@zitadel/api 0.1.0-alpha.18 → 0.1.0-alpha.19

package/dist/{index-D6qIOslB.d.mts → index-Dt_0fSH9.d.mts}

@@ -529,6 +529,14 @@ type CreateAuthAttemptDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "internal";
 }) | ({
@@ -1411,6 +1419,14 @@ type CreateFlowDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "flowdef.not_found";
 }) | ({
@@ -1741,6 +1757,17 @@ type CreateFlowDefinition201FlowDefinitionStepsItemTransitions = {
     Example: login → recovery → back to login.
     */
     action?: "switch" | "pivot" | null;
+    /** Local re-purposing. When set, taking this transition changes the
+    flow's current purpose to this value — the dispatch mode a step's
+    challenges run under — while the flow's original purpose stays
+    pinned. Must be a purpose this definition serves, and `target`
+    must be that purpose's entry step. Mutually exclusive with
+    `action`: a transition either re-purposes within this flow or
+    targets another flow, never both.
+    Example: a "Sign up" navigation on the login identifier step
+    (`{ target: register, purpose: register }`).
+    */
+    purpose?: "login" | "register" | "recovery" | "profiling" | "reauth" | "link_account" | null;
   };
 };
 //#endregion
@@ -2185,6 +2212,17 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions = {
     Example: login → recovery → back to login.
     */
     action?: "switch" | "pivot" | null;
+    /** Local re-purposing. When set, taking this transition changes the
+    flow's current purpose to this value — the dispatch mode a step's
+    challenges run under — while the flow's original purpose stays
+    pinned. Must be a purpose this definition serves, and `target`
+    must be that purpose's entry step. Mutually exclusive with
+    `action`: a transition either re-purposes within this flow or
+    targets another flow, never both.
+    Example: a "Sign up" navigation on the login identifier step
+    (`{ target: register, purpose: register }`).
+    */
+    purpose?: "login" | "register" | "recovery" | "profiling" | "reauth" | "link_account" | null;
   };
 };
 //#endregion
@@ -2347,6 +2385,14 @@ type CreateFlowDefinitionDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "flowdef.already_exists";
 }) | ({
@@ -2490,6 +2536,14 @@ type CreateHandoffDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "internal";
 }) | ({
@@ -2600,6 +2654,14 @@ type CreateProjectDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "internal";
 }) | ({
@@ -2616,6 +2678,14 @@ type CreateProjectDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "tkn.invalid_tknid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "sch.invalid_request";
 }) | ({
@@ -2741,43 +2811,18 @@ type CreateSchemaBody = {
   "x-auth-methods": {
     password?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
     passkey?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
     magic_link?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
     sso?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
     otp?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
   };
   /** A map of additional properties for the user definition, where the
@@ -2785,14 +2830,13 @@ type CreateSchemaBody = {
   */
   properties?: {
     [key: string]: {
-      /** The verification method for this property, if applicable */"x-verify"?: string | null; /** The level of uniqueness for this property, if applicable */
-      "x-unique"?: "unspecified" | "project" | "team" | null; /** The claim name for this property, if applicable */
-      "x-claim"?: string | null; /** Whether this property is editable by the user or not */
-      "x-editable"?: boolean; /** Whether this property contains sensitive information or not */
-      "x-sensitive"?: boolean;
-      /** Whether this property is used for multi-factor authentication or not
-       */
-      "x-mfa"?: boolean;
+      /** The level of uniqueness for this property, if applicable */"x-unique"?: "unspecified" | "project" | "team" | null; /** The claim name for this property, if applicable */
+      "x-claim"?: string | null;
+      /** Whether this property's value may appear in audit event payloads. Audit
+      payloads are deny-by-default: a property without this annotation
+      contributes its key but never its value.
+      */
+      "x-audit"?: boolean;
       /** A map of additional properties for the user definition, where the key is
       the property name and the value is the property schema.
       */
@@ -2941,7 +2985,7 @@ type CreateSession201SessionMetadata = {
  */
 /**
  * Current lifecycle state of the session:
-- `building`: has a user factor but is still gathering authentication factors
+- `building`: no verified authentication factors yet
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
 
@@ -2988,7 +3032,7 @@ type CreateSession201Session = {
   session_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
   /** Current lifecycle state of the session:
-  - `building`: has a user factor but is still gathering authentication factors
+  - `building`: no verified authentication factors yet
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
    */
@@ -3152,6 +3196,14 @@ type CreateSessionDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "internal";
 }) | ({
@@ -3168,6 +3220,14 @@ type CreateSessionDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "tkn.invalid_tknid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "req.invalid";
 }) | ({
@@ -3433,7 +3493,7 @@ type CreateTeamParams = {
   project_id: string;
 };
 //#endregion
-//#region src/generated/model/createUser201.d.ts
+//#region src/generated/model/createUser201Attributes.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3442,15 +3502,76 @@ type CreateTeamParams = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * The content of this response is determined by the configured
-schema for users.
+ * The user's content, satisfying the schema named by `schema`. Property
+names and types are determined entirely by that schema.
 
  */
-type CreateUser201 = {
-  /** The unique identifier of the created user. */id: string;
+type CreateUser201Attributes = {
   [key: string]: unknown;
 };
 //#endregion
+//#region src/generated/model/createUser201MetadataStatus.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The status of the user.
+ */
+type CreateUser201MetadataStatus = (typeof CreateUser201MetadataStatus)[keyof typeof CreateUser201MetadataStatus];
+declare const CreateUser201MetadataStatus: {
+  readonly active: "active";
+  readonly suspended: "suspended";
+  readonly deactivated: "deactivated";
+  readonly pending_purge: "pending_purge";
+};
+//#endregion
+//#region src/generated/model/createUser201Metadata.d.ts
+type CreateUser201Metadata = {
+  /** The time when the user was created. */created_at: string; /** The time when the user was last updated. */
+  updated_at: string; /** The status of the user. */
+  status: CreateUser201MetadataStatus;
+  /** The team that owns this user's identity lifecycle, or `null` when the
+  user is self-owned. This is a single team and a different concept from
+  the user's team roster: it decides who may deprovision the user, not
+  which teams the user collaborates in. The roster is its own paginated
+  resource — `GET /users/{user_id}/teams`.
+   */
+  lifecycle_owner_team_id?: string | null;
+};
+//#endregion
+//#region src/generated/model/createUser201.d.ts
+/**
+ * A user represents an individual identity in the system. It can be used to
+represent a human user, but also a service account or any other type of
+identity.
+
+`attributes` is the document that satisfies the user schema named by
+`schema`: its property names and types are defined entirely by that schema,
+and it is what the schema validates. The rest of the object — `id`,
+`schema`, `metadata` — is the server-owned envelope. Keeping the two apart
+means a schema may name a property `id` or `metadata` without colliding with
+the envelope, and closed-world keywords (`additionalProperties: false`,
+`propertyNames`, `unevaluatedProperties`) behave as their author expects.
+
+ */
+type CreateUser201 = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id: string;
+  /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
+   */
+  schema: string;
+  /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
+   */
+  attributes: CreateUser201Attributes;
+  metadata: CreateUser201Metadata;
+};
+//#endregion
 //#region src/generated/model/createUser400Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -3551,7 +3672,7 @@ type CreateUser409 = {
   details?: CreateUser409Details;
 };
 //#endregion
-//#region src/generated/model/createUserBodyMetadataStatus.d.ts
+//#region src/generated/model/createUser500Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3560,45 +3681,65 @@ type CreateUser409 = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * The status of the user.
+ * Additional error-specific context.
  */
-type CreateUserBodyMetadataStatus = (typeof CreateUserBodyMetadataStatus)[keyof typeof CreateUserBodyMetadataStatus];
-declare const CreateUserBodyMetadataStatus: {
-  readonly active: "active";
-  readonly suspended: "suspended";
-  readonly deactivated: "deactivated";
-  readonly pending_purge: "pending_purge";
+type CreateUser500Details = {
+  [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/createUserBodyMetadata.d.ts
-type CreateUserBodyMetadata = {
-  /** The time when the user was created. */created_at: string; /** The time when the user was last updated. */
-  updated_at: string; /** The status of the user. */
-  status: CreateUserBodyMetadataStatus;
-  /** The team that owns this user's identity lifecycle, or `null` when the
-  user is self-owned. This is a single team and a different concept from
-  the user's team roster: it decides who may deprovision the user, not
-  which teams the user collaborates in. The roster is its own paginated
-  resource — `GET /users/{user_id}/teams`.
-   */
-  lifecycle_owner_team_id?: string | null;
+//#region src/generated/model/createUser500.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type CreateUser500 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: CreateUser500Details;
+};
+//#endregion
+//#region src/generated/model/createUserBodyAttributes.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The user's schema-defined content. Validated against `schema`; a
+property the schema does not permit is rejected with `user.invalid`.
+
+ */
+type CreateUserBodyAttributes = {
+  [key: string]: unknown;
 };
 //#endregion
 //#region src/generated/model/createUserBody.d.ts
 /**
- * A user represents an individual identity in the system. It can be used to
-represent a human user, but also a service account or any other type of
-identity. The content of a user is determined by the configured schema for
-users, this is only a base schema.
+ * `attributes` is the document that must satisfy the user schema named by
+`schema`.
 
-The server assigns the resource primary key (`id`) on create. Clients must
-not send `id` in the create body; it is returned in the create response.
+The resource primary key is server-assigned and returned in the response, so
+the request carries no `id`; `metadata` is server-owned for the same reason.
+Neither is part of this schema, which is what frees a user schema to declare
+properties of those names.
+
+A request carrying any other top-level property is rejected rather than
+ignored. `attributes` stays open, since the user schema is what determines
+what belongs in it.
 
  */
 type CreateUserBody = {
-  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id?: string;
-  metadata?: CreateUserBodyMetadata;
-  [key: string]: unknown;
+  /**
+     * The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+        * @minLength 1
+     */
+  schema: string;
+  /** The user's schema-defined content. Validated against `schema`; a
+  property the schema does not permit is rejected with `user.invalid`.
+   */
+  attributes: CreateUserBodyAttributes;
 };
 //#endregion
 //#region src/generated/model/createUserDefault.d.ts
@@ -3623,6 +3764,14 @@ type CreateUserDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "internal";
 }) | ({
@@ -3735,6 +3884,14 @@ type DeleteFlowDefinitionDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "flowdef.not_found";
 }) | ({
@@ -3779,22 +3936,6 @@ type DeleteFlowDefinitionDefault = ({
   code: "req.invalid";
 });
 //#endregion
-//#region src/generated/model/deleteFlowDefinitionParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type DeleteFlowDefinitionParams = {
-  /**
-   * The project id to filter by.
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-};
-//#endregion
 //#region src/generated/model/deleteTeam400Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -3895,22 +4036,6 @@ type DeleteTeamDefault = {
   details?: DeleteTeamDefaultDetails;
 };
 //#endregion
-//#region src/generated/model/deleteTeamParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type DeleteTeamParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-};
-//#endregion
 //#region src/generated/model/deleteUserByID401Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -3983,6 +4108,14 @@ type DeleteUserByIDDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "internal";
 }) | ({
@@ -4011,22 +4144,6 @@ type DeleteUserByIDDefault = ({
   code: "user.permission_denied";
 });
 //#endregion
-//#region src/generated/model/deleteUserByIDParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type DeleteUserByIDParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-};
-//#endregion
 //#region src/generated/model/exchangeHandoff200SessionFactorsItemMethod.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -4114,7 +4231,7 @@ type ExchangeHandoff200SessionMetadata = {
  */
 /**
  * Current lifecycle state of the session:
-- `building`: has a user factor but is still gathering authentication factors
+- `building`: no verified authentication factors yet
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
 
