, listUserTeamsQueryLimitMax, listUsersQueryLimitDefault, listUsersQueryLimitMax, listUsersResponseUsersItemIdRegExp, patchProjectPathProjectIdRegExp, queryProjectsBodyLimitDefault, queryProjectsBodyLimitMax, querySessionsBodyLimitDefault, querySessionsBodyLimitMax, querySessionsQueryProjectIdRegExp, querySessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp, querySessionsResponseSessionsItemProjectIdRegExp, querySessionsResponseSessionsItemSessionIdRegExp, querySessionsResponseSessionsItemUserIdOneRegExp, queryTeamsBodyLimitDefault, queryTeamsBodyLimitMax, queryTeamsQueryProjectIdRegExp, revokeSessionPathSessionIdRegExp, setUserPasswordPathUserIdRegExp, submitFlowStepResponseBrandingLayoutDefault, submitFlowStepResponseBrandingLiquidTemplateMax, submitFlowStepResponseStepActionsDefault, submitFlowStepResponseStepActionsItemPrimaryDefault, submitFlowStepResponseStepFieldsDefault, submitFlowStepResponseStepFieldsItemRequiredDefault, submitFlowStepResponseStepFieldsItemValidationMaxLengthMin, submitFlowStepResponseStepFieldsItemValidationMinLengthMin, submitFlowStepResponseStepGatesDefault, submitFlowStepResponseStepSsoProvidersDefault, updateFlowDefinitionBodyFlowDefinitionNameRegExp, updateFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault, updateFlowDefinitionResponseFlowDefinitionNameRegExp, updateFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault, updateTeamBodyNameMax, updateTeamPathTeamIdRegExp, verifyChallengeProofPathAttemptIdRegExp, verifyChallengeProofPathChallengeIdRegExp, verifyChallengeProofResponseAttemptIdRegExp, verifyChallengeProofResponseChallengesItemChallengeIdRegExp, verifyChallengeProofResponseCompletedFactorsItemPayloadOneUserIdRegExp, verifyChallengeProofResponseProjectIdRegExp, verifyChallengeProofResponseSessionIdOneRegExp, verifyChallengeProofResponseUserIdOneRegExp };
 
 //# sourceMappingURL=zitadelNextGen.zod.mjs.map