@zitadel/api 0.1.0-alpha.18 → 0.1.0-alpha.19

package/dist/generated/endpoints/zitadelNextGen.zod.mjs

@@ -16,21 +16,10 @@ const CreateUserQueryParams = zod.strictObject({
 	project_id: zod.string().regex(createUserQueryProjectIdRegExp).describe("The unique identifier of the project"),
 	team_id: zod.string().regex(createUserQueryTeamIdRegExp).optional().describe("The unique identifier of the team")
 });
-const createUserBodyIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const CreateUserBody = zod.object({
-	id: zod.string().regex(createUserBodyIdRegExp).optional(),
-	metadata: zod.object({
-		created_at: zod.iso.datetime({ offset: true }).describe("The time when the user was created."),
-		updated_at: zod.iso.datetime({ offset: true }).describe("The time when the user was last updated."),
-		status: zod.enum([
-			"active",
-			"suspended",
-			"deactivated",
-			"pending_purge"
-		]).describe("The status of the user."),
-		lifecycle_owner_team_id: zod.union([zod.string(), zod.null()]).optional().describe("The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team roster: it decides who may deprovision the user, not\nwhich teams the user collaborates in. The roster is its own paginated\nresource — `GET /users/{user_id}/teams`.\n")
-	}).optional()
-}).describe("A user represents an individual identity in the system. It can be used to \nrepresent a human user, but also a service account or any other type of \nidentity. The content of a user is determined by the configured schema for \nusers, this is only a base schema.\n\nThe server assigns the resource primary key (`id`) on create. Clients must\nnot send `id` in the create body; it is returned in the create response.\n");
+	schema: zod.string().min(1).describe("The schema that defines the content of `attributes`. These schemas can be\ncreated using the `/schemas` endpoint. A default schema is provided.\n"),
+	attributes: zod.record(zod.string(), zod.unknown()).describe("The user's schema-defined content. Validated against `schema`; a\nproperty the schema does not permit is rejected with `user.invalid`.\n")
+}).describe("`attributes` is the document that must satisfy the user schema named by\n`schema`.\n\nThe resource primary key is server-assigned and returned in the response, so\nthe request carries no `id`; `metadata` is server-owned for the same reason.\nNeither is part of this schema, which is what frees a user schema to declare\nproperties of those names.\n\nA request carrying any other top-level property is rejected rather than\nignored. `attributes` stays open, since the user schema is what determines\nwhat belongs in it.\n");
 /**
 * @summary List users
 */
@@ -43,7 +32,9 @@ const ListUsersQueryParams = zod.strictObject({
 const listUsersResponseUsersItemIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const ListUsersResponse = zod.object({
 	users: zod.array(zod.object({
-		id: zod.string().regex(listUsersResponseUsersItemIdRegExp).optional(),
+		id: zod.string().regex(listUsersResponseUsersItemIdRegExp),
+		schema: zod.string().describe("The schema that defines the content of `attributes`. These schemas can be\ncreated using the `/schemas` endpoint. A default schema is provided.\nThis schema can be retrieved using the same endpoint.\n"),
+		attributes: zod.record(zod.string(), zod.unknown()).describe("The user's content, satisfying the schema named by `schema`. Property\nnames and types are determined entirely by that schema.\n"),
 		metadata: zod.object({
 			created_at: zod.iso.datetime({ offset: true }).describe("The time when the user was created."),
 			updated_at: zod.iso.datetime({ offset: true }).describe("The time when the user was last updated."),
@@ -54,8 +45,8 @@ const ListUsersResponse = zod.object({
 				"pending_purge"
 			]).describe("The status of the user."),
 			lifecycle_owner_team_id: zod.union([zod.string(), zod.null()]).optional().describe("The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team roster: it decides who may deprovision the user, not\nwhich teams the user collaborates in. The roster is its own paginated\nresource — `GET /users/{user_id}/teams`.\n")
-		}).optional()
-	}).describe("A user represents an individual identity in the system. It can be used to \nrepresent a human user, but also a service account or any other type of \nidentity. The content of a user is determined by the configured schema for \nusers, this is only a base schema.\n\nThe server assigns the resource primary key (`id`) on create. Clients must\nnot send `id` in the create body; it is returned in the create response.\n")),
+		})
+	}).describe("A user represents an individual identity in the system. It can be used to\nrepresent a human user, but also a service account or any other type of\nidentity.\n\n`attributes` is the document that satisfies the user schema named by\n`schema`: its property names and types are defined entirely by that schema,\nand it is what the schema validates. The rest of the object — `id`,\n`schema`, `metadata` — is the server-owned envelope. Keeping the two apart\nmeans a schema may name a property `id` or `metadata` without colliding with\nthe envelope, and closed-world keywords (`additionalProperties: false`,\n`propertyNames`, `unevaluatedProperties`) behave as their author expects.\n")),
 	next_page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results.\n")
 }).describe("Paginated list of users.");
 /**
@@ -63,15 +54,13 @@ const ListUsersResponse = zod.object({
 */
 const getUserByIDPathUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const GetUserByIDParams = zod.object({ user_id: zod.string().regex(getUserByIDPathUserIdRegExp) });
-const getUserByIDQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const getUserByIDQueryTeamIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const GetUserByIDQueryParams = zod.strictObject({
-	project_id: zod.string().regex(getUserByIDQueryProjectIdRegExp).describe("The unique identifier of the project"),
-	team_id: zod.string().regex(getUserByIDQueryTeamIdRegExp).optional().describe("The unique identifier of the team")
-});
+const GetUserByIDQueryParams = zod.strictObject({ team_id: zod.string().regex(getUserByIDQueryTeamIdRegExp).optional().describe("The unique identifier of the team") });
 const getUserByIDResponseIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const GetUserByIDResponse = zod.object({
-	id: zod.string().regex(getUserByIDResponseIdRegExp).optional(),
+	id: zod.string().regex(getUserByIDResponseIdRegExp),
+	schema: zod.string().describe("The schema that defines the content of `attributes`. These schemas can be\ncreated using the `/schemas` endpoint. A default schema is provided.\nThis schema can be retrieved using the same endpoint.\n"),
+	attributes: zod.record(zod.string(), zod.unknown()).describe("The user's content, satisfying the schema named by `schema`. Property\nnames and types are determined entirely by that schema.\n"),
 	metadata: zod.object({
 		created_at: zod.iso.datetime({ offset: true }).describe("The time when the user was created."),
 		updated_at: zod.iso.datetime({ offset: true }).describe("The time when the user was last updated."),
@@ -82,15 +71,13 @@ const GetUserByIDResponse = zod.object({
 			"pending_purge"
 		]).describe("The status of the user."),
 		lifecycle_owner_team_id: zod.union([zod.string(), zod.null()]).optional().describe("The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team roster: it decides who may deprovision the user, not\nwhich teams the user collaborates in. The roster is its own paginated\nresource — `GET /users/{user_id}/teams`.\n")
-	}).optional()
-}).describe("A user represents an individual identity in the system. It can be used to \nrepresent a human user, but also a service account or any other type of \nidentity. The content of a user is determined by the configured schema for \nusers, this is only a base schema.\n\nThe server assigns the resource primary key (`id`) on create. Clients must\nnot send `id` in the create body; it is returned in the create response.\n");
+	})