@@ -4161,7 +4278,7 @@ type ExchangeHandoff200Session = {
   session_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
   /** Current lifecycle state of the session:
-  - `building`: has a user factor but is still gathering authentication factors
+  - `building`: no verified authentication factors yet
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
    */
@@ -4372,6 +4489,14 @@ type ExchangeHandoffDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "internal";
 }) | ({
@@ -4899,22 +5024,6 @@ type GetBrandingByIdDefault = {
   details?: GetBrandingByIdDefaultDetails;
 };
 //#endregion
-//#region src/generated/model/getBrandingByIdParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type GetBrandingByIdParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-};
-//#endregion
 //#region src/generated/model/getClaimStatus200.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -5104,27 +5213,7 @@ type GetClaimStatusParams = {
   challenge_id: string;
 };
 //#endregion
-//#region src/generated/model/getFlowDefinition200FlowDefinitionAudience.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Scopes which teams or apps this flow definition applies to. Empty or
-omitted fields mean "no restriction"; when both are empty the definition
-matches every request in the project. The engine picks the most specific
-matching definition: app > team > project-wide.
-
- */
-type GetFlowDefinition200FlowDefinitionAudience = {
-  /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
-  app_ids?: string[];
-};
-//#endregion
-//#region src/generated/model/getFlowDefinition200FlowDefinitionStatus.d.ts
+//#region src/generated/model/getEvent200.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5133,14 +5222,1093 @@ type GetFlowDefinition200FlowDefinitionAudience = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * The lifecycle state of this flow definition.
-
-active: The flow definition is ready to be used. The flow engine can select it for new flows.
-draft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.
-
-Allowed transitions:
-- draft -> active: To activate the flow definition.
-- active -> draft: To remove the flow definition from active use immediately.
+ * Discriminated wide-event union (ADR 048 / ADR 049). Clients select the
+member via event_type; each member carries a typed payload.
+
+ */
+type GetEvent200 = ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.attempt.created";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.attempt.handed_off";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.check.failed";
+  /** Payload for `auth.check.failed` / `auth.check.succeeded`.
+  `auth_attempt_id` joins the check to its attempt for SIEM correlation.
+  */
+  payload: {
+    check_id: string;
+    check_type?: string;
+    auth_attempt_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.check.succeeded";
+  /** Payload for `auth.check.failed` / `auth.check.succeeded`.
+  `auth_attempt_id` joins the check to its attempt for SIEM correlation.
+  */
+  payload: {
+    check_id: string;
+    check_type?: string;
+    auth_attempt_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.factor.passkey.enrolled"; /** Payload for `auth.factor.*` events. */
+  payload: {
+    user_id: string;
+    factor_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.factor.password.set"; /** Payload for `auth.factor.*` events. */
+  payload: {
+    user_id: string;
+    factor_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.token.issued"; /** Payload for `auth.token.issued` events. */
+  payload: {
+    scopes?: string[];
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.token.revoked";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "authz.granted"; /** Payload for `authz.granted` events. */
+  payload: {
+    principal_type?: string;
+    principal_id?: string;
+    relation?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "branding.created";
+  /** Allowlisted fields for `branding.created`. Omits `liquid_template`.
+   */
+  payload: {
+    layout?: string;
+    logo_url?: string;
+    font_url?: string;
+    hero_url?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "flowdef.created";
+  /** Shared allowlisted fields for `flowdef.created` (full snapshot) and
+  `flowdef.updated` (delta: only changed fields present). Steps are omitted.
+  */
+  payload: {
+    name?: string;
+    status?: string;
+    user_schema?: string;
+    purposes?: {
+      [key: string]: string;
+    };
+    audience?: {
+      app_ids?: string[];
+      team_ids?: string[];
+    };
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "flowdef.deleted";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "flowdef.updated";
+  /** Shared allowlisted fields for `flowdef.created` (full snapshot) and
+  `flowdef.updated` (delta: only changed fields present). Steps are omitted.
+  */
+  payload: {
+    name?: string;
+    status?: string;
+    user_schema?: string;
+    purposes?: {
+      [key: string]: string;
+    };
+    audience?: {
+      app_ids?: string[];
+      team_ids?: string[];
+    };
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "project.created";
+  /** Shared allowlisted fields for `project.created` (full snapshot) and
+  `project.updated` (delta: only changed fields present).
+  */
+  payload: {
+    name?: string;
+    preview_origins?: string[];
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "project.deleted";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "project.updated";
+  /** Shared allowlisted fields for `project.created` (full snapshot) and
+  `project.updated` (delta: only changed fields present).
+  */
+  payload: {
+    name?: string;
+    preview_origins?: string[];
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "request.api"; /** Payload for `request.api` events. */
+  payload: {
+    operation_id: string; /** HTTP method. */
+    method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+    route_template: string;
+    /**
+     * @minimum 100
+     * @maximum 599
+     */
+    status: number; /** @minimum 0 */
+    duration_ms: number;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "schema.created";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "session.deleted"; /** Payload for `session.deleted` events. */
+  payload: {
+    reason?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "session.established"; /** Payload for `session.established` events. */
+  payload: {
+    user_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "team.created";
+  /** Shared allowlisted fields for `team.created` (snapshot) and
+  `team.updated` (delta: only changed fields present).
+  */
+  payload: {
+    name?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "team.deactivated";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "team.updated";
+  /** Shared allowlisted fields for `team.created` (snapshot) and
+  `team.updated` (delta: only changed fields present).
+  */
+  payload: {
+    name?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "user.create.failed"; /** Payload for `user.create.failed` events. */
+  payload: {
+    key_name?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "user.created";
+  /** Payload for `user.created`. Identity is `entity_id`; attribute values
+  appear only for schema fields marked `x-audit`.
+  */
+  payload: {
+    schema_id?: string;
+    attribute_keys?: string[];
+    attributes?: {
+      [key: string]: unknown;
+    };
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "user.deleted";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+});
+//#endregion
+//#region src/generated/model/getEvent401Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type GetEvent401Details = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/getEvent401.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type GetEvent401 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: GetEvent401Details;
+};
+//#endregion
+//#region src/generated/model/getEvent403Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type GetEvent403Details = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/getEvent403.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type GetEvent403 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: GetEvent403Details;
+};
+//#endregion
+//#region src/generated/model/getEvent404Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type GetEvent404Details = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/getEvent404.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type GetEvent404 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: GetEvent404Details;
+};
+//#endregion
+//#region src/generated/model/getEventDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type GetEventDefaultDetails = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/getEventDefault.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type GetEventDefault = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: GetEventDefaultDetails;
+};
+//#endregion
+//#region src/generated/model/getEventParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type GetEventParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+};
+//#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionAudience.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Scopes which teams or apps this flow definition applies to. Empty or
+omitted fields mean "no restriction"; when both are empty the definition
+matches every request in the project. The engine picks the most specific
+matching definition: app > team > project-wide.
+
+ */
+type GetFlowDefinition200FlowDefinitionAudience = {
+  /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
+  app_ids?: string[];
+};
+//#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStatus.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The lifecycle state of this flow definition.
+
+active: The flow definition is ready to be used. The flow engine can select it for new flows.
+draft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.
+
+Allowed transitions:
+- draft -> active: To activate the flow definition.
+- active -> draft: To remove the flow definition from active use immediately.
 
  */
 type GetFlowDefinition200FlowDefinitionStatus = (typeof GetFlowDefinition200FlowDefinitionStatus)[keyof typeof GetFlowDefinition200FlowDefinitionStatus];
@@ -5366,6 +6534,17 @@ type GetFlowDefinition200FlowDefinitionStepsItemTransitions = {
     Example: login → recovery → back to login.
     */
     action?: "switch" | "pivot" | null;
+    /** Local re-purposing. When set, taking this transition changes the
+    flow's current purpose to this value — the dispatch mode a step's
+    challenges run under — while the flow's original purpose stays
+    pinned. Must be a purpose this definition serves, and `target`
+    must be that purpose's entry step. Mutually exclusive with
+    `action`: a transition either re-purposes within this flow or
+    targets another flow, never both.
+    Example: a "Sign up" navigation on the login identifier step
+    (`{ target: register, purpose: register }`).
+    */
+    purpose?: "login" | "register" | "recovery" | "profiling" | "reauth" | "link_account" | null;
   };
 };
 //#endregion
@@ -5564,22 +6743,6 @@ type GetFlowDefinitionDefault = ({
   code: "req.invalid";
 });
 //#endregion
-//#region src/generated/model/getFlowDefinitionParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type GetFlowDefinitionParams = {
-  /**
-   * The project id to filter by.
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-};
-//#endregion
 //#region src/generated/model/getFlowStep200BrandingLayout.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -6438,7 +7601,7 @@ type GetMySession200Metadata = {
  */
 /**
  * Current lifecycle state of the session:
-- `building`: has a user factor but is still gathering authentication factors
+- `building`: no verified authentication factors yet
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
 
@@ -6485,7 +7648,7 @@ type GetMySession200 = {
   session_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
   /** Current lifecycle state of the session:
-  - `building`: has a user factor but is still gathering authentication factors
+  - `building`: no verified authentication factors yet
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
    */
@@ -6622,6 +7785,23 @@ type GetMySessionDefault = ({
   code: "sess.not_found";
 });
 //#endregion
+//#region src/generated/model/getMyUser200Attributes.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The user's content, satisfying the schema named by `schema`. Property
+names and types are determined entirely by that schema.
+
+ */
+type GetMyUser200Attributes = {
+  [key: string]: unknown;
+};
+//#endregion
 //#region src/generated/model/getMyUser200MetadataStatus.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -6659,17 +7839,29 @@ type GetMyUser200Metadata = {
 /**
  * A user represents an individual identity in the system. It can be used to
 represent a human user, but also a service account or any other type of
-identity. The content of a user is determined by the configured schema for
-users, this is only a base schema.
+identity.
 
-The server assigns the resource primary key (`id`) on create. Clients must
-not send `id` in the create body; it is returned in the create response.
+`attributes` is the document that satisfies the user schema named by
+`schema`: its property names and types are defined entirely by that schema,
+and it is what the schema validates. The rest of the object — `id`,
+`schema`, `metadata` — is the server-owned envelope. Keeping the two apart
+means a schema may name a property `id` or `metadata` without colliding with
+the envelope, and closed-world keywords (`additionalProperties: false`,
+`propertyNames`, `unevaluatedProperties`) behave as their author expects.
 
  */
 type GetMyUser200 = {
-  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id?: string;
-  metadata?: GetMyUser200Metadata;
-  [key: string]: unknown;
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id: string;
+  /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
+   */
+  schema: string;
+  /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
+   */
+  attributes: GetMyUser200Attributes;
+  metadata: GetMyUser200Metadata;
 };
 //#endregion
 //#region src/generated/model/getMyUser401Details.d.ts
@@ -6977,43 +8169,18 @@ type GetSchemaById200 = {
   "x-auth-methods": {
     password?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
     passkey?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
     magic_link?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
     sso?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
     otp?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
   };
   /** A map of additional properties for the user definition, where the
@@ -7021,14 +8188,13 @@ type GetSchemaById200 = {
    */
   properties?: {
     [key: string]: {
-      /** The verification method for this property, if applicable */"x-verify"?: string | null; /** The level of uniqueness for this property, if applicable */
-      "x-unique"?: "unspecified" | "project" | "team" | null; /** The claim name for this property, if applicable */
-      "x-claim"?: string | null; /** Whether this property is editable by the user or not */
-      "x-editable"?: boolean; /** Whether this property contains sensitive information or not */
-      "x-sensitive"?: boolean;
-      /** Whether this property is used for multi-factor authentication or not
-       */
-      "x-mfa"?: boolean;
+      /** The level of uniqueness for this property, if applicable */"x-unique"?: "unspecified" | "project" | "team" | null; /** The claim name for this property, if applicable */
+      "x-claim"?: string | null;
+      /** Whether this property's value may appear in audit event payloads. Audit
+      payloads are deny-by-default: a property without this annotation
+      contributes its key but never its value.
+      */
+      "x-audit"?: boolean;
       /** A map of additional properties for the user definition, where the key is
       the property name and the value is the property schema.
       */
@@ -7125,11 +8291,6 @@ type GetSchemaByIdDefault = {
  * OpenAPI spec version: 0.0.1
  */
 type GetSchemaByIdParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
   /**
    * The unique identifier of the team
    * @pattern ^[a-zA-Z0-9_-]+$
@@ -7224,7 +8385,7 @@ type GetSession200Metadata = {
  */
 /**
  * Current lifecycle state of the session:
-- `building`: has a user factor but is still gathering authentication factors
+- `building`: no verified authentication factors yet
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
 
@@ -7271,7 +8432,7 @@ type GetSession200 = {
   session_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
   /** Current lifecycle state of the session:
-  - `building`: has a user factor but is still gathering authentication factors
+  - `building`: no verified authentication factors yet
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
    */
@@ -7443,22 +8604,6 @@ type GetSessionDefault = ({
   code: "sess.permission_denied";
 });
 //#endregion
-//#region src/generated/model/getSessionParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type GetSessionParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-};
-//#endregion
 //#region src/generated/model/getTeam200Status.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -7571,7 +8716,7 @@ type GetTeamDefault = {
   details?: GetTeamDefaultDetails;
 };
 //#endregion
-//#region src/generated/model/getTeamParams.d.ts
+//#region src/generated/model/getUserByID200Attributes.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7579,12 +8724,13 @@ type GetTeamDefault = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type GetTeamParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
+/**
+ * The user's content, satisfying the schema named by `schema`. Property
+names and types are determined entirely by that schema.
+
+ */
+type GetUserByID200Attributes = {
+  [key: string]: unknown;
 };
 //#endregion
 //#region src/generated/model/getUserByID200MetadataStatus.d.ts
@@ -7624,17 +8770,29 @@ type GetUserByID200Metadata = {
 /**
  * A user represents an individual identity in the system. It can be used to
 represent a human user, but also a service account or any other type of
-identity. The content of a user is determined by the configured schema for
-users, this is only a base schema.
+identity.
 
-The server assigns the resource primary key (`id`) on create. Clients must
-not send `id` in the create body; it is returned in the create response.
+`attributes` is the document that satisfies the user schema named by
+`schema`: its property names and types are defined entirely by that schema,
+and it is what the schema validates. The rest of the object — `id`,
+`schema`, `metadata` — is the server-owned envelope. Keeping the two apart
+means a schema may name a property `id` or `metadata` without colliding with
+the envelope, and closed-world keywords (`additionalProperties: false`,
+`propertyNames`, `unevaluatedProperties`) behave as their author expects.
 
  */
 type GetUserByID200 = {
-  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id?: string;
-  metadata?: GetUserByID200Metadata;
-  [key: string]: unknown;
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id: string;
+  /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
+   */
+  schema: string;
+  /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
+   */
+  attributes: GetUserByID200Attributes;
+  metadata: GetUserByID200Metadata;
 };
 //#endregion
 //#region src/generated/model/getUserByID401Details.d.ts
@@ -7746,11 +8904,6 @@ type GetUserByIDDefault = ({
  * OpenAPI spec version: 0.0.1
  */
 type GetUserByIDParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
   /**
    * The unique identifier of the team
    * @pattern ^[a-zA-Z0-9_-]+$
@@ -8100,22 +9253,1106 @@ type IssueChallengeDefault = ({
 }) | ({
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: {
-    [key: string]: unknown;
-  };
-} & {
-  code: "internal";
-}) | ({
+  details?: {
+    [key: string]: unknown;
+  };
+} & {
+  code: "internal";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
+} & {
+  code: "req.invalid";
+});
+//#endregion
+//#region src/generated/model/listBranding200Item.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type ListBranding200Item = {
+  /** The unique identifier of this branding revision. */id: string; /** When this revision was published. */
+  created_at: string;
+};
+//#endregion
+//#region src/generated/model/listBrandingDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type ListBrandingDefaultDetails = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/listBrandingDefault.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type ListBrandingDefault = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: ListBrandingDefaultDetails;
+};
+//#endregion
+//#region src/generated/model/listBrandingParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type ListBrandingParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+};
+//#endregion
+//#region src/generated/model/listEvents200DataItem.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Discriminated wide-event union (ADR 048 / ADR 049). Clients select the
+member via event_type; each member carries a typed payload.
+
+ */
+type ListEvents200DataItem = ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.attempt.created";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.attempt.handed_off";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.check.failed";
+  /** Payload for `auth.check.failed` / `auth.check.succeeded`.
+  `auth_attempt_id` joins the check to its attempt for SIEM correlation.
+  */
+  payload: {
+    check_id: string;
+    check_type?: string;
+    auth_attempt_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.check.succeeded";
+  /** Payload for `auth.check.failed` / `auth.check.succeeded`.
+  `auth_attempt_id` joins the check to its attempt for SIEM correlation.
+  */
+  payload: {
+    check_id: string;
+    check_type?: string;
+    auth_attempt_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.factor.passkey.enrolled"; /** Payload for `auth.factor.*` events. */
+  payload: {
+    user_id: string;
+    factor_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.factor.password.set"; /** Payload for `auth.factor.*` events. */
+  payload: {
+    user_id: string;
+    factor_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.token.issued"; /** Payload for `auth.token.issued` events. */
+  payload: {
+    scopes?: string[];
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.token.revoked";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "authz.granted"; /** Payload for `authz.granted` events. */
+  payload: {
+    principal_type?: string;
+    principal_id?: string;
+    relation?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "branding.created";
+  /** Allowlisted fields for `branding.created`. Omits `liquid_template`.
+   */
+  payload: {
+    layout?: string;
+    logo_url?: string;
+    font_url?: string;
+    hero_url?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "flowdef.created";
+  /** Shared allowlisted fields for `flowdef.created` (full snapshot) and
+  `flowdef.updated` (delta: only changed fields present). Steps are omitted.
+  */
+  payload: {
+    name?: string;
+    status?: string;
+    user_schema?: string;
+    purposes?: {
+      [key: string]: string;
+    };
+    audience?: {
+      app_ids?: string[];
+      team_ids?: string[];
+    };
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "flowdef.deleted";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "flowdef.updated";
+  /** Shared allowlisted fields for `flowdef.created` (full snapshot) and
+  `flowdef.updated` (delta: only changed fields present). Steps are omitted.
+  */
+  payload: {
+    name?: string;
+    status?: string;
+    user_schema?: string;
+    purposes?: {
+      [key: string]: string;
+    };
+    audience?: {
+      app_ids?: string[];
+      team_ids?: string[];
+    };
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "project.created";
+  /** Shared allowlisted fields for `project.created` (full snapshot) and
+  `project.updated` (delta: only changed fields present).
+  */
+  payload: {
+    name?: string;
+    preview_origins?: string[];
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "project.deleted";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "project.updated";
+  /** Shared allowlisted fields for `project.created` (full snapshot) and
+  `project.updated` (delta: only changed fields present).
+  */
+  payload: {
+    name?: string;
+    preview_origins?: string[];
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "request.api"; /** Payload for `request.api` events. */
+  payload: {
+    operation_id: string; /** HTTP method. */
+    method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+    route_template: string;
+    /**
+     * @minimum 100
+     * @maximum 599
+     */
+    status: number; /** @minimum 0 */
+    duration_ms: number;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "schema.created";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "session.deleted"; /** Payload for `session.deleted` events. */
+  payload: {
+    reason?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "session.established"; /** Payload for `session.established` events. */
+  payload: {
+    user_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "team.created";
+  /** Shared allowlisted fields for `team.created` (snapshot) and
+  `team.updated` (delta: only changed fields present).
+  */
+  payload: {
+    name?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "team.deactivated";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "team.updated";
+  /** Shared allowlisted fields for `team.created` (snapshot) and
+  `team.updated` (delta: only changed fields present).
+  */
+  payload: {
+    name?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "user.create.failed"; /** Payload for `user.create.failed` events. */
+  payload: {
+    key_name?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "user.created";
+  /** Payload for `user.created`. Identity is `entity_id`; attribute values
+  appear only for schema fields marked `x-audit`.
+  */
+  payload: {
+    schema_id?: string;
+    attribute_keys?: string[];
+    attributes?: {
+      [key: string]: unknown;
+    };
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "user.deleted";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+});
+//#endregion
+//#region src/generated/model/listEvents200.d.ts
+/**
+ * Paginated list of events (ADR 027 / ADR 049).
+ */
+type ListEvents200 = {
+  data: ListEvents200DataItem[];
+  /** Token to pass as `page_token` in the next request to fetch the following page.
+  Absent when there are no more results.
+   */
+  next_page_token?: string | null;
+};
+//#endregion
+//#region src/generated/model/listEvents400Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type ListEvents400Details = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/listEvents400.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type ListEvents400 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: ListEvents400Details;
+};
+//#endregion
+//#region src/generated/model/listEvents401Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type ListEvents401Details = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/listEvents401.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type ListEvents401 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: ListEvents401Details;
+};
+//#endregion
+//#region src/generated/model/listEvents403Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type ListEvents403Details = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/listEvents403.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type ListEvents403 = {
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: {
-    [key: string]: unknown;
-  };
-} & {
-  code: "req.invalid";
-});
+  details?: ListEvents403Details;
+};
 //#endregion
-//#region src/generated/model/listBranding200Item.d.ts
+//#region src/generated/model/listEventsCategoryItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -8123,12 +10360,17 @@ type IssueChallengeDefault = ({
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type ListBranding200Item = {
-  /** The unique identifier of this branding revision. */id: string; /** When this revision was published. */
-  created_at: string;
+type ListEventsCategoryItem = (typeof ListEventsCategoryItem)[keyof typeof ListEventsCategoryItem];
+declare const ListEventsCategoryItem: {
+  readonly request: "request";
+  readonly auth: "auth";
+  readonly session: "session";
+  readonly admin: "admin";
+  readonly entity: "entity";
+  readonly signal: "signal";
 };
 //#endregion
-//#region src/generated/model/listBrandingDefaultDetails.d.ts
+//#region src/generated/model/listEventsDefaultDetails.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -8139,21 +10381,21 @@ type ListBranding200Item = {
 /**
  * Additional error-specific context.
  */
-type ListBrandingDefaultDetails = {
+type ListEventsDefaultDetails = {
   [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/listBrandingDefault.d.ts
+//#region src/generated/model/listEventsDefault.d.ts
 /**
  * Standard error payload returned for failed API requests.
  */
-type ListBrandingDefault = {
+type ListEventsDefault = {
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: ListBrandingDefaultDetails;
+  details?: ListEventsDefaultDetails;
 };
 //#endregion
-//#region src/generated/model/listBrandingParams.d.ts
+//#region src/generated/model/listEventsOrder.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -8161,12 +10403,65 @@ type ListBrandingDefault = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type ListBrandingParams = {
+type ListEventsOrder = (typeof ListEventsOrder)[keyof typeof ListEventsOrder];
+declare const ListEventsOrder: {
+  readonly asc: "asc";
+  readonly desc: "desc";
+};
+//#endregion
+//#region src/generated/model/listEventsParams.d.ts
+type ListEventsParams = {
   /**
    * The unique identifier of the project
    * @pattern ^[a-zA-Z0-9_-]+$
    */
   project_id: string;
+  /**
+  * Filter by wide-event category. Repeatable (OR within the parameter).
+    */
+  category?: ListEventsCategoryItem[];
+  /**
+  * Exact-match filter on `event_type`. Repeatable (OR within the parameter).
+    */
+  event_type?: string[];
+  actor_id?: string;
+  client_id?: string;
+  session_id?: string;
+  flow_id?: string;
+  request_id?: string;
+  fingerprint?: string;
+  entity_type?: string;
+  entity_id?: string;
+  /**
+   * Filter by emit-time team scope stored on the event.
+   */
+  team_id?: string;
+  /**
+   * Inclusive lower bound on `created_at` (RFC 3339).
+   */
+  created_after?: string;
+  /**
+   * Exclusive upper bound on `created_at` (RFC 3339).
+   */
+  created_before?: string;
+  /**
+  * Sort direction on `(created_at, id)`. Default `desc` (newest first)
+  for audit UI. Pass `asc` for oldest-first.
+    */
+  order?: ListEventsOrder;
+  /**
+  * Token for fetching the next page of results.
+  Obtain this value from `next_page_token` in the previous response.
+  Omit to start from the beginning.
+  Its format is opaque and may change between releases.
+    */
+  page_token?: string;
+  /**
+   * Maximum number of items to return.
+   * @minimum 1
+   * @maximum 100
+   */
+  limit?: number;
 };
 //#endregion
 //#region src/generated/model/listFlowDefinitions200FlowDefinitionsItemStatus.d.ts
@@ -8658,11 +10953,23 @@ type ListUserPasskeysParams = {
   Its format is opaque and may change between releases.
     */
   page_token?: string;
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
+};
+//#endregion
+//#region src/generated/model/listUsers200UsersItemAttributes.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The user's content, satisfying the schema named by `schema`. Property
+names and types are determined entirely by that schema.
+
+ */
+type ListUsers200UsersItemAttributes = {
+  [key: string]: unknown;
 };
 //#endregion
 //#region src/generated/model/listUsers200UsersItemMetadataStatus.d.ts
@@ -8702,17 +11009,29 @@ type ListUsers200UsersItemMetadata = {
 /**
  * A user represents an individual identity in the system. It can be used to
 represent a human user, but also a service account or any other type of
-identity. The content of a user is determined by the configured schema for
-users, this is only a base schema.
+identity.
 
-The server assigns the resource primary key (`id`) on create. Clients must
-not send `id` in the create body; it is returned in the create response.
+`attributes` is the document that satisfies the user schema named by
+`schema`: its property names and types are defined entirely by that schema,
+and it is what the schema validates. The rest of the object — `id`,
+`schema`, `metadata` — is the server-owned envelope. Keeping the two apart
+means a schema may name a property `id` or `metadata` without colliding with
+the envelope, and closed-world keywords (`additionalProperties: false`,
+`propertyNames`, `unevaluatedProperties`) behave as their author expects.
 