+}).describe("A user represents an individual identity in the system. It can be used to\nrepresent a human user, but also a service account or any other type of\nidentity.\n\n`attributes` is the document that satisfies the user schema named by\n`schema`: its property names and types are defined entirely by that schema,\nand it is what the schema validates. The rest of the object — `id`,\n`schema`, `metadata` — is the server-owned envelope. Keeping the two apart\nmeans a schema may name a property `id` or `metadata` without colliding with\nthe envelope, and closed-world keywords (`additionalProperties: false`,\n`propertyNames`, `unevaluatedProperties`) behave as their author expects.\n");
 /**
 * @summary Delete user by ID
 */
 const deleteUserByIDPathUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const DeleteUserByIDParams = zod.object({ user_id: zod.string().regex(deleteUserByIDPathUserIdRegExp) });
-const deleteUserByIDQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const DeleteUserByIDQueryParams = zod.strictObject({ project_id: zod.string().regex(deleteUserByIDQueryProjectIdRegExp).describe("The unique identifier of the project") });
 /**
 * @summary List user passkeys
 */
@@ -98,11 +85,9 @@ const listUserPasskeysPathUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA
 const ListUserPasskeysParams = zod.object({ user_id: zod.string().regex(listUserPasskeysPathUserIdRegExp) });
 const listUserPasskeysQueryLimitDefault = 20;
 const listUserPasskeysQueryLimitMax = 100;
-const listUserPasskeysQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const ListUserPasskeysQueryParams = zod.strictObject({
 	limit: zod.number().min(1).max(100).default(20).describe("Maximum number of items to return."),
-	page_token: zod.string().optional().describe("Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n"),
-	project_id: zod.string().regex(listUserPasskeysQueryProjectIdRegExp).describe("The unique identifier of the project")
+	page_token: zod.string().optional().describe("Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n")
 });
 const ListUserPasskeysResponse = zod.object({
 	passkeys: zod.array(zod.object({
@@ -117,8 +102,6 @@ const ListUserPasskeysResponse = zod.object({
 */
 const setUserPasswordPathUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const SetUserPasswordParams = zod.object({ user_id: zod.string().regex(setUserPasswordPathUserIdRegExp) });
-const setUserPasswordQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const SetUserPasswordQueryParams = zod.strictObject({ project_id: zod.string().regex(setUserPasswordQueryProjectIdRegExp).describe("The unique identifier of the project") });
 const SetUserPasswordBody = zod.object({
 	password: zod.string().describe("The new password for the user."),
 	is_change_required: zod.boolean().optional().describe("Whether the user is required to change their password on the next login.\nIf not provided, it will default to false.\n")
@@ -138,11 +121,9 @@ const listUserTeamsPathUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0
 const ListUserTeamsParams = zod.object({ user_id: zod.string().regex(listUserTeamsPathUserIdRegExp) });
 const listUserTeamsQueryLimitDefault = 20;
 const listUserTeamsQueryLimitMax = 100;
-const listUserTeamsQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const ListUserTeamsQueryParams = zod.strictObject({
 	limit: zod.number().min(1).max(100).default(20).describe("Maximum number of items to return."),
-	page_token: zod.string().optional().describe("Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n"),
-	project_id: zod.string().regex(listUserTeamsQueryProjectIdRegExp).describe("The unique identifier of the project")
+	page_token: zod.string().optional().describe("Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n")
 });
 const ListUserTeamsResponse = zod.object({
 	teams: zod.array(zod.object({
@@ -163,7 +144,9 @@ const ListUserTeamsResponse = zod.object({
 */
 const getMyUserResponseIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const GetMyUserResponse = zod.object({
-	id: zod.string().regex(getMyUserResponseIdRegExp).optional(),
+	id: zod.string().regex(getMyUserResponseIdRegExp),
+	schema: zod.string().describe("The schema that defines the content of `attributes`. These schemas can be\ncreated using the `/schemas` endpoint. A default schema is provided.\nThis schema can be retrieved using the same endpoint.\n"),
+	attributes: zod.record(zod.string(), zod.unknown()).describe("The user's content, satisfying the schema named by `schema`. Property\nnames and types are determined entirely by that schema.\n"),
 	metadata: zod.object({
 		created_at: zod.iso.datetime({ offset: true }).describe("The time when the user was created."),
 		updated_at: zod.iso.datetime({ offset: true }).describe("The time when the user was last updated."),
@@ -174,8 +157,8 @@ const GetMyUserResponse = zod.object({
 			"pending_purge"
 		]).describe("The status of the user."),
 		lifecycle_owner_team_id: zod.union([zod.string(), zod.null()]).optional().describe("The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team roster: it decides who may deprovision the user, not\nwhich teams the user collaborates in. The roster is its own paginated\nresource — `GET /users/{user_id}/teams`.\n")
-	}).optional()
-}).describe("A user represents an individual identity in the system. It can be used to \nrepresent a human user, but also a service account or any other type of \nidentity. The content of a user is determined by the configured schema for \nusers, this is only a base schema.\n\nThe server assigns the resource primary key (`id`) on create. Clients must\nnot send `id` in the create body; it is returned in the create response.\n");
+	})
+}).describe("A user represents an individual identity in the system. It can be used to\nrepresent a human user, but also a service account or any other type of\nidentity.\n\n`attributes` is the document that satisfies the user schema named by\n`schema`: its property names and types are defined entirely by that schema,\nand it is what the schema validates. The rest of the object — `id`,\n`schema`, `metadata` — is the server-owned envelope. Keeping the two apart\nmeans a schema may name a property `id` or `metadata` without colliding with\nthe envelope, and closed-world keywords (`additionalProperties: false`,\n`propertyNames`, `unevaluatedProperties`) behave as their author expects.\n");
 /**
 * Resolves a flow definition based on purpose + audience context and returns
 the first capability step. Creates a new session implicitly unless
@@ -749,7 +732,7 @@ const QueryProjectsBody = zod.object({
 			"less_than_or_equal",
 			"greater_than",
 			"greater_than_or_equal"
-		]).describe("Filter operation defines the operations which can be used when filtering on a\nquery endpoint.\n")
+		]).describe("Filter operation defines the operations which can be used when filtering on a\nquery endpoint.\n\nOn text fields, `contains` is a case-insensitive substring match. `equals`\ncompares the whole value and is case-sensitive unless the field documents\notherwise.\n")
 	})).optional().describe("Filter criteria for querying projects.")
 }).describe("Request to query projects.");
 const QueryProjectsResponse = zod.object({
@@ -896,7 +879,7 @@ const QuerySessionsBody = zod.object({
 			"created_at",
 			"user_id",
 			"state"
-		]).describe("Field to filter sessions by:\n- `created_at`: RFC3339 timestamp\n- `user_id`: user id\n- `state`: one of `building`, `active`, `expired`\n"),
+		]).describe("Field to filter sessions by:\n- `created_at`: RFC3339 timestamp\n- `user_id`: user id\n- `state`: one of `building`, `active`, `expired`. State is computed at read\n  time, so a session expiring mid-request can match `active` but return `expired`.\n"),
 		value: zod.union([
 			zod.string(),
 			zod.number(),
@@ -912,7 +895,7 @@ const QuerySessionsBody = zod.object({
 			"less_than_or_equal",
 			"greater_than",
 			"greater_than_or_equal"
-		]).describe("Filter operation defines the operations which can be used when filtering on a\nquery endpoint.\n")
+		]).describe("Filter operation defines the operations which can be used when filtering on a\nquery endpoint.\n\nOn text fields, `contains` is a case-insensitive substring match. `equals`\ncompares the whole value and is case-sensitive unless the field documents\notherwise.\n")
 	})).optional().describe("Filter criteria for querying sessions.")
 }).describe("Request to query the sessions of a project.");
 const querySessionsResponseSessionsItemSessionIdRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
@@ -927,7 +910,7 @@ const QuerySessionsResponse = zod.object({
 			"building",
 			"active",
 			"expired"
-		]).describe("Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n"),
+		]).describe("Current lifecycle state of the session:\n- `building`: no verified authentication factors yet\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n"),
 		user_id: zod.union([zod.string().regex(querySessionsResponseSessionsItemUserIdOneRegExp), zod.null()]).optional().describe("The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n"),
 		name: zod.string().optional().describe("Human-readable name of the authenticated user, resolved from the\nconventional user-schema properties: `name` when defined, otherwise\nthe given and family name parts joined — `givenName`/`familyName`\n(the shipped presets' spelling) or `given_name`/`family_name`. Only\npresent on reads that hydrate the user's identity\n(`GET /sessions/me`) and only when the session has an authenticated\nuser whose schema carries those properties; clients fall back to\n`email`, then `user_id`.\n"),
 		email: zod.string().optional().describe("Email address of the authenticated user, resolved from the\nconventional `email` user-schema property. Only present on reads\nthat hydrate the user's identity (`GET /sessions/me`) and only when\nthe session has an authenticated user whose schema carries that\nproperty.\n"),
@@ -1001,7 +984,7 @@ const ExchangeHandoffResponse = zod.object({
 			"building",
 			"active",
 			"expired"
-		]).describe("Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n"),
+		]).describe("Current lifecycle state of the session:\n- `building`: no verified authentication factors yet\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n"),
 		user_id: zod.union([zod.string().regex(exchangeHandoffResponseSessionUserIdOneRegExp), zod.null()]).optional().describe("The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n"),
 		name: zod.string().optional().describe("Human-readable name of the authenticated user, resolved from the\nconventional user-schema properties: `name` when defined, otherwise\nthe given and family name parts joined — `givenName`/`familyName`\n(the shipped presets' spelling) or `given_name`/`family_name`. Only\npresent on reads that hydrate the user's identity\n(`GET /sessions/me`) and only when the session has an authenticated\nuser whose schema carries those properties; clients fall back to\n`email`, then `user_id`.\n"),
 		email: zod.string().optional().describe("Email address of the authenticated user, resolved from the\nconventional `email` user-schema property. Only present on reads\nthat hydrate the user's identity (`GET /sessions/me`) and only when\nthe session has an authenticated user whose schema carries that\nproperty.\n"),
@@ -1047,8 +1030,6 @@ against the same `session_id`) to restore a dropped assurance level.
 */
 const getSessionPathSessionIdRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const GetSessionParams = zod.object({ session_id: zod.string().regex(getSessionPathSessionIdRegExp).describe("The unique identifier of the session.") });
-const getSessionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const GetSessionQueryParams = zod.strictObject({ project_id: zod.string().regex(getSessionQueryProjectIdRegExp).describe("The unique identifier of the project") });
 const getSessionResponseSessionIdRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const getSessionResponseProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const getSessionResponseUserIdOneRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
@@ -1060,7 +1041,7 @@ const GetSessionResponse = zod.object({
 		"building",
 		"active",
 		"expired"
-	]).describe("Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n"),
+	]).describe("Current lifecycle state of the session:\n- `building`: no verified authentication factors yet\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n"),
 	user_id: zod.union([zod.string().regex(getSessionResponseUserIdOneRegExp), zod.null()]).optional().describe("The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n"),
 	name: zod.string().optional().describe("Human-readable name of the authenticated user, resolved from the\nconventional user-schema properties: `name` when defined, otherwise\nthe given and family name parts joined — `givenName`/`familyName`\n(the shipped presets' spelling) or `given_name`/`family_name`. Only\npresent on reads that hydrate the user's identity\n(`GET /sessions/me`) and only when the session has an authenticated\nuser whose schema carries those properties; clients fall back to\n`email`, then `user_id`.\n"),
 	email: zod.string().optional().describe("Email address of the authenticated user, resolved from the\nconventional `email` user-schema property. Only present on reads\nthat hydrate the user's identity (`GET /sessions/me`) and only when\nthe session has an authenticated user whose schema carries that\nproperty.\n"),
@@ -1107,8 +1088,6 @@ invalidated.
 */
 const revokeSessionPathSessionIdRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const RevokeSessionParams = zod.object({ session_id: zod.string().regex(revokeSessionPathSessionIdRegExp).describe("The unique identifier of the session.") });
-const revokeSessionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const RevokeSessionQueryParams = zod.strictObject({ project_id: zod.string().regex(revokeSessionQueryProjectIdRegExp).describe("The unique identifier of the project") });
 /**
 * Returns the current state of the current session including its factors and all currently
 satisfied assurance levels.
@@ -1130,7 +1109,7 @@ const GetMySessionResponse = zod.object({
 		"building",
 		"active",
 		"expired"
-	]).describe("Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n"),
+	]).describe("Current lifecycle state of the session:\n- `building`: no verified authentication factors yet\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n"),
 	user_id: zod.union([zod.string().regex(getMySessionResponseUserIdOneRegExp), zod.null()]).optional().describe("The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n"),
 	name: zod.string().optional().describe("Human-readable name of the authenticated user, resolved from the\nconventional user-schema properties: `name` when defined, otherwise\nthe given and family name parts joined — `givenName`/`familyName`\n(the shipped presets' spelling) or `given_name`/`family_name`. Only\npresent on reads that hydrate the user's identity\n(`GET /sessions/me`) and only when the session has an authenticated\nuser whose schema carries those properties; clients fall back to\n`email`, then `user_id`.\n"),
 	email: zod.string().optional().describe("Email address of the authenticated user, resolved from the\nconventional `email` user-schema property. Only present on reads\nthat hydrate the user's identity (`GET /sessions/me`) and only when\nthe session has an authenticated user whose schema carries that\nproperty.\n"),
@@ -1182,53 +1161,28 @@ const CreateSchemaQueryParams = zod.strictObject({
 	team_id: zod.string().regex(createSchemaQueryTeamIdRegExp).optional().describe("The unique identifier of the team")
 });
 const createSchemaBodyOneObjectTypeMax = 256;
-const createSchemaBodyOneXAuthMethodsPasswordPositionMin = 0;
-const createSchemaBodyOneXAuthMethodsPasskeyPositionMin = 0;
-const createSchemaBodyOneXAuthMethodsMagicLinkPositionMin = 0;
-const createSchemaBodyOneXAuthMethodsSsoPositionMin = 0;
-const createSchemaBodyOneXAuthMethodsOtpPositionMin = 0;
-const createSchemaBodyOnePropertiesXEditableDefault = true;
-const createSchemaBodyOnePropertiesXSensitiveDefault = false;
-const createSchemaBodyOnePropertiesXMfaDefault = false;
+const createSchemaBodyOnePropertiesXAuditDefault = false;
 const CreateSchemaBody = zod.union([zod.object({
 	objectType: zod.string().max(256).optional().describe("The type of user this schema describes. This is a customer chosen name.\n"),
 	kind: zod.literal("user-schema").describe("Discriminator value for a user schema create request."),
 	metaSchema: zod.url().describe("The user Schema version used for this schema."),
 	"x-auth-methods": zod.object({
-		password: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional(),
-		passkey: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional(),