  */
 type ListUsers200UsersItem = {
-  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id?: string;
-  metadata?: ListUsers200UsersItemMetadata;
-  [key: string]: unknown;
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id: string;
+  /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
+   */
+  schema: string;
+  /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
+   */
+  attributes: ListUsers200UsersItemAttributes;
+  metadata: ListUsers200UsersItemMetadata;
 };
 //#endregion
 //#region src/generated/model/listUsers200.d.ts
@@ -9068,22 +11387,6 @@ type ListUserTeamsDefault = ({
   details?: {
     [key: string]: unknown;
   };
-} & {
-  code: "team.team_not_found";
-}) | ({
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: {
-    [key: string]: unknown;
-  };
-} & {
-  code: "team.permission_denied";
-}) | ({
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: {
-    [key: string]: unknown;
-  };
 } & {
   code: "user.not_found";
 }) | ({
@@ -9118,11 +11421,6 @@ type ListUserTeamsParams = {
   Its format is opaque and may change between releases.
     */
   page_token?: string;
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
 };
 //#endregion
 //#region src/generated/model/patchProject200.d.ts
@@ -9255,6 +11553,14 @@ type PatchProjectDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "internal";
 }) | ({
@@ -9458,6 +11764,10 @@ declare const QueryProjectsBodyFilterItemField: {
  * Filter operation defines the operations which can be used when filtering on a
 query endpoint.
 
+On text fields, `contains` is a case-insensitive substring match. `equals`
+compares the whole value and is case-sensitive unless the field documents
+otherwise.
+
  */
 type QueryProjectsBodyFilterItemOperation = (typeof QueryProjectsBodyFilterItemOperation)[keyof typeof QueryProjectsBodyFilterItemOperation];
 declare const QueryProjectsBodyFilterItemOperation: {
@@ -9481,6 +11791,9 @@ type QueryProjectsBodyFilterItem = {
   value?: string | number | boolean | null;
   /** Filter operation defines the operations which can be used when filtering on a
   query endpoint.
+     On text fields, `contains` is a case-insensitive substring match. `equals`
+  compares the whole value and is case-sensitive unless the field documents
+  otherwise.
    */
   operation: QueryProjectsBodyFilterItemOperation;
 };
@@ -9690,7 +12003,7 @@ type QuerySessions200SessionsItemMetadata = {
  */
 /**
  * Current lifecycle state of the session:
-- `building`: has a user factor but is still gathering authentication factors
+- `building`: no verified authentication factors yet
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
 
@@ -9737,7 +12050,7 @@ type QuerySessions200SessionsItem = {
   session_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
   /** Current lifecycle state of the session:
-  - `building`: has a user factor but is still gathering authentication factors
+  - `building`: no verified authentication factors yet
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
    */
@@ -9883,7 +12196,8 @@ type QuerySessions403 = {
  * Field to filter sessions by:
 - `created_at`: RFC3339 timestamp
 - `user_id`: user id
-- `state`: one of `building`, `active`, `expired`
+- `state`: one of `building`, `active`, `expired`. State is computed at read
+  time, so a session expiring mid-request can match `active` but return `expired`.
 
  */
 type QuerySessionsBodyFilterItemField = (typeof QuerySessionsBodyFilterItemField)[keyof typeof QuerySessionsBodyFilterItemField];
@@ -9905,6 +12219,10 @@ declare const QuerySessionsBodyFilterItemField: {
  * Filter operation defines the operations which can be used when filtering on a
 query endpoint.
 
+On text fields, `contains` is a case-insensitive substring match. `equals`
+compares the whole value and is case-sensitive unless the field documents
+otherwise.
+
  */
 type QuerySessionsBodyFilterItemOperation = (typeof QuerySessionsBodyFilterItemOperation)[keyof typeof QuerySessionsBodyFilterItemOperation];
 declare const QuerySessionsBodyFilterItemOperation: {
@@ -9923,7 +12241,8 @@ type QuerySessionsBodyFilterItem = {
   /** Field to filter sessions by:
   - `created_at`: RFC3339 timestamp
   - `user_id`: user id
-  - `state`: one of `building`, `active`, `expired`
+  - `state`: one of `building`, `active`, `expired`. State is computed at read
+    time, so a session expiring mid-request can match `active` but return `expired`.
    */
   field: QuerySessionsBodyFilterItemField;
   /** Filter-value specifies which values can be filtered by a query endpoint. This
@@ -9933,6 +12252,9 @@ type QuerySessionsBodyFilterItem = {
   value?: string | number | boolean | null;
   /** Filter operation defines the operations which can be used when filtering on a
   query endpoint.
+     On text fields, `contains` is a case-insensitive substring match. `equals`
+  compares the whole value and is case-sensitive unless the field documents
+  otherwise.
    */
   operation: QuerySessionsBodyFilterItemOperation;
 };
@@ -10034,6 +12356,14 @@ type QuerySessionsDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "proj.missing_id";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "req.invalid";
 }) | ({
@@ -10252,10 +12582,19 @@ type QueryTeams429 = {
  * Zitadel NextGen
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Field to filter or sort teams by.
+
+Team names are unique per project case-insensitively, so `name` is matched
+case-insensitively by `equals` as well as by `contains`.
+
  */
 type QueryTeamsBodyFilterItemField = (typeof QueryTeamsBodyFilterItemField)[keyof typeof QueryTeamsBodyFilterItemField];
 declare const QueryTeamsBodyFilterItemField: {
   readonly created_at: "created_at";
+  readonly name: "name";
+  readonly status: "status";
 };
 //#endregion
 //#region src/generated/model/queryTeamsBodyFilterItemOperation.d.ts
@@ -10270,6 +12609,10 @@ declare const QueryTeamsBodyFilterItemField: {
  * Filter operation defines the operations which can be used when filtering on a
 query endpoint.
 
+On text fields, `contains` is a case-insensitive substring match. `equals`
+compares the whole value and is case-sensitive unless the field documents
+otherwise.
+
  */
 type QueryTeamsBodyFilterItemOperation = (typeof QueryTeamsBodyFilterItemOperation)[keyof typeof QueryTeamsBodyFilterItemOperation];
 declare const QueryTeamsBodyFilterItemOperation: {
@@ -10285,6 +12628,10 @@ declare const QueryTeamsBodyFilterItemOperation: {
 //#endregion
 //#region src/generated/model/queryTeamsBodyFilterItem.d.ts
 type QueryTeamsBodyFilterItem = {
+  /** Field to filter or sort teams by.
+     Team names are unique per project case-insensitively, so `name` is matched
+  case-insensitively by `equals` as well as by `contains`.
+   */
   field: QueryTeamsBodyFilterItemField;
   /** Filter-value specifies which values can be filtered by a query endpoint. This
   is a union of types. When a value is specified which is not assignable to the
@@ -10293,6 +12640,9 @@ type QueryTeamsBodyFilterItem = {
   value?: string | number | boolean | null;
   /** Filter operation defines the operations which can be used when filtering on a
   query endpoint.
+     On text fields, `contains` is a case-insensitive substring match. `equals`
+  compares the whole value and is case-sensitive unless the field documents
+  otherwise.
    */
   operation: QueryTeamsBodyFilterItemOperation;
 };
@@ -10318,14 +12668,27 @@ declare const QueryTeamsBodySortingDirection: {
  * Zitadel NextGen
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Field to filter or sort teams by.
+
+Team names are unique per project case-insensitively, so `name` is matched
+case-insensitively by `equals` as well as by `contains`.
+
  */
 type QueryTeamsBodySortingField = (typeof QueryTeamsBodySortingField)[keyof typeof QueryTeamsBodySortingField];
 declare const QueryTeamsBodySortingField: {
   readonly created_at: "created_at";
+  readonly name: "name";
+  readonly status: "status";
 };
 //#endregion
 //#region src/generated/model/queryTeamsBodySorting.d.ts
 type QueryTeamsBodySorting = {
+  /** Field to filter or sort teams by.
+     Team names are unique per project case-insensitively, so `name` is matched
+  case-insensitively by `equals` as well as by `contains`.
+   */
   field: QueryTeamsBodySortingField;
   direction: QueryTeamsBodySortingDirection;
 };
@@ -10436,6 +12799,14 @@ type RevokeMySessionDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "internal";
 }) | ({
@@ -10528,6 +12899,14 @@ type RevokeSessionDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "internal";
 }) | ({
@@ -10556,22 +12935,6 @@ type RevokeSessionDefault = ({
   code: "sess.permission_denied";
 });
 //#endregion
-//#region src/generated/model/revokeSessionParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type RevokeSessionParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-};
-//#endregion
 //#region src/generated/model/setUserPassword400Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -10688,6 +13051,14 @@ type SetUserPasswordDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "internal";
 }) | ({
@@ -10724,22 +13095,6 @@ type SetUserPasswordDefault = ({
   code: "user.permission_denied";
 });
 //#endregion
-//#region src/generated/model/setUserPasswordParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type SetUserPasswordParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-};
-//#endregion
 //#region src/generated/model/submitFlowStep200BrandingLayout.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -12000,6 +14355,14 @@ type SubmitFlowStepDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "flow.cookie_expired";
 }) | ({
@@ -12386,6 +14749,17 @@ type UpdateFlowDefinition200FlowDefinitionStepsItemTransitions = {
     Example: login → recovery → back to login.
     */
     action?: "switch" | "pivot" | null;
+    /** Local re-purposing. When set, taking this transition changes the
+    flow's current purpose to this value — the dispatch mode a step's
+    challenges run under — while the flow's original purpose stays
+    pinned. Must be a purpose this definition serves, and `target`
+    must be that purpose's entry step. Mutually exclusive with
+    `action`: a transition either re-purposes within this flow or
+    targets another flow, never both.
+    Example: a "Sign up" navigation on the login identifier step
+    (`{ target: register, purpose: register }`).
+    */
+    purpose?: "login" | "register" | "recovery" | "profiling" | "reauth" | "link_account" | null;
   };
 };
 //#endregion
@@ -12830,6 +15204,17 @@ type UpdateFlowDefinitionBodyFlowDefinitionStepsItemTransitions = {
     Example: login → recovery → back to login.
     */
     action?: "switch" | "pivot" | null;
+    /** Local re-purposing. When set, taking this transition changes the
+    flow's current purpose to this value — the dispatch mode a step's
+    challenges run under — while the flow's original purpose stays
+    pinned. Must be a purpose this definition serves, and `target`
+    must be that purpose's entry step. Mutually exclusive with
+    `action`: a transition either re-purposes within this flow or
+    targets another flow, never both.
+    Example: a "Sign up" navigation on the login identifier step
+    (`{ target: register, purpose: register }`).
+    */
+    purpose?: "login" | "register" | "recovery" | "profiling" | "reauth" | "link_account" | null;
   };
 };
 //#endregion
@@ -12989,6 +15374,14 @@ type UpdateFlowDefinitionDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "flowdef.invalid";
 }) | ({
@@ -13065,22 +15458,6 @@ type UpdateFlowDefinitionDefault = ({
   code: "flowdef.schema_fetch_failed";
 });
 //#endregion
-//#region src/generated/model/updateFlowDefinitionParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type UpdateFlowDefinitionParams = {
-  /**
-   * The project id to filter by.
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-};
-//#endregion
 //#region src/generated/model/updateTeam200Status.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -13285,22 +15662,6 @@ type UpdateTeamDefault = {
   details?: UpdateTeamDefaultDetails;
 };
 //#endregion
-//#region src/generated/model/updateTeamParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type UpdateTeamParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-};
-//#endregion
 //#region src/generated/model/verifyChallengeProof200ChallengesItemMethod.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -13668,6 +16029,14 @@ type VerifyChallengeProofDefault = ({
   details?: {
     [key: string]: unknown;
   };
+} & {
+  code: "evt.invalid";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
 } & {
   code: "internal";
 }) | ({
@@ -13680,5 +16049,5 @@ type VerifyChallengeProofDefault = ({
   code: "req.invalid";
 });
 //#endregion
-export { UpdateFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem as $, GetMyUser404 as $a, CreateTeam201Status as $c, InitClaim401Details as $i, CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess as $l, QuerySessions401Details as $n, GetFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem as $o, ListUsersDefault as $r, ExchangeHandoff200SessionMetadata as $s, SubmitFlowStep200Branding as $t, CreateAuthAttempt201ChallengesItemPayload as $u, UpdateFlowDefinitionDefault as A, GetSession200Metadata as Aa, CreateUser403Details as Ac, ListFlowDefinitions400Details as Ai, CreateFlowDefinitionBody as Al, QueryTeams404 as An, GetFlowStep200StepTexts as Ao, PatchProject404 as Ar, GetAuthAttempt200 as As, SubmitFlowStep400StepChallengeOptions as At, CreateFlow201StepActionsItemKind as Au, UpdateFlowDefinitionBodyFlowDefinitionStepsItemComplete as B, GetSchemaById400Details as Ba, CreateTeam429 as Bc, IssueChallengeBodyPasskeyOptions as Bi, CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItem as Bl, QueryTeams200TeamsItemStatus as Bn, GetFlowStep200StepChallenge as Bo, ListUserTeams500Details as Br, ExchangeHandoffParams as Bs, SubmitFlowStep200StepGates as Bt, CreateBranding201 as Bu, UpdateTeam401 as C, GetSession403 as Ca, CreateUserDefault as Cc, ListSchemasDefault as Ci, CreateProjectBody as Cl, QueryTeamsBodySortingField as Cn, GetFlowStepDefault as Co, QueryProjects401Details as Cr, GetBrandingByIdDefaultDetails as Cs, SubmitFlowStep400StepGatesConfig as Ct, CreateFlow201StepFieldsItemValidationFormat as Cu, UpdateTeam200 as D, GetSession200 as Da, CreateUser409 as Dc, ListFlowDefinitionsPurpose as Di, CreateHandoffDefault as Dl, QueryTeamsBodyFilterItemField as Dn, GetFlowStep404Details as Do, QueryProjects200ProjectsItem as Dr, GetBrandingById200Branding as Ds, SubmitFlowStep400StepFieldsItemType as Dt, CreateFlow201StepChallengeOptions as Du, UpdateTeam400Details as E, GetSession401Details as Ea, CreateUserBodyMetadataStatus as Ec, ListFlowDefinitionsParams as Ei, CreateProject201 as El, QueryTeamsBodyFilterItemOperation as En, GetFlowStep404 as Eo, QueryProjects200 as Er, GetBrandingById200 as Es, SubmitFlowStep400StepFieldsItemValidationFormat as Et, CreateFlow201StepChallenge as Eu, UpdateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem as F, GetSchemaByIdDefault as Fa, CreateUser201 as Fc, ListBrandingDefault as Fi, CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess as Fl, QueryTeams401Details as Fn, GetFlowStep200StepFieldsItem as Fo, PatchProject400Details as Fr, GetAuthAttempt200CompletedFactorsItemMethod as Fs, SubmitFlowStep400BrandingLayout as Ft, CreateBrandingDefaultDetails as Fu, UpdateFlowDefinition404 as G, GetReady4xxDetails as Ga, CreateTeam404Details as Gc, IssueChallenge201Payload as Gi, CreateFlowDefinition409Details as Gl, QuerySessionsBodySortingField as Gn, GetFlowStep200Branding as Go, ListUserTeams401 as Gr, ExchangeHandoff401 as Gs, SubmitFlowStep200StepFieldsItemValidationFormat as Gt, CreateAuthAttempt201 as Gu, UpdateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind as H, GetReadyDefault as Ha, CreateTeam409 as Hc, IssueChallengeBodyMethod as Hi, CreateFlowDefinitionBodyFlowDefinitionStatus as Hl, QuerySessionsDefault as Hn, GetFlowStep200StepChallengeMethod as Ho, ListUserTeams404Details as Hr, ExchangeHandoffBody as Hs, SubmitFlowStep200StepGatesConfig as Ht, CreateBranding201BrandingLayout as Hu, UpdateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess as I, GetSchemaByIdDefaultDetails as Ia, CreateTeamParams as Ic, ListBrandingDefaultDetails as Ii, CreateFlowDefinitionBodyFlowDefinitionStepsItemGates as Il, QueryTeams400 as In, GetFlowStep200StepFieldsItemValidation as Io, PatchProject200 as Ir, GetAuthAttempt200ChallengesItem as Is, SubmitFlowStep200 as It, CreateBrandingBody as Iu, UpdateFlowDefinition400Details as J, GetProject404Details as Ja, CreateTeam401 as Jc, InitClaimDefaultDetails as Ji, CreateFlowDefinition201 as Jl, QuerySessionsBodyFilterItemOperation as Jn, GetFlowDefinitionDefault as Jo, ListUserTeams400Details as Jr, ExchangeHandoff400Details as Js, SubmitFlowStep200StepChallenge as Jt, CreateAuthAttempt201CompletedFactorsItem as Ju, UpdateFlowDefinition404Details as K, GetProjectDefault as Ka, CreateTeam403 as Kc, IssueChallenge201Method as Ki, CreateFlowDefinition400 as Kl, QuerySessionsBodySortingDirection as Kn, GetFlowStep200BrandingLayout as Ko, ListUserTeams401Details as Kr, ExchangeHandoff401Details as Ks, SubmitFlowStep200StepFieldsItemType as Kt, CreateAuthAttempt201State as Ku, UpdateFlowDefinitionBodyFlowDefinitionStepsItemGates as L, GetSchemaById404 as La, CreateTeamDefault as Lc, ListBranding200Item as Li, CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind as Ll, QueryTeams400Details as Ln, GetFlowStep200StepFieldsItemValidationFormat as Lo, ListUserTeamsParams as Lr, GetAuthAttempt200ChallengesItemState as Ls, SubmitFlowStep200Step as Lt, CreateBrandingBodyLayout as Lu, UpdateFlowDefinitionBodyFlowDefinition as M, GetSession200FactorsItemPayload as Ma, CreateUser401Details as Mc, ListFlowDefinitions200FlowDefinitionsItem as Mi, CreateFlowDefinitionBodyFlowDefinitionStepsItem as Ml, QueryTeams403 as Mn, GetFlowStep200StepGates as Mo, PatchProject401 as Mr, GetAuthAttempt200RequiredFactorsItem as Ms, SubmitFlowStep400StepActionsItem as Mt, CreateFlow201BrandingLayout as Mu, UpdateFlowDefinitionBodyFlowDefinitionStepsItem