-		magic_link: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional(),
-		sso: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional(),
-		otp: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional()
+		password: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional(),
+		passkey: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional(),
+		magic_link: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional(),
+		sso: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional(),
+		otp: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional()
 	}).describe("A list of authentication methods supported by the user definition."),
 	properties: zod.record(zod.string(), zod.object({
-		"x-verify": zod.union([zod.string(), zod.null()]).optional().describe("The verification method for this property, if applicable"),
 		"x-unique": zod.union([zod.enum([
 			"unspecified",
 			"project",
 			"team"
 		]), zod.null()]).optional().describe("The level of uniqueness for this property, if applicable"),
 		"x-claim": zod.union([zod.string(), zod.null()]).optional().describe("The claim name for this property, if applicable"),
-		"x-editable": zod.boolean().default(true).describe("Whether this property is editable by the user or not"),
-		"x-sensitive": zod.boolean().default(false).describe("Whether this property contains sensitive information or not"),
-		"x-mfa": zod.boolean().default(false).describe("Whether this property is used for multi-factor authentication or not\n"),
+		"x-audit": zod.boolean().default(false).describe("Whether this property's value may appear in audit event payloads. Audit\npayloads are deny-by-default: a property without this annotation\ncontributes its key but never its value.\n"),
 		properties: zod.record(zod.string(), zod.unknown()).optional().describe("A map of additional properties for the user definition, where the key is\nthe property name and the value is the property schema.\n")
-	}).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n\nA few properties are reserved:\n- id: is used to return the id of the user \n- metadata: is used to embed metadata of the user, like creation date, \n  status,... in a return object\n")).optional().describe("A map of additional properties for the user definition, where the\nkey is the property name and the value is the property schema\n")
+	}).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`.\nThis is done because a lot of code generators cannot handle that.\n\nNative JSON Schema keywords such as `type`, `format`, `title` and `writeOnly`\nare accepted without being listed below. `writeOnly: true` is reserved for a\nvalue that may be written but is never returned by the read API; nothing\nenforces it today, so responses still include write-only properties.\n")).optional().describe("A map of additional properties for the user definition, where the\nkey is the property name and the value is the property schema\n")
 }).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n"), zod.object({
 	kind: zod.literal("schema-url").describe("Discriminator value for a user schema create request."),
 	url: zod.url().describe("URL to the schema definition.")
@@ -1259,60 +1213,31 @@ const ListSchemasResponse = zod.array(ListSchemasResponseItem);
 * @summary Get schema by ID
 */
 const GetSchemaByIdParams = zod.object({ id: zod.string() });
-const getSchemaByIdQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const getSchemaByIdQueryTeamIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const GetSchemaByIdQueryParams = zod.strictObject({
-	project_id: zod.string().regex(getSchemaByIdQueryProjectIdRegExp).describe("The unique identifier of the project"),
-	team_id: zod.string().regex(getSchemaByIdQueryTeamIdRegExp).optional().describe("The unique identifier of the team")
-});
+const GetSchemaByIdQueryParams = zod.strictObject({ team_id: zod.string().regex(getSchemaByIdQueryTeamIdRegExp).optional().describe("The unique identifier of the team") });
 const getSchemaByIdResponseOneObjectTypeMax = 256;
-const getSchemaByIdResponseOneXAuthMethodsPasswordPositionMin = 0;
-const getSchemaByIdResponseOneXAuthMethodsPasskeyPositionMin = 0;
-const getSchemaByIdResponseOneXAuthMethodsMagicLinkPositionMin = 0;
-const getSchemaByIdResponseOneXAuthMethodsSsoPositionMin = 0;
-const getSchemaByIdResponseOneXAuthMethodsOtpPositionMin = 0;
-const getSchemaByIdResponseOnePropertiesXEditableDefault = true;
-const getSchemaByIdResponseOnePropertiesXSensitiveDefault = false;
-const getSchemaByIdResponseOnePropertiesXMfaDefault = false;
+const getSchemaByIdResponseOnePropertiesXAuditDefault = false;
 const GetSchemaByIdResponse = zod.object({
 	objectType: zod.string().max(256).optional().describe("The type of user this schema describes. This is a customer chosen name.\n"),
 	kind: zod.literal("user-schema").describe("Discriminator value for a user schema create request."),
 	metaSchema: zod.url().describe("The user Schema version used for this schema."),
 	"x-auth-methods": zod.object({
-		password: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional(),
-		passkey: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional(),
-		magic_link: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional(),
-		sso: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional(),
-		otp: zod.object({
-			enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
-			position: zod.number().min(0).describe("The position of the authentication method in the list of supported methods")
-		}).optional()
+		password: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional(),
+		passkey: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional(),
+		magic_link: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional(),
+		sso: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional(),
+		otp: zod.object({ enabled: zod.boolean().describe("Whether the authentication method is enabled or not") }).optional()
 	}).describe("A list of authentication methods supported by the user definition."),
 	properties: zod.record(zod.string(), zod.object({
-		"x-verify": zod.union([zod.string(), zod.null()]).optional().describe("The verification method for this property, if applicable"),
 		"x-unique": zod.union([zod.enum([
 			"unspecified",
 			"project",
 			"team"
 		]), zod.null()]).optional().describe("The level of uniqueness for this property, if applicable"),
 		"x-claim": zod.union([zod.string(), zod.null()]).optional().describe("The claim name for this property, if applicable"),
-		"x-editable": zod.boolean().default(true).describe("Whether this property is editable by the user or not"),
-		"x-sensitive": zod.boolean().default(false).describe("Whether this property contains sensitive information or not"),
-		"x-mfa": zod.boolean().default(false).describe("Whether this property is used for multi-factor authentication or not\n"),
+		"x-audit": zod.boolean().default(false).describe("Whether this property's value may appear in audit event payloads. Audit\npayloads are deny-by-default: a property without this annotation\ncontributes its key but never its value.\n"),
 		properties: zod.record(zod.string(), zod.unknown()).optional().describe("A map of additional properties for the user definition, where the key is\nthe property name and the value is the property schema.\n")
-	}).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n\nA few properties are reserved:\n- id: is used to return the id of the user \n- metadata: is used to embed metadata of the user, like creation date, \n  status,... in a return object\n")).optional().describe("A map of additional properties for the user definition, where the\nkey is the property name and the value is the property schema\n")
+	}).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`.\nThis is done because a lot of code generators cannot handle that.\n\nNative JSON Schema keywords such as `type`, `format`, `title` and `writeOnly`\nare accepted without being listed below. `writeOnly: true` is reserved for a\nvalue that may be written but is never returned by the read API; nothing\nenforces it today, so responses still include write-only properties.\n")).optional().describe("A map of additional properties for the user definition, where the\nkey is the property name and the value is the property schema\n")
 }).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n");
 /**
 * Creates a new flow definition.
@@ -1371,7 +1296,15 @@ const CreateFlowDefinitionBody = zod.object({
 			complete: zod.enum(["redirect", "show"]).optional().describe("Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC/SAML callback done)\n- show: render as a success/info screen\n"),
 			transitions: zod.record(zod.string(), zod.object({
 				target: zod.string().describe("Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n"),
-				action: zod.union([zod.enum(["switch", "pivot"]), zod.null()]).optional().describe("How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n")
+				action: zod.union([zod.enum(["switch", "pivot"]), zod.null()]).optional().describe("How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n"),
+				purpose: zod.union([zod.enum([
+					"login",
+					"register",
+					"recovery",
+					"profiling",
+					"reauth",
+					"link_account"
+				]), zod.null()]).optional().describe("Local re-purposing. When set, taking this transition changes the\nflow's current purpose to this value — the dispatch mode a step's\nchallenges run under — while the flow's original purpose stays\npinned. Must be a purpose this definition serves, and `target`\nmust be that purpose's entry step. Mutually exclusive with\n`action`: a transition either re-purposes within this flow or\ntargets another flow, never both.\nExample: a \"Sign up\" navigation on the login identifier step\n(`{ target: register, purpose: register }`).\n")
 			})).optional().describe("Maps action/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n")
 		}).describe("A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n")).min(1).describe("Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n")
 	}).describe("A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST /flow.\n")
@@ -1416,8 +1349,6 @@ const ListFlowDefinitionsResponse = zod.object({
 * @summary Get a flow definition by id
 */
 const GetFlowDefinitionParams = zod.object({ id: zod.string().describe("The id returned by the POST /flow_definitions endpoint.\n") });
-const getFlowDefinitionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const GetFlowDefinitionQueryParams = zod.strictObject({ project_id: zod.string().regex(getFlowDefinitionQueryProjectIdRegExp).describe("The project id to filter by.") });
 const getFlowDefinitionResponseFlowDefinitionNameRegExp = /* @__PURE__ */ new RegExp("^[a-z][a-z0-9-]*$");
 const getFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault = [];
 const getFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault = false;
@@ -1465,7 +1396,15 @@ const GetFlowDefinitionResponse = zod.object({
 			complete: zod.enum(["redirect", "show"]).optional().describe("Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC/SAML callback done)\n- show: render as a success/info screen\n"),
 			transitions: zod.record(zod.string(), zod.object({
 				target: zod.string().describe("Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n"),
-				action: zod.union([zod.enum(["switch", "pivot"]), zod.null()]).optional().describe("How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n")
+				action: zod.union([zod.enum(["switch", "pivot"]), zod.null()]).optional().describe("How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n"),
+				purpose: zod.union([zod.enum([
+					"login",
+					"register",
+					"recovery",
+					"profiling",
+					"reauth",
+					"link_account"
+				]), zod.null()]).optional().describe("Local re-purposing. When set, taking this transition changes the\nflow's current purpose to this value — the dispatch mode a step's\nchallenges run under — while the flow's original purpose stays\npinned. Must be a purpose this definition serves, and `target`\nmust be that purpose's entry step. Mutually exclusive with\n`action`: a transition either re-purposes within this flow or\ntargets another flow, never both.\nExample: a \"Sign up\" navigation on the login identifier step\n(`{ target: register, purpose: register }`).\n")
 			})).optional().describe("Maps action/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n")
 		}).describe("A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n")).min(1).describe("Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n")
 	}).describe("A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST /flow.\n"),
@@ -1479,8 +1418,6 @@ If `flow_definition.status` is omitted, the current status is preserved
 * @summary Update a flow definition by id
 */
 const UpdateFlowDefinitionParams = zod.object({ id: zod.string().describe("The id returned by the POST /flow_definitions endpoint.\n") });
-const updateFlowDefinitionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const UpdateFlowDefinitionQueryParams = zod.strictObject({ project_id: zod.string().regex(updateFlowDefinitionQueryProjectIdRegExp).describe("The project id to filter by.") });
 const updateFlowDefinitionBodyFlowDefinitionNameRegExp = /* @__PURE__ */ new RegExp("^[a-z][a-z0-9-]*$");
 const updateFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault = [];
 const updateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault = false;
@@ -1527,7 +1464,15 @@ const UpdateFlowDefinitionBody = zod.object({
 			complete: zod.enum(["redirect", "show"]).optional().describe("Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC/SAML callback done)\n- show: render as a success/info screen\n"),
 			transitions: zod.record(zod.string(), zod.object({
 				target: zod.string().describe("Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n"),
-				action: zod.union([zod.enum(["switch", "pivot"]), zod.null()]).optional().describe("How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n")
+				action: zod.union([zod.enum(["switch", "pivot"]), zod.null()]).optional().describe("How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n"),
+				purpose: zod.union([zod.enum([
+					"login",
+					"register",
+					"recovery",
+					"profiling",
+					"reauth",
+					"link_account"
+				]), zod.null()]).optional().describe("Local re-purposing. When set, taking this transition changes the\nflow's current purpose to this value — the dispatch mode a step's\nchallenges run under — while the flow's original purpose stays\npinned. Must be a purpose this definition serves, and `target`\nmust be that purpose's entry step. Mutually exclusive with\n`action`: a transition either re-purposes within this flow or\ntargets another flow, never both.\nExample: a \"Sign up\" navigation on the login identifier step\n(`{ target: register, purpose: register }`).\n")
 			})).optional().describe("Maps action/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n")
 		}).describe("A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n")).min(1).describe("Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n")
 	}).describe("A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST /flow.\n")
@@ -1579,7 +1524,15 @@ const UpdateFlowDefinitionResponse = zod.object({
 			complete: zod.enum(["redirect", "show"]).optional().describe("Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC/SAML callback done)\n- show: render as a success/info screen\n"),
 			transitions: zod.record(zod.string(), zod.object({
 				target: zod.string().describe("Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n"),
-				action: zod.union([zod.enum(["switch", "pivot"]), zod.null()]).optional().describe("How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n")
+				action: zod.union([zod.enum(["switch", "pivot"]), zod.null()]).optional().describe("How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n"),
+				purpose: zod.union([zod.enum([
+					"login",
+					"register",
+					"recovery",
+					"profiling",
+					"reauth",
+					"link_account"
+				]), zod.null()]).optional().describe("Local re-purposing. When set, taking this transition changes the\nflow's current purpose to this value — the dispatch mode a step's\nchallenges run under — while the flow's original purpose stays\npinned. Must be a purpose this definition serves, and `target`\nmust be that purpose's entry step. Mutually exclusive with\n`action`: a transition either re-purposes within this flow or\ntargets another flow, never both.\nExample: a \"Sign up\" navigation on the login identifier step\n(`{ target: register, purpose: register }`).\n")
 			})).optional().describe("Maps action/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n")
 		}).describe("A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n")).min(1).describe("Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n")
 	}).describe("A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST /flow.\n"),
@@ -1594,8 +1547,6 @@ If the flow definition is the last active flow definition for a given purpose, t
 * @summary Delete a flow definition by id
 */
 const DeleteFlowDefinitionParams = zod.object({ id: zod.string().describe("The id returned by the POST /flow_definitions endpoint.\n") });
-const deleteFlowDefinitionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const DeleteFlowDefinitionQueryParams = zod.strictObject({ project_id: zod.string().regex(deleteFlowDefinitionQueryProjectIdRegExp).describe("The project id to filter by.") });
 /**
 * @summary Create team
 */
@@ -1605,7 +1556,6 @@ const createTeamBodyNameMax = 200;
 const CreateTeamBody = zod.object({ name: zod.string().min(1).max(200).describe("The name of the team. Must be unique within the project.") });
 /**
 * Returns the teams of a project, paginated with a cursor.