as N, GetSession200FactorsItemMethod as Na, CreateUser400 as Nc, ListFlowDefinitions200FlowDefinitionsItemStatus as Ni, CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions as Nl, QueryTeams403Details as Nn, GetFlowStep200StepGatesKind as No, PatchProject401Details as Nr, GetAuthAttempt200CompletedFactorsItem as Ns, SubmitFlowStep400StepActionsItemKind as Nt, CreateBrandingParams as Nu, UpdateTeam200Status as O, GetSession200UserAgent as Oa, CreateUser409Details as Oc, ListFlowDefinitionsDefault as Oi, CreateHandoff200 as Ol, QueryTeams429 as On, GetFlowStep200 as Oo, PatchProjectDefault as Or, GetBrandingById200BrandingLayout as Os, SubmitFlowStep400StepComplete as Ot, CreateFlow201StepChallengeMethod as Ou, UpdateFlowDefinitionBodyFlowDefinitionStepsItemTransitions as P, GetSchemaByIdParams as Pa, CreateUser400Details as Pc, ListBrandingParams as Pi, CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem as Pl, QueryTeams401 as Pn, GetFlowStep200StepGatesConfig as Po, PatchProject400 as Pr, GetAuthAttempt200CompletedFactorsItemPayload as Ps, SubmitFlowStep400Branding as Pt, CreateBrandingDefault as Pu, UpdateFlowDefinition200FlowDefinitionStepsItemTransitions as Q, GetMyUserDefault as Qa, CreateTeam201 as Qc, InitClaim401 as Qi, CreateFlowDefinition201FlowDefinitionStepsItemSsoProvidersItem as Ql, QuerySessions401 as Qn, GetFlowDefinition200FlowDefinitionStepsItemTransitions as Qo, ListUsersParams as Qr, ExchangeHandoff200SessionState as Qs, SubmitFlowStep200StepActionsItemKind as Qt, CreateAuthAttempt201ChallengesItemState as Qu, UpdateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind as R, GetSchemaById404Details as Ra, CreateTeamDefaultDetails as Rc, IssueChallengeDefault as Ri, CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig as Rl, QueryTeams200 as Rn, GetFlowStep200StepFieldsItemType as Ro, ListUserTeamsDefault as Rr, GetAuthAttempt200ChallengesItemPayload as Rs, SubmitFlowStep200StepTexts as Rt, CreateBranding400 as Ru, UpdateTeam403Details as S, GetSession404Details as Sa, CreateUserParams as Sc, ListSchemasParams as Si, CreateProjectDefault as Sl, QueryTeamsBodySorting as Sn, GetHealth4xxDetails as So, QueryProjects401 as Sr, GetBrandingByIdDefault as Ss, SubmitFlowStep400StepGatesKind as St, CreateFlow201StepFieldsItemValidation as Su, UpdateTeam400 as T, GetSession401 as Ta, CreateUserBodyMetadata as Tc, ListSchemas200Item as Ti, CreateProject429Details as Tl, QueryTeamsBodyFilterItem as Tn, GetFlowStep410Details as To, QueryProjects400Details as Tr, GetBrandingById404Details as Ts, SubmitFlowStep400StepFieldsItemValidation as Tt, CreateFlow201StepComplete as Tu, UpdateFlowDefinitionBodyFlowDefinitionStatus as U, GetReadyDefaultDetails as Ua, CreateTeam409Details as Uc, IssueChallenge201 as Ui, CreateFlowDefinitionBodyFlowDefinitionAudience as Ul, QuerySessionsBody as Un, GetFlowStep200StepActionsItem as Uo, ListUserTeams403 as Ur, ExchangeHandoff410 as Us, SubmitFlowStep200StepFieldsItem as Ut, CreateAuthAttemptDefault as Uu, UpdateFlowDefinitionBodyFlowDefinitionStepsItemActionsItem as V, GetSchemaById200 as Va, CreateTeam429Details as Vc, IssueChallengeBodyPasskeyOptionsUserVerification as Vi, CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind as Vl, QuerySessionsParams as Vn, GetFlowStep200StepChallengeOptions as Vo, ListUserTeams404 as Vr, ExchangeHandoffDefault as Vs, SubmitFlowStep200StepGatesKind as Vt, CreateBranding201Branding as Vu, UpdateFlowDefinitionBodyFlowDefinitionAudience as W, GetReady4xx as Wa, CreateTeam404 as Wc, IssueChallenge201State as Wi, CreateFlowDefinition409 as Wl, QuerySessionsBodySorting as Wn, GetFlowStep200StepActionsItemKind as Wo, ListUserTeams403Details as Wr, ExchangeHandoff410Details as Ws, SubmitFlowStep200StepFieldsItemValidation as Wt, CreateAuthAttemptBody as Wu, UpdateFlowDefinition200FlowDefinition as X, GetProject401Details as Xa, CreateTeam400 as Xc, InitClaim409Details as Xi, CreateFlowDefinition201FlowDefinitionStepsItem as Xl, QuerySessions403 as Xn, GetFlowDefinition200FlowDefinition as Xo, ListUserTeams200TeamsItem as Xr, ExchangeHandoff200Session as Xs, SubmitFlowStep200StepChallengeMethod as Xt, CreateAuthAttempt201CompletedFactorsItemMethod as Xu, UpdateFlowDefinition200 as Y, GetProject401 as Ya, CreateTeam401Details as Yc, InitClaim409 as Yi, CreateFlowDefinition201FlowDefinition as Yl, QuerySessionsBodyFilterItemField as Yn, GetFlowDefinition200 as Yo, ListUserTeams200 as Yr, ExchangeHandoff200 as Ys, SubmitFlowStep200StepChallengeOptions as Yt, CreateAuthAttempt201CompletedFactorsItemPayload as Yu, UpdateFlowDefinition200FlowDefinitionStepsItem as Z, GetProject200 as Za, CreateTeam400Details as Zc, InitClaim404 as Zi, CreateFlowDefinition201FlowDefinitionStepsItemTransitions as Zl, QuerySessions403Details as Zn, GetFlowDefinition200FlowDefinitionStepsItem as Zo, ListUserTeams200TeamsItemMembershipStatus as Zr, ExchangeHandoff200SessionUserAgent as Zs, SubmitFlowStep200StepActionsItem as Zt, CreateAuthAttempt201ChallengesItem as Zu, UpdateTeam409 as _, GetTeam200 as _a, DeleteTeam400Details as _c, ListUserPasskeys401Details as _i, CreateSchema409 as _l, RevokeMySession401 as _n, GetLive4xx as _o, QueryProjectsBodyFilterItemField as _r, GetClaimStatus403 as _s, SubmitFlowStep400 as _t, CreateFlow201StepSsoProvidersItem as _u, VerifyChallengeProof200RequiredFactorsItem as a, GetUserByID401 as aa, DeleteUserByID404 as ac, CompleteClaim429Details as ad, ListUsers200UsersItem as ai, CreateSession201 as al, SetUserPassword500Details as an, GetMySessionDefault as ao, QuerySessions200SessionsItemState as ar, GetFlowDefinition200FlowDefinitionStepsItemActionsItem as as, UpdateFlowDefinition200FlowDefinitionStepsItemActionsItem as at, CreateFlowDefinition201FlowDefinitionStepsItemActionsItemKind as au, UpdateTeam404Details as b, GetSessionDefault as ba, DeleteFlowDefinition409 as bc, ListUserPasskeys200 as bi, CreateSchema400Details as bl, QueryTeamsDefaultDetails as bn, GetHealthDefaultDetails as bo, QueryProjects403 as br, GetClaimStatus200 as bs, SubmitFlowStep400StepSsoProvidersItem as bt, CreateFlow201StepGatesConfig as bu, VerifyChallengeProof200CompletedFactorsItemMethod as c, GetUserByID200Metadata as ca, DeleteUserByID401Details as cc, CompleteClaim409Details as cd, ListUserPasskeysParams as ci, CreateSession201SessionState as cl, SetUserPassword400 as cn, GetMySession200 as co, QuerySessions200SessionsItemFactorsItemPayload as cr, GetFlowDefinition200FlowDefinitionAudience as cs, UpdateFlowDefinition200FlowDefinitionAudience as ct, CreateFlowDefault as cu, VerifyChallengeProof200ChallengesItemPayload as d, GetTeamDefault as da, DeleteTeamDefaultDetails as dc, CompleteClaim401 as dd, ListUserPasskeys500Details as di, CreateSession201SessionFactorsItemPayload as dl, RevokeSessionDefault as dn, GetMySession200Metadata as do, QueryProjectsBody as dr, GetClaimStatusDefaultDetails as ds, SubmitFlowStepBodyGateProofs as dt, CreateFlowBodyHint as du, InitClaim201 as ea, ExchangeHandoff200SessionFactorsItem as ec, CreateAuthAttempt201ChallengesItemMethod as ed, ListUsers500 as ei, CreateSessionDefault as el, SubmitFlowStep200BrandingLayout as en, GetMyUser401 as eo, QuerySessions400 as er, GetFlowDefinition200FlowDefinitionStepsItemOnSuccess as es, UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess as et, CreateFlowDefinition201FlowDefinitionStepsItemGates as eu, VerifyChallengeProof200ChallengesItemMethod as f, GetTeamDefaultDetails as fa, DeleteTeam403 as fc, CompleteClaim400 as fd, ListUserPasskeys404 as fi, CreateSession201SessionFactorsItemMethod as fl, RevokeSession403 as fn, GetMySession200FactorsItem as fo, QueryProjectsBodySorting as fr, GetClaimStatus429 as fs, SubmitFlowStepBodyFields as ft, CreateFlow400 as fu, UpdateTeamBody as g, GetTeam401Details as ga, DeleteTeam400 as gc, ListUserPasskeys401 as gi, CreateSchemaBody as gl, RevokeMySessionDefault as gn, GetLiveDefaultDetails as go, QueryProjectsBodyFilterItemOperation as gr, GetClaimStatus404Details as gs, SubmitFlowStep409Details as gt, CreateFlow201StepTexts as gu, UpdateTeamDefaultDetails as h, GetTeam401 as ha, DeleteTeam401Details as hc, ListUserPasskeys403Details as hi, CreateSchemaDefaultDetails as hl, RevokeSession401Details as hn, GetLiveDefault as ho, QueryProjectsBodyFilterItem as hr, GetClaimStatus404 as hs, SubmitFlowStep409 as ht, CreateFlow201Step as hu, VerifyChallengeProof200State as i, GetUserByID404Details as ia, DeleteUserByIDDefault as ic, CompleteClaim429 as id, ListUsers200 as ii, CreateSession400Details as il, SetUserPassword500 as in, GetMyUser200MetadataStatus as io, QuerySessions200SessionsItemUserAgent as ir, GetFlowDefinition200FlowDefinitionStepsItemComplete as is, UpdateFlowDefinition200FlowDefinitionStepsItemComplete as it, CreateFlowDefinition201FlowDefinitionStepsItemActionsItem as iu, UpdateFlowDefinitionBody as j, GetSession200FactorsItem as ja, CreateUser401 as jc, ListFlowDefinitions200 as ji, CreateFlowDefinitionBodyFlowDefinition as jl, QueryTeams404Details as jn, GetFlowStep200StepSsoProvidersItem as jo, PatchProject404Details as jr, GetAuthAttempt200State as js, SubmitFlowStep400StepChallengeMethod as jt, CreateFlow201Branding as ju, UpdateFlowDefinitionParams as k, GetSession200State as ka, CreateUser403 as kc, ListFlowDefinitions400 as ki, CreateFlowDefinitionDefault as kl, QueryTeams429Details as kn, GetFlowStep200Step as ko, PatchProjectBody as kr, GetAuthAttemptDefault as ks, SubmitFlowStep400StepChallenge as kt, CreateFlow201StepActionsItem as ku, VerifyChallengeProof200ChallengesItem as l, GetUserByID200MetadataStatus as la, DeleteTeamParams as lc, CompleteClaim404 as ld, ListUserPasskeysDefault as li, CreateSession201SessionMetadata as ll, SetUserPassword400Details as ln, GetMySession200UserAgent as lo, QuerySessions200SessionsItemFactorsItemMethod as lr, GetClaimStatusParams as ls, SubmitFlowStepDefault as lt, CreateFlowBody as lu, UpdateTeamDefault as m, GetTeam404Details as ma, DeleteTeam401 as mc, CompleteClaim200 as md, ListUserPasskeys403 as mi, CreateSchemaDefault as ml, RevokeSession401 as mn, GetMySession200FactorsItemMethod as mo, QueryProjectsBodySortingDirection as mr, GetClaimStatus410 as ms, SubmitFlowStepBodyChallengeResponseProof as mt, CreateFlow201 as mu, VerifyChallengeProofBody as n, GetUserByIDDefault as na, ExchangeHandoff200SessionFactorsItemMethod as nc, CompleteClaimDefaultDetails as nd, ListUsers400 as ni, CreateSessionBodyUserAgent as nl, SetUserPasswordDefault as nn, GetMyUser200 as no, QuerySessions200 as nr, GetFlowDefinition200FlowDefinitionStepsItemGatesKind as ns, UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind as nt, CreateFlowDefinition201FlowDefinitionStepsItemGatesConfig as nu, VerifyChallengeProof200CompletedFactorsItem as o, GetUserByID401Details as oa, DeleteUserByID404Details as oc, CompleteClaim410 as od, ListUsers200UsersItemMetadata as oi, CreateSession201Session as ol, SetUserPassword404 as on, GetMySession404 as oo, QuerySessions200SessionsItemMetadata as or, GetFlowDefinition200FlowDefinitionStepsItemActionsItemKind as os, UpdateFlowDefinition200FlowDefinitionStepsItemActionsItemKind as ot, CreateFlowDefinition201FlowDefinitionStatus as ou, UpdateTeamParams as p, GetTeam404 as pa, DeleteTeam403Details as pc, CompleteClaim400Details as pd, ListUserPasskeys404Details as pi, CreateSchemaParams as pl, RevokeSession403Details as pn, GetMySession200FactorsItemPayload as po, QueryProjectsBodySortingField as pr, GetClaimStatus429Details as ps, SubmitFlowStepBodyChallengeResponse as pt, CreateFlow400Details as pu, UpdateFlowDefinition400 as q, GetProject404 as qa, CreateTeam403Details as qc, InitClaimDefault as qi, CreateFlowDefinition400Details as ql, QuerySessionsBodyFilterItem as qn, GetFlowDefinitionParams as qo, ListUserTeams400 as qr, ExchangeHandoff400 as qs, SubmitFlowStep200StepComplete as qt, CreateAuthAttempt201RequiredFactorsItem as qu, VerifyChallengeProof200 as r, GetUserByID404 as ra, DeleteUserByIDParams as rc, CompleteClaimBody as rd, ListUsers400Details as ri, CreateSession400 as rl, SetUserPasswordBody as rn, GetMyUser200Metadata as ro, QuerySessions200SessionsItem as