-Teams of every lifecycle status are returned; each carries its `status`.
 
 * @summary Query teams
 */
@@ -1617,11 +1567,19 @@ const QueryTeamsBody = zod.object({
 	limit: zod.number().min(1).max(100).default(20),
 	page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to retrieve the next page of results. Must be sent with the same\n`sorting` as the request that issued the token. Omitting `sorting` reuses\nthe default sort and only succeeds when that default matches the token.\n"),
 	sorting: zod.object({
-		field: zod.enum(["created_at"]),
+		field: zod.enum([
+			"created_at",
+			"name",
+			"status"
+		]).describe("Field to filter or sort teams by.\n\nTeam names are unique per project case-insensitively, so `name` is matched\ncase-insensitively by `equals` as well as by `contains`.\n"),
 		direction: zod.enum(["asc", "desc"])
 	}).optional(),
 	filter: zod.array(zod.object({
-		field: zod.enum(["created_at"]),
+		field: zod.enum([
+			"created_at",
+			"name",
+			"status"
+		]).describe("Field to filter or sort teams by.\n\nTeam names are unique per project case-insensitively, so `name` is matched\ncase-insensitively by `equals` as well as by `contains`.\n"),
 		value: zod.union([
 			zod.string(),
 			zod.number(),
@@ -1637,7 +1595,7 @@ const QueryTeamsBody = zod.object({
 			"less_than_or_equal",
 			"greater_than",
 			"greater_than_or_equal"
-		]).describe("Filter operation defines the operations which can be used when filtering on a\nquery endpoint.\n")
+		]).describe("Filter operation defines the operations which can be used when filtering on a\nquery endpoint.\n\nOn text fields, `contains` is a case-insensitive substring match. `equals`\ncompares the whole value and is case-sensitive unless the field documents\notherwise.\n")
 	})).optional().describe("Filter criteria for querying teams.")
 }).describe("Request to query the teams of a project.");
 const QueryTeamsResponse = zod.object({
@@ -1657,8 +1615,6 @@ const QueryTeamsResponse = zod.object({
 */
 const getTeamPathTeamIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const GetTeamParams = zod.object({ team_id: zod.string().regex(getTeamPathTeamIdRegExp) });
-const getTeamQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const GetTeamQueryParams = zod.strictObject({ project_id: zod.string().regex(getTeamQueryProjectIdRegExp).describe("The unique identifier of the project") });
 const GetTeamResponse = zod.object({
 	id: zod.string().describe("The unique identifier of the team."),
 	name: zod.string().describe("The name of the team."),
@@ -1680,8 +1636,6 @@ or doesn't exist succeeds without changing anything.
 */
 const deleteTeamPathTeamIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const DeleteTeamParams = zod.object({ team_id: zod.string().regex(deleteTeamPathTeamIdRegExp) });
-const deleteTeamQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const DeleteTeamQueryParams = zod.strictObject({ project_id: zod.string().regex(deleteTeamQueryProjectIdRegExp).describe("The unique identifier of the project") });
 /**
 * Update team. Only active teams can be updated.
 
@@ -1689,8 +1643,6 @@ const DeleteTeamQueryParams = zod.strictObject({ project_id: zod.string().regex(
 */
 const updateTeamPathTeamIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const UpdateTeamParams = zod.object({ team_id: zod.string().regex(updateTeamPathTeamIdRegExp) });
-const updateTeamQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const UpdateTeamQueryParams = zod.strictObject({ project_id: zod.string().regex(updateTeamQueryProjectIdRegExp).describe("The unique identifier of the project") });
 const updateTeamBodyNameMax = 200;
 const UpdateTeamBody = zod.object({ name: zod.string().min(1).max(200).optional().describe("The name of the team. Must be unique within the project.") });
 const UpdateTeamResponse = zod.object({
@@ -1745,8 +1697,6 @@ const ListBrandingResponse = zod.array(ListBrandingResponseItem);
 * @summary Get a branding revision by ID
 */
 const GetBrandingByIdParams = zod.object({ id: zod.string() });
-const getBrandingByIdQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const GetBrandingByIdQueryParams = zod.strictObject({ project_id: zod.string().regex(getBrandingByIdQueryProjectIdRegExp).describe("The unique identifier of the project") });
 const getBrandingByIdResponseBrandingLayoutDefault = `centered`;
 const getBrandingByIdResponseBrandingLiquidTemplateMax = 131072;
 const GetBrandingByIdResponse = zod.object({
@@ -1760,7 +1710,2495 @@ const GetBrandingByIdResponse = zod.object({
 		hero_url: zod.url().optional().describe("Hero/background image URL (used by split layout).")
 	}).describe("Branding configuration. Appears in two places with one shape:\n\n- On flow responses as a read-only projection: the server resolves the\n  latest branding revision for the project per step response (falling\n  back to built-in defaults when none is stored). Branding is configured\n  via the Branding API / `zitadel apply`, not the Flow API.\n- As the request body of `POST /branding`, which publishes the same\n  shape as a new immutable revision (see ADR 040).\n")
 }).describe("A stored branding revision. `branding` echoes the canonical stored\nconfiguration so clients (e.g. the CLI sync engine) can reconcile local\nfiles with the server's stored state.\n");
+/**
+* Returns project-scoped audit events, newest-first by keyset on
+`(created_at, id)` (ADR 027 / ADR 049). Pass `order=asc` for oldest-first.
+Requires `events.read`.
+
+Pre-claim projects return an empty list (events are stored but not
+visible until claim succeeds). Team-scoped credentials see only events
+whose emit-time `team_id` matches the credential team (enforced when
+team-scoped tokens exist).
+
+Clients discriminate each item via `event_type` (OpenAPI Event oneOf) —
+see docs/design/api/events-catalog.md.
+
+* @summary List events
+*/
+const listEventsQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsQueryOrderDefault = `desc`;
+const listEventsQueryLimitDefault = 20;
+const listEventsQueryLimitMax = 100;
+const ListEventsQueryParams = zod.strictObject({
+	project_id: zod.string().regex(listEventsQueryProjectIdRegExp).describe("The unique identifier of the project"),
+	category: zod.array(zod.enum([
+		"request",
+		"auth",
+		"session",
+		"admin",
+		"entity",
+		"signal"
+	])).optional().describe("Filter by wide-event category. Repeatable (OR within the parameter).\n"),
+	event_type: zod.array(zod.string()).optional().describe("Exact-match filter on `event_type`. Repeatable (OR within the parameter).\n"),
+	actor_id: zod.string().optional(),
+	client_id: zod.string().optional(),
+	session_id: zod.string().optional(),
+	flow_id: zod.string().optional(),
+	request_id: zod.string().optional(),
+	fingerprint: zod.string().optional(),
+	entity_type: zod.string().optional(),
+	entity_id: zod.string().optional(),
+	team_id: zod.string().optional().describe("Filter by emit-time team scope stored on the event."),
+	created_after: zod.iso.datetime({ offset: true }).optional().describe("Inclusive lower bound on `created_at` (RFC 3339)."),
+	created_before: zod.iso.datetime({ offset: true }).optional().describe("Exclusive upper bound on `created_at` (RFC 3339)."),
+	order: zod.enum(["asc", "desc"]).default(listEventsQueryOrderDefault).describe("Sort direction on `(created_at, id)`. Default `desc` (newest first)\nfor audit UI. Pass `asc` for oldest-first.\n"),
+	page_token: zod.string().optional().describe("Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n"),
+	limit: zod.number().min(1).max(100).default(20).describe("Maximum number of items to return.")
+});
+const listEventsResponseDataItemOneOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemTwoOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemThreeOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemFourOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemFiveOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemSixOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemSevenOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemEightOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemNineOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnezeroOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOneoneOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnetwoOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnethreeOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnefourOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnefiveOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnesixOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnesevenOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnesevenTwoPayloadStatusMin = 100;
+const listEventsResponseDataItemOnesevenTwoPayloadStatusMax = 599;
+const listEventsResponseDataItemOnesevenTwoPayloadDurationMsMin = 0;
+const listEventsResponseDataItemOneeightOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemOnenineOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemTwozeroOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemTwooneOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemTwotwoOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemTwothreeOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemTwofourOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemTwofiveOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const listEventsResponseDataItemTwosixOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const ListEventsResponse = zod.object({
+	data: zod.array(zod.union([
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOneOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("auth.attempt.created"),
+			payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+		})).describe("Wide event with event_type=auth.attempt.created.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemTwoOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("auth.attempt.handed_off"),
+			payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+		})).describe("Wide event with event_type=auth.attempt.handed_off.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemThreeOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("auth.check.failed"),
+			payload: zod.object({
+				check_id: zod.string(),
+				check_type: zod.string().optional(),
+				auth_attempt_id: zod.string().optional()
+			}).describe("Payload for `auth.check.failed` / `auth.check.succeeded`.\n`auth_attempt_id` joins the check to its attempt for SIEM correlation.\n")
+		})).describe("Wide event with event_type=auth.check.failed.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemFourOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("auth.check.succeeded"),
+			payload: zod.object({
+				check_id: zod.string(),
+				check_type: zod.string().optional(),
+				auth_attempt_id: zod.string().optional()
+			}).describe("Payload for `auth.check.failed` / `auth.check.succeeded`.\n`auth_attempt_id` joins the check to its attempt for SIEM correlation.\n")
+		})).describe("Wide event with event_type=auth.check.succeeded.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemFiveOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("auth.factor.passkey.enrolled"),
+			payload: zod.object({
+				user_id: zod.string(),
+				factor_id: zod.string().optional()
+			}).describe("Payload for `auth.factor.*` events.")
+		})).describe("Wide event with event_type=auth.factor.passkey.enrolled.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemSixOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("auth.factor.password.set"),
+			payload: zod.object({
+				user_id: zod.string(),
+				factor_id: zod.string().optional()
+			}).describe("Payload for `auth.factor.*` events.")
+		})).describe("Wide event with event_type=auth.factor.password.set.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemSevenOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("auth.token.issued"),
+			payload: zod.object({ scopes: zod.array(zod.string()).optional() }).describe("Payload for `auth.token.issued` events.")
+		})).describe("Wide event with event_type=auth.token.issued.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemEightOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("auth.token.revoked"),
+			payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+		})).describe("Wide event with event_type=auth.token.revoked.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemNineOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("authz.granted"),
+			payload: zod.object({
+				principal_type: zod.string().optional(),
+				principal_id: zod.string().optional(),
+				relation: zod.string().optional()
+			}).describe("Payload for `authz.granted` events.")
+		})).describe("Wide event with event_type=authz.granted.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOnezeroOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("branding.created"),
+			payload: zod.object({
+				layout: zod.string().optional(),
+				logo_url: zod.string().optional(),
+				font_url: zod.string().optional(),
+				hero_url: zod.string().optional()
+			}).describe("Allowlisted fields for `branding.created`. Omits `liquid_template`.\n")
+		})).describe("Wide event with event_type=branding.created.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOneoneOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("flowdef.created"),
+			payload: zod.object({
+				name: zod.string().optional(),
+				status: zod.string().optional(),
+				user_schema: zod.string().optional(),
+				purposes: zod.record(zod.string(), zod.string()).optional(),
+				audience: zod.object({
+					app_ids: zod.array(zod.string()).optional(),
+					team_ids: zod.array(zod.string()).optional()
+				}).optional()
+			}).describe("Shared allowlisted fields for `flowdef.created` (full snapshot) and\n`flowdef.updated` (delta: only changed fields present). Steps are omitted.\n")
+		})).describe("Wide event with event_type=flowdef.created.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOnetwoOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("flowdef.deleted"),
+			payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+		})).describe("Wide event with event_type=flowdef.deleted.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOnethreeOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("flowdef.updated"),
+			payload: zod.object({
+				name: zod.string().optional(),
+				status: zod.string().optional(),
+				user_schema: zod.string().optional(),
+				purposes: zod.record(zod.string(), zod.string()).optional(),
+				audience: zod.object({
+					app_ids: zod.array(zod.string()).optional(),
+					team_ids: zod.array(zod.string()).optional()
+				}).optional()
+			}).describe("Shared allowlisted fields for `flowdef.created` (full snapshot) and\n`flowdef.updated` (delta: only changed fields present). Steps are omitted.\n")
+		})).describe("Wide event with event_type=flowdef.updated.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOnefourOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("project.created"),
+			payload: zod.object({
+				name: zod.string().optional(),
+				preview_origins: zod.array(zod.string()).optional()
+			}).describe("Shared allowlisted fields for `project.created` (full snapshot) and\n`project.updated` (delta: only changed fields present).\n")
+		})).describe("Wide event with event_type=project.created.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOnefiveOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("project.deleted"),
+			payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+		})).describe("Wide event with event_type=project.deleted.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOnesixOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("project.updated"),
+			payload: zod.object({
+				name: zod.string().optional(),
+				preview_origins: zod.array(zod.string()).optional()
+			}).describe("Shared allowlisted fields for `project.created` (full snapshot) and\n`project.updated` (delta: only changed fields present).\n")
+		})).describe("Wide event with event_type=project.updated.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOnesevenOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("request.api"),
+			payload: zod.object({
+				operation_id: zod.string(),
+				method: zod.enum([
+					"GET",
+					"POST",
+					"PUT",
+					"PATCH",
+					"DELETE",
+					"HEAD",
+					"OPTIONS"
+				]).describe("HTTP method."),
+				route_template: zod.string(),
+				status: zod.number().min(100).max(599),
+				duration_ms: zod.number().min(0)
+			}).describe("Payload for `request.api` events.")
+		})).describe("Wide event with event_type=request.api.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOneeightOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("schema.created"),
+			payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+		})).describe("Wide event with event_type=schema.created.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemOnenineOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("session.deleted"),
+			payload: zod.object({ reason: zod.string().optional() }).describe("Payload for `session.deleted` events.")
+		})).describe("Wide event with event_type=session.deleted.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemTwozeroOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("session.established"),
+			payload: zod.object({ user_id: zod.string().optional() }).describe("Payload for `session.established` events.")