rr, GetFlowDefinition200FlowDefinitionStepsItemGatesConfig as rs, UpdateFlowDefinition200FlowDefinitionStepsItemGatesConfig as rt, CreateFlowDefinition201FlowDefinitionStepsItemComplete as ru, VerifyChallengeProof200CompletedFactorsItemPayload as s, GetUserByID200 as sa, DeleteUserByID401 as sc, CompleteClaim409 as sd, ListUsers200UsersItemMetadataStatus as si, CreateSession201SessionUserAgent as sl, SetUserPassword404Details as sn, GetMySession401 as so, QuerySessions200SessionsItemFactorsItem as sr, GetFlowDefinition200FlowDefinitionStatus as ss, UpdateFlowDefinition200FlowDefinitionStatus as st, CreateFlowDefinition201FlowDefinitionAudience as su, VerifyChallengeProofDefault as t, GetUserByIDParams as ta, ExchangeHandoff200SessionFactorsItemPayload as tc, CompleteClaimDefault as td, ListUsers500Details as ti, CreateSessionBody as tl, SetUserPasswordParams as tn, GetMyUser401Details as to, QuerySessions400Details as tr, GetFlowDefinition200FlowDefinitionStepsItemGates as ts, UpdateFlowDefinition200FlowDefinitionStepsItemGates as tt, CreateFlowDefinition201FlowDefinitionStepsItemGatesKind as tu, VerifyChallengeProof200ChallengesItemState as u, GetTeamParams as ua, DeleteTeamDefault as uc, CompleteClaim404Details as ud, ListUserPasskeys500 as ui, CreateSession201SessionFactorsItem as ul, RevokeSessionParams as un, GetMySession200State as uo, QueryProjectsDefault as ur, GetClaimStatusDefault as us, SubmitFlowStepBody as ut, CreateFlowBodyPurpose as uu, UpdateTeam409Details as v, GetTeam200Status as va, DeleteFlowDefinitionParams as vc, ListUserPasskeys400 as vi, CreateSchema409Details as vl, QueryTeamsParams as vn, GetLive4xxDetails as vo, QueryProjects429 as vr, GetClaimStatus401 as vs, SubmitFlowStep400Step as vt, CreateFlow201StepGates as vu, UpdateTeam401Details as w, GetSession403Details as wa, CreateUserBody as wc, ListSchemasDefaultDetails as wi, CreateProject429 as wl, QueryTeamsBodySortingDirection as wn, GetFlowStep410 as wo, QueryProjects400 as wr, GetBrandingById404 as ws, SubmitFlowStep400StepFieldsItem as wt, CreateFlow201StepFieldsItemType as wu, UpdateTeam403 as x, GetSession404 as xa, DeleteFlowDefinition409Details as xc, ListUserPasskeys200PasskeysItem as xi, CreateSchema201 as xl, QueryTeamsBody as xn, GetHealth4xx as xo, QueryProjects403Details as xr, GetBrandingByIdParams as xs, SubmitFlowStep400StepGates as xt, CreateFlow201StepFieldsItem as xu, UpdateTeam404 as y, GetSessionParams as ya, DeleteFlowDefinitionDefault as yc, ListUserPasskeys400Details as yi, CreateSchema400 as yl, QueryTeamsDefault as yn, GetHealthDefault as yo, QueryProjects429Details as yr, GetClaimStatus401Details as ys, SubmitFlowStep400StepTexts as yt, CreateFlow201StepGatesKind as yu, UpdateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig as z, GetSchemaById400 as za, CreateTeamBody as zc, IssueChallengeBody as zi, CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete as zl, QueryTeams200TeamsItem as zn, GetFlowStep200StepComplete as zo, ListUserTeams500 as zr, GetAuthAttempt200ChallengesItemMethod as zs, SubmitFlowStep200StepSsoProvidersItem as zt, CreateBranding400Details as zu };
-//# sourceMappingURL=index-D6qIOslB.d.mts.map
+export { UpdateFlowDefinition200FlowDefinitionStepsItemGates as $, GetReady4xx as $a, CreateUser201MetadataStatus as $c, IssueChallenge201 as $i, CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem as $l, QuerySessions200SessionsItem as $n, GetFlowStep200StepActionsItem as $o, ListUsers400Details as $r, GetAuthAttempt200CompletedFactorsItemMethod as $s, SetUserPasswordDefault as $t, CreateBrandingDefault as $u, UpdateFlowDefinitionBodyFlowDefinition as A, GetSession404 as Aa, DeleteTeam401 as Ac, CompleteClaim401 as Ad, ListFlowDefinitions200FlowDefinitionsItemStatus as Ai, CreateSession201SessionFactorsItemPayload as Al, QueryTeams401 as An, GetHealthDefaultDetails as Ao, PatchProject400 as Ar, GetClaimStatusDefaultDetails as As, SubmitFlowStep400StepActionsItem as At, CreateFlowBodyHint as Au, UpdateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind as B, GetSession200FactorsItem as Ba, CreateUserBodyAttributes as Bc, ListEvents400 as Bi, CreateSchema201 as Bl, QuerySessionsBodySorting as Bn, GetFlowStep200StepTexts as Bo, ListUserTeams403Details as Br, GetBrandingByIdDefault as Bs, SubmitFlowStep200StepGatesConfig as Bt, CreateFlow201StepFieldsItem as Bu, UpdateTeam401Details as C, GetTeam404 as Ca, DeleteUserByID404Details as Cc, CompleteClaim429 as Cd, ListFlowDefinitionsParams as Ci, CreateSession400Details as Cl, QueryTeamsBodyFilterItemField as Cn, GetMySession200FactorsItemPayload as Co, QueryProjects200ProjectsItem as Cr, GetEvent403 as Cs, SubmitFlowStep400StepFieldsItemValidation as Ct, CreateFlowDefinition201FlowDefinitionStepsItemActionsItem as Cu, UpdateTeam200Status as D, GetTeam200 as Da, DeleteTeamDefaultDetails as Dc, CompleteClaim409Details as Dd, ListFlowDefinitions400Details as Di, CreateSession201SessionState as Dl, QueryTeams404Details as Dn, GetLive4xx as Do, PatchProject404Details as Dr, GetEvent200 as Ds, SubmitFlowStep400StepChallenge as Dt, CreateFlowDefault as Du, UpdateTeam200 as E, GetTeam401Details as Ea, DeleteTeamDefault as Ec, CompleteClaim409 as Ed, ListFlowDefinitions400 as Ei, CreateSession201SessionUserAgent as El, QueryTeams404 as En, GetLiveDefaultDetails as Eo, PatchProject404 as Er, GetEvent401Details as Es, SubmitFlowStep400StepComplete as Et, CreateFlowDefinition201FlowDefinitionAudience as Eu, UpdateFlowDefinitionBodyFlowDefinitionStepsItemGates as F, GetSession401Details as Fa, DeleteFlowDefinition409 as Fc, ListEventsCategoryItem as Fi, CreateSchemaBody as Fl, QueryTeams200TeamsItem as Fn, GetFlowStep410Details as Fo, ListUserTeams500 as Fr, GetClaimStatus404Details as Fs, SubmitFlowStep200Step as Ft, CreateFlow201StepTexts as Fu, UpdateFlowDefinition400 as G, GetSchemaByIdDefaultDetails as Ga, CreateUser403 as Gc, ListBrandingDefault as Gi, CreateProject201 as Gl, QuerySessionsBodyFilterItemField as Gn, GetFlowStep200StepFieldsItem as Go, ListUserTeams200 as Gr, GetBrandingById200Branding as Gs, SubmitFlowStep200StepComplete as Gt, CreateFlow201StepChallenge as Gu, UpdateFlowDefinitionBodyFlowDefinitionAudience as H, GetSession200FactorsItemMethod as Ha, CreateUser500Details as Hc, ListEvents200 as Hi, CreateProjectBody as Hl, QuerySessionsBodySortingDirection as Hn, GetFlowStep200StepGates as Ho, ListUserTeams401Details as Hr, GetBrandingById404 as Hs, SubmitFlowStep200StepFieldsItemValidation as Ht, CreateFlow201StepFieldsItemValidationFormat as Hu, UpdateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind as I, GetSession200 as Ia, DeleteFlowDefinition409Details as Ic, ListEvents403 as Ii, CreateSchema409 as Il, QueryTeams200TeamsItemStatus as In, GetFlowStep404 as Io, ListUserTeams500Details as Ir, GetClaimStatus403 as Is, SubmitFlowStep200StepTexts as It, CreateFlow201StepSsoProvidersItem as Iu, UpdateFlowDefinition200FlowDefinition as J, GetSchemaById400 as Ja, CreateUser401Details as Jc, IssueChallengeDefault as Ji, CreateFlowDefinitionDefault as Jl, QuerySessions401 as Jn, GetFlowStep200StepFieldsItemType as Jo, ListUsersParams as Jr, GetAuthAttempt200 as Js, SubmitFlowStep200StepChallengeMethod as Jt, CreateFlow201StepActionsItem as Ju, UpdateFlowDefinition400Details as K, GetSchemaById404 as Ka, CreateUser403Details as Kc, ListBrandingDefaultDetails as Ki, CreateHandoffDefault as Kl, QuerySessions403 as Kn, GetFlowStep200StepFieldsItemValidation as Ko, ListUserTeams200TeamsItem as Kr, GetBrandingById200BrandingLayout as Ks, SubmitFlowStep200StepChallenge as Kt, CreateFlow201StepChallengeOptions as Ku, UpdateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig as L, GetSession200UserAgent as La, CreateUserParams as Lc, ListEvents403Details as Li, CreateSchema409Details as Ll, QuerySessionsParams as Ln, GetFlowStep404Details as Lo, ListUserTeams404 as Lr, GetClaimStatus401 as Ls, SubmitFlowStep200StepSsoProvidersItem as Lt, CreateFlow201StepGates as Lu, UpdateFlowDefinitionBodyFlowDefinitionStepsItemTransitions as M, GetSession403 as Ma, DeleteTeam400 as Mc, CompleteClaim400Details as Md, ListEventsOrder as Mi, CreateSchemaParams as Ml, QueryTeams400 as Mn, GetHealth4xxDetails as Mo, PatchProject200 as Mr, GetClaimStatus429Details as Ms, SubmitFlowStep400Branding as Mt, CreateFlow400Details as Mu, UpdateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem as N, GetSession403Details as Na, DeleteTeam400Details as Nc, CompleteClaim200 as Nd, ListEventsDefault as Ni, CreateSchemaDefault as Nl, QueryTeams400Details as Nn, GetFlowStepDefault as No, ListUserTeamsParams as Nr, GetClaimStatus410 as Ns, SubmitFlowStep400BrandingLayout as Nt, CreateFlow201 as Nu, UpdateFlowDefinitionDefault as O, GetTeam200Status as Oa, DeleteTeam403 as Oc, CompleteClaim404 as Od, ListFlowDefinitions200 as Oi, CreateSession201SessionMetadata as Ol, QueryTeams403 as On, GetLive4xxDetails as Oo, PatchProject401 as Or, GetClaimStatusParams as Os, SubmitFlowStep400StepChallengeOptions as Ot, CreateFlowBody as Ou, UpdateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess as P, GetSession401 as Pa, DeleteFlowDefinitionDefault as Pc, ListEventsDefaultDetails as Pi, CreateSchemaDefaultDetails as Pl, QueryTeams200 as Pn, GetFlowStep410 as Po, ListUserTeamsDefault as Pr, GetClaimStatus404 as Ps, SubmitFlowStep200 as Pt, CreateFlow201Step as Pu, UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess as Q, GetReadyDefaultDetails as Qa, CreateUser201Metadata as Qc, IssueChallengeBodyMethod as Qi, CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions as Ql, QuerySessions200 as Qn, GetFlowStep200StepChallengeMethod as Qo, ListUsers400 as Qr, GetAuthAttempt200CompletedFactorsItemPayload as Qs, SubmitFlowStep200BrandingLayout as Qt, CreateBrandingParams as Qu, UpdateFlowDefinitionBodyFlowDefinitionStepsItemComplete as R, GetSession200State as Ra, CreateUserDefault as Rc, ListEvents401 as Ri, CreateSchema400 as Rl, QuerySessionsDefault as Rn, GetFlowStep200 as Ro, ListUserTeams404Details as Rr, GetClaimStatus401Details as Rs, SubmitFlowStep200StepGates as Rt, CreateFlow201StepGatesKind as Ru, UpdateTeam401 as S, GetTeamDefaultDetails as Sa, DeleteUserByID404 as Sc, CompleteClaimBody as Sd, ListSchemas200Item as Si, CreateSession400 as Sl, QueryTeamsBodyFilterItemOperation as Sn, GetMySession200FactorsItem as So, QueryProjects200 as Sr, GetEvent404Details as Ss, SubmitFlowStep400StepFieldsItem as St, CreateFlowDefinition201FlowDefinitionStepsItemComplete as Su, UpdateTeam400Details as T, GetTeam401 as Ta, DeleteUserByID401Details as Tc, CompleteClaim410 as Td, ListFlowDefinitionsDefault as Ti, CreateSession201Session as Tl, QueryTeams429Details as Tn, GetLiveDefault as To, PatchProjectBody as Tr, GetEvent401 as Ts, SubmitFlowStep400StepFieldsItemType as Tt, CreateFlowDefinition201FlowDefinitionStatus as Tu, UpdateFlowDefinition404 as U, GetSchemaByIdParams as Ua, CreateUser409 as Uc, ListEvents200DataItem as Ui, CreateProject429 as Ul, QuerySessionsBodyFilterItem as Un, GetFlowStep200StepGatesKind as Uo, ListUserTeams400 as Ur, GetBrandingById404Details as Us, SubmitFlowStep200StepFieldsItemValidationFormat as Ut, CreateFlow201StepFieldsItemType as Uu, UpdateFlowDefinitionBodyFlowDefinitionStatus as V, GetSession200FactorsItemPayload as Va, CreateUser500 as Vc, ListEvents400Details as Vi, CreateProjectDefault as Vl, QuerySessionsBodySortingField as Vn, GetFlowStep200StepSsoProvidersItem as Vo, ListUserTeams401 as Vr, GetBrandingByIdDefaultDetails as Vs, SubmitFlowStep200StepFieldsItem as Vt, CreateFlow201StepFieldsItemValidation as Vu, UpdateFlowDefinition404Details as W, GetSchemaByIdDefault as Wa, CreateUser409Details as Wc, ListBrandingParams as Wi, CreateProject429Details as Wl, QuerySessionsBodyFilterItemOperation as Wn, GetFlowStep200StepGatesConfig as Wo, ListUserTeams400Details as Wr, GetBrandingById200 as Ws, SubmitFlowStep200StepFieldsItemType as Wt, CreateFlow201StepComplete as Wu, UpdateFlowDefinition200FlowDefinitionStepsItemTransitions as X, GetSchemaById200 as Xa, CreateUser400Details as Xc, IssueChallengeBodyPasskeyOptions as Xi, CreateFlowDefinitionBodyFlowDefinition as Xl, QuerySessions400 as Xn, GetFlowStep200StepChallenge as Xo, ListUsers500 as Xr, GetAuthAttempt200RequiredFactorsItem as Xs, SubmitFlowStep200StepActionsItemKind as Xt, CreateFlow201Branding as Xu, UpdateFlowDefinition200FlowDefinitionStepsItem as Y, GetSchemaById400Details as Ya, CreateUser400 as Yc, IssueChallengeBody as Yi, CreateFlowDefinitionBody as Yl, QuerySessions401Details as Yn, GetFlowStep200StepComplete as Yo, ListUsersDefault as Yr, GetAuthAttempt200State as Ys, SubmitFlowStep200StepActionsItem as Yt, CreateFlow201StepActionsItemKind as Yu, UpdateFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem as Z, GetReadyDefault as Za, CreateUser201 as Zc, IssueChallengeBodyPasskeyOptionsUserVerification as Zi, CreateFlowDefinitionBodyFlowDefinitionStepsItem as Zl, QuerySessions400Details as Zn, GetFlowStep200StepChallengeOptions as Zo, ListUsers500Details as Zr, GetAuthAttempt200CompletedFactorsItem as Zs, SubmitFlowStep200Branding as Zt, CreateFlow201BrandingLayout as Zu, UpdateTeam409Details as _, GetUserByID200 as _a, ExchangeHandoff200SessionMetadata as _c, CreateAuthAttempt201ChallengesItemState as _d, ListUserPasskeys200 as _i, CreateTeam201 as _l, QueryTeamsBody as _n, GetMySession401 as _o, QueryProjects403Details as _r, GetFlowDefinition200FlowDefinitionAudience as _s, SubmitFlowStep400StepTexts as _t, CreateFlowDefinition201FlowDefinitionStepsItemSsoProvidersItem as _u, VerifyChallengeProof200RequiredFactorsItem as a, InitClaim409 as aa, ExchangeHandoffDefault as ac, CreateBranding201 as ad, ListUserPasskeysParams as ai, CreateTeam429 as al, SetUserPassword400 as an, GetProject401Details as ao, QuerySessions200SessionsItemFactorsItemMethod as ar, GetFlowDefinition200FlowDefinition as as, UpdateFlowDefinition200FlowDefinitionStatus as at, CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItem as au, UpdateTeam403 as b, GetUserByID200Attributes as ba, ExchangeHandoff200SessionFactorsItemMethod as bc, CompleteClaimDefault as bd, ListSchemasDefault as bi, CreateSessionBody as bl, QueryTeamsBodySortingDirection as bn, GetMySession200State as bo, QueryProjects400 as br, GetEventDefaultDetails as bs, SubmitFlowStep400StepGatesKind as bt, CreateFlowDefinition201FlowDefinitionStepsItemGatesKind as bu, VerifyChallengeProof200CompletedFactorsItemMethod as c, InitClaim401 as ca, ExchangeHandoff410Details as cc, CreateAuthAttemptDefault as cd, ListUserPasskeys500Details as ci, CreateTeam409Details as cl, RevokeSession403 as cn, GetMyUser404 as co, QueryProjectsBodySorting as cr, GetFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem as cs, SubmitFlowStepBody as ct, CreateFlowDefinitionBodyFlowDefinitionAudience as cu, VerifyChallengeProof200ChallengesItemPayload as d, GetUserByIDParams as da, ExchangeHandoff400 as dc, CreateAuthAttempt201State as dd, ListUserPasskeys403 as di, CreateTeam403 as dl, RevokeSession401Details as dn, GetMyUser200 as do, QueryProjectsBodyFilterItem as dr, GetFlowDefinition200FlowDefinitionStepsItemGatesKind as ds, SubmitFlowStepBodyChallengeResponse as dt, CreateFlowDefinition400 as du, IssueChallenge201State as ea, GetAuthAttempt200ChallengesItem as ec, CreateBrandingDefaultDetails as ed, ListUsers200 as ei, CreateUser201Attributes as el, SetUserPasswordBody as en, GetReady4xxDetails as eo, QuerySessions200SessionsItemUserAgent as er, GetFlowStep200StepActionsItemKind as es, UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind as et, CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess as eu, VerifyChallengeProof200ChallengesItemMethod as f, GetUserByIDDefault as fa, ExchangeHandoff400Details as fc, CreateAuthAttempt201RequiredFactorsItem as fd, ListUserPasskeys403Details as fi, CreateTeam403Details as fl, RevokeMySessionDefault as fn, GetMyUser200Metadata as fo, QueryProjectsBodyFilterItemOperation as fr, GetFlowDefinition200FlowDefinitionStepsItemGatesConfig as fs, SubmitFlowStepBodyChallengeResponseProof as ft, CreateFlowDefinition400Details as fu, UpdateTeam409 as g, GetUserByID401Details as ga, ExchangeHandoff200SessionState as gc, CreateAuthAttempt201ChallengesItem as gd, ListUserPasskeys400Details as gi, CreateTeam400Details as gl, QueryTeamsDefaultDetails as gn, GetMySession404 as go, QueryProjects403 as gr, GetFlowDefinition200FlowDefinitionStatus as gs, SubmitFlowStep400Step as gt, CreateFlowDefinition201FlowDefinitionStepsItemTransitions as gu, UpdateTeamBody as h, GetUserByID401 as ha, ExchangeHandoff200SessionUserAgent as hc, CreateAuthAttempt201CompletedFactorsItemMethod as hd, ListUserPasskeys400 as hi, CreateTeam400 as hl, QueryTeamsDefault as hn, GetMySessionDefault as ho, QueryProjects429Details as hr, GetFlowDefinition200FlowDefinitionStepsItemActionsItemKind as hs, SubmitFlowStep400 as ht, CreateFlowDefinition201FlowDefinitionStepsItem as hu, VerifyChallengeProof200State as i, InitClaimDefaultDetails as ia, ExchangeHandoffParams as ic, CreateBranding400Details as id, ListUsers200UsersItemAttributes as ii, CreateTeamBody as il, SetUserPassword404Details as in, GetProject401 as io, QuerySessions200SessionsItemFactorsItemPayload as ir, GetFlowDefinition200 as is, UpdateFlowDefinition200FlowDefinitionStepsItemActionsItemKind as it, CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete as iu, UpdateFlowDefinitionBodyFlowDefinitionStepsItem as j, GetSession404Details as ja, DeleteTeam401Details as jc, CompleteClaim400 as jd, ListEventsParams as ji, CreateSession201SessionFactorsItemMethod as jl, QueryTeams401Details as jn, GetHealth4xx as jo, PatchProject400Details as jr, GetClaimStatus429 as js, SubmitFlowStep400StepActionsItemKind as jt, CreateFlow400 as ju, UpdateFlowDefinitionBody as k, GetSessionDefault as ka, DeleteTeam403Details as kc, CompleteClaim404Details as kd, ListFlowDefinitions200FlowDefinitionsItem as ki, CreateSession201SessionFactorsItem as kl, QueryTeams403Details as kn, GetHealthDefault as ko, PatchProject401Details as kr, GetClaimStatusDefault as ks, SubmitFlowStep400StepChallengeMethod as kt, CreateFlowBodyPurpose as ku, VerifyChallengeProof200ChallengesItem as l, InitClaim401Details as la, ExchangeHandoff401 as lc, CreateAuthAttemptBody as ld, ListUserPasskeys404 as li, CreateTeam404 as ll, RevokeSession403Details as ln, GetMyUser401 as lo, QueryProjectsBodySortingField as lr, GetFlowDefinition200FlowDefinitionStepsItemOnSuccess as ls, SubmitFlowStepBodyGateProofs as lt, CreateFlowDefinition409 as lu, UpdateTeamDefaultDetails as m, GetUserByID404Details as ma, ExchangeHandoff200Session as mc, CreateAuthAttempt201CompletedFactorsItemPayload as md, ListUserPasskeys401Details as mi, CreateTeam401Details as ml, QueryTeamsParams as mn, GetMyUser200Attributes as mo, QueryProjects429 as mr, GetFlowDefinition200FlowDefinitionStepsItemActionsItem as ms, SubmitFlowStep409Details as mt, CreateFlowDefinition201FlowDefinition as mu, VerifyChallengeProofBody as n, IssueChallenge201Method as na, GetAuthAttempt200ChallengesItemPayload as nc, CreateBrandingBodyLayout as nd, ListUsers200UsersItemMetadata as ni, CreateTeamDefault as nl, SetUserPassword500Details as nn, GetProject404 as no, QuerySessions200SessionsItemMetadata as nr, GetFlowStep200BrandingLayout as ns, UpdateFlowDefinition200FlowDefinitionStepsItemComplete as nt, CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind as nu, VerifyChallengeProof200CompletedFactorsItem as o, InitClaim409Details as oa, ExchangeHandoffBody as oc, CreateBranding201Branding as od, ListUserPasskeysDefault as oi, CreateTeam429Details as ol, SetUserPassword400Details as on, GetProject200 as oo, QueryProjectsDefault as or, GetFlowDefinition200FlowDefinitionStepsItem as os, UpdateFlowDefinition200FlowDefinitionAudience as ot, CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind as ou, UpdateTeamDefault as p, GetUserByID404 as pa, ExchangeHandoff200 as pc, CreateAuthAttempt201CompletedFactorsItem as pd, ListUserPasskeys401 as pi, CreateTeam401 as pl, RevokeMySession401 as pn, GetMyUser200MetadataStatus as po, QueryProjectsBodyFilterItemField as pr, GetFlowDefinition200FlowDefinitionStepsItemComplete as ps, SubmitFlowStep409 as pt, CreateFlowDefinition201 as pu, UpdateFlowDefinition200 as q, GetSchemaById404Details as qa, CreateUser401 as qc, ListBranding200Item as qi, CreateHandoff200 as ql, QuerySessions403Details as qn, GetFlowStep200StepFieldsItemValidationFormat as qo, ListUserTeams200TeamsItemMembershipStatus as qr, GetAuthAttemptDefault as qs, SubmitFlowStep200StepChallengeOptions as qt, CreateFlow201StepChallengeMethod as qu, VerifyChallengeProof200 as r, InitClaimDefault as ra, GetAuthAttempt200ChallengesItemMethod as rc, CreateBranding400 as rd, ListUsers200UsersItemMetadataStatus as ri, CreateTeamDefaultDetails as rl, SetUserPassword404 as rn, GetProject404Details as ro, QuerySessions200SessionsItemFactorsItem as rr, GetFlowDefinitionDefault as rs, UpdateFlowDefinition200FlowDefinitionStepsItemActionsItem as rt, CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig as ru, VerifyChallengeProof200CompletedFactorsItemPayload as s, InitClaim404 as sa, ExchangeHandoff410 as sc, CreateBranding201BrandingLayout as sd, ListUserPasskeys500 as si, CreateTeam409 as sl, RevokeSessionDefault as sn, GetMyUserDefault as so, QueryProjectsBody as sr, GetFlowDefinition200FlowDefinitionStepsItemTransitions as ss, SubmitFlowStepDefault as st, CreateFlowDefinitionBodyFlowDefinitionStatus as su, VerifyChallengeProofDefault as t, IssueChallenge201Payload as ta, GetAuthAttempt200ChallengesItemState as tc, CreateBrandingBody as td, ListUsers200UsersItem as ti, CreateTeamParams as tl, SetUserPassword500 as tn, GetProjectDefault as to, QuerySessions200SessionsItemState as tr, GetFlowStep200Branding as ts, UpdateFlowDefinition200FlowDefinitionStepsItemGatesConfig as tt, CreateFlowDefinitionBodyFlowDefinitionStepsItemGates as tu, VerifyChallengeProof200ChallengesItemState as u, InitClaim201 as ua, ExchangeHandoff401Details as uc, CreateAuthAttempt201 as ud, ListUserPasskeys404Details as ui, CreateTeam404Details as ul, RevokeSession401 as un, GetMyUser401Details as uo, QueryProjectsBodySortingDirection as ur, GetFlowDefinition200FlowDefinitionStepsItemGates as us, SubmitFlowStepBodyFields as ut, CreateFlowDefinition409Details as uu, UpdateTeam404 as v, GetUserByID200Metadata as va, ExchangeHandoff200SessionFactorsItem as vc, CreateAuthAttempt201ChallengesItemPayload as vd, ListUserPasskeys200PasskeysItem as vi, CreateTeam201Status as vl, QueryTeamsBodySorting as vn, GetMySession200 as vo, QueryProjects401 as vr, GetEventParams as vs, SubmitFlowStep400StepSsoProvidersItem as vt, CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess as vu, UpdateTeam400 as w, GetTeam404Details as wa, DeleteUserByID401 as wc, CompleteClaim429Details as wd, ListFlowDefinitionsPurpose as wi, CreateSession201 as wl, QueryTeams429 as wn, GetMySession200FactorsItemMethod as wo, PatchProjectDefault as wr, GetEvent403Details as ws, SubmitFlowStep400StepFieldsItemValidationFormat as wt, CreateFlowDefinition201FlowDefinitionStepsItemActionsItemKind as wu, UpdateTeam403Details as x, GetTeamDefault as xa, DeleteUserByIDDefault as xc, CompleteClaimDefaultDetails as xd, ListSchemasDefaultDetails as xi, CreateSessionBodyUserAgent as xl, QueryTeamsBodyFilterItem as xn, GetMySession200Metadata as xo, QueryProjects400Details as xr, GetEvent404 as xs, SubmitFlowStep400StepGatesConfig as xt, CreateFlowDefinition201FlowDefinitionStepsItemGatesConfig as xu, UpdateTeam404Details as y, GetUserByID200MetadataStatus as ya, ExchangeHandoff200SessionFactorsItemPayload as yc, CreateAuthAttempt201ChallengesItemMethod as yd, ListSchemasParams as yi, CreateSessionDefault as yl, QueryTeamsBodySortingField as yn, GetMySession200UserAgent as yo, QueryProjects401Details as yr, GetEventDefault as ys, SubmitFlowStep400StepGates as yt, CreateFlowDefinition201FlowDefinitionStepsItemGates as yu, UpdateFlowDefinitionBodyFlowDefinitionStepsItemActionsItem as z, GetSession200Metadata as za, CreateUserBody as zc, ListEvents401Details as zi, CreateSchema400Details as zl, QuerySessionsBody as zn, GetFlowStep200Step as zo, ListUserTeams403 as zr, GetClaimStatus200 as zs, SubmitFlowStep200StepGatesKind as zt, CreateFlow201StepGatesConfig as zu };
+//# sourceMappingURL=index-Dt_0fSH9.d.mts.map