+		})).describe("Wide event with event_type=session.established.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemTwooneOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("team.created"),
+			payload: zod.object({ name: zod.string().optional() }).describe("Shared allowlisted fields for `team.created` (snapshot) and\n`team.updated` (delta: only changed fields present).\n")
+		})).describe("Wide event with event_type=team.created.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemTwotwoOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("team.deactivated"),
+			payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+		})).describe("Wide event with event_type=team.deactivated.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemTwothreeOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("team.updated"),
+			payload: zod.object({ name: zod.string().optional() }).describe("Shared allowlisted fields for `team.created` (snapshot) and\n`team.updated` (delta: only changed fields present).\n")
+		})).describe("Wide event with event_type=team.updated.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemTwofourOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("user.create.failed"),
+			payload: zod.object({ key_name: zod.string().optional() }).describe("Payload for `user.create.failed` events.")
+		})).describe("Wide event with event_type=user.create.failed.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemTwofiveOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("user.created"),
+			payload: zod.object({
+				schema_id: zod.string().optional(),
+				attribute_keys: zod.array(zod.string()).optional(),
+				attributes: zod.record(zod.string(), zod.unknown()).optional()
+			}).describe("Payload for `user.created`. Identity is `entity_id`; attribute values\nappear only for schema fields marked `x-audit`.\n")
+		})).describe("Wide event with event_type=user.created.\n"),
+		zod.object({
+			id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+			project_id: zod.string().regex(listEventsResponseDataItemTwosixOneProjectIdRegExp),
+			team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+			event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+			category: zod.enum([
+				"request",
+				"auth",
+				"session",
+				"admin",
+				"entity",
+				"signal"
+			]).describe("Wide-event category."),
+			occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+			created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+			actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+			actor_type: zod.union([zod.enum([
+				"human",
+				"service",
+				"system",
+				"agent"
+			]), zod.null()]).optional().describe("Actor kind."),
+			entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+			entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+			client_id: zod.string().describe("Application or agent that produced the event."),
+			token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+			delegation_type: zod.enum([
+				"direct",
+				"delegated",
+				"pat_shared",
+				"exchanged"
+			]).optional().describe("Delegation kind (omit when unset)."),
+			delegation_id: zod.string().optional(),
+			grantor: zod.string().optional(),
+			fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+			request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+			session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+			flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+			metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+		}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+			event_type: zod.literal("user.deleted"),
+			payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+		})).describe("Wide event with event_type=user.deleted.\n")
+	]).describe("Discriminated wide-event union (ADR 048 / ADR 049). Clients select the\nmember via event_type; each member carries a typed payload.\n")),
+	next_page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results.\n")
+}).describe("Paginated list of events (ADR 027 / ADR 049).");
+/**
+* Loads a single event by `(project_id, id)`. Requires `events.read`.
+Events are not registered in `resource_scope_index`; project scope is
+required on the query (ADR 049). Misses and cross-project ids return 404.
+
+Pre-claim projects return 404 (stored events stay invisible until claim).
+
+* @summary Get event by ID
+*/
+const GetEventParams = zod.object({ id: zod.string().describe("Managed event id (`evt_<opaque>`).") });
+const getEventQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const GetEventQueryParams = zod.strictObject({ project_id: zod.string().regex(getEventQueryProjectIdRegExp).describe("The unique identifier of the project") });
+const getEventResponseOneOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseTwoOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseThreeOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseFourOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseFiveOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseSixOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseSevenOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseEightOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseNineOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnezeroOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOneoneOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnetwoOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnethreeOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnefourOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnefiveOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnesixOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnesevenOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnesevenTwoPayloadStatusMin = 100;
+const getEventResponseOnesevenTwoPayloadStatusMax = 599;
+const getEventResponseOnesevenTwoPayloadDurationMsMin = 0;
+const getEventResponseOneeightOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseOnenineOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseTwozeroOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseTwooneOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseTwotwoOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseTwothreeOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseTwofourOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseTwofiveOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getEventResponseTwosixOneProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const GetEventResponse = zod.union([
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOneOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("auth.attempt.created"),
+		payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+	})).describe("Wide event with event_type=auth.attempt.created.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseTwoOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("auth.attempt.handed_off"),
+		payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+	})).describe("Wide event with event_type=auth.attempt.handed_off.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseThreeOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("auth.check.failed"),
+		payload: zod.object({
+			check_id: zod.string(),
+			check_type: zod.string().optional(),
+			auth_attempt_id: zod.string().optional()
+		}).describe("Payload for `auth.check.failed` / `auth.check.succeeded`.\n`auth_attempt_id` joins the check to its attempt for SIEM correlation.\n")
+	})).describe("Wide event with event_type=auth.check.failed.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseFourOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("auth.check.succeeded"),
+		payload: zod.object({
+			check_id: zod.string(),
+			check_type: zod.string().optional(),
+			auth_attempt_id: zod.string().optional()
+		}).describe("Payload for `auth.check.failed` / `auth.check.succeeded`.\n`auth_attempt_id` joins the check to its attempt for SIEM correlation.\n")
+	})).describe("Wide event with event_type=auth.check.succeeded.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseFiveOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("auth.factor.passkey.enrolled"),
+		payload: zod.object({
+			user_id: zod.string(),
+			factor_id: zod.string().optional()
+		}).describe("Payload for `auth.factor.*` events.")
+	})).describe("Wide event with event_type=auth.factor.passkey.enrolled.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseSixOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("auth.factor.password.set"),
+		payload: zod.object({
+			user_id: zod.string(),
+			factor_id: zod.string().optional()
+		}).describe("Payload for `auth.factor.*` events.")
+	})).describe("Wide event with event_type=auth.factor.password.set.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseSevenOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("auth.token.issued"),
+		payload: zod.object({ scopes: zod.array(zod.string()).optional() }).describe("Payload for `auth.token.issued` events.")
+	})).describe("Wide event with event_type=auth.token.issued.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseEightOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("auth.token.revoked"),
+		payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+	})).describe("Wide event with event_type=auth.token.revoked.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseNineOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("authz.granted"),
+		payload: zod.object({
+			principal_type: zod.string().optional(),
+			principal_id: zod.string().optional(),
+			relation: zod.string().optional()
+		}).describe("Payload for `authz.granted` events.")
+	})).describe("Wide event with event_type=authz.granted.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOnezeroOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("branding.created"),
+		payload: zod.object({
+			layout: zod.string().optional(),
+			logo_url: zod.string().optional(),
+			font_url: zod.string().optional(),
+			hero_url: zod.string().optional()
+		}).describe("Allowlisted fields for `branding.created`. Omits `liquid_template`.\n")
+	})).describe("Wide event with event_type=branding.created.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOneoneOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("flowdef.created"),
+		payload: zod.object({
+			name: zod.string().optional(),
+			status: zod.string().optional(),
+			user_schema: zod.string().optional(),
+			purposes: zod.record(zod.string(), zod.string()).optional(),
+			audience: zod.object({
+				app_ids: zod.array(zod.string()).optional(),
+				team_ids: zod.array(zod.string()).optional()
+			}).optional()
+		}).describe("Shared allowlisted fields for `flowdef.created` (full snapshot) and\n`flowdef.updated` (delta: only changed fields present). Steps are omitted.\n")
+	})).describe("Wide event with event_type=flowdef.created.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOnetwoOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("flowdef.deleted"),
+		payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+	})).describe("Wide event with event_type=flowdef.deleted.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOnethreeOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("flowdef.updated"),
+		payload: zod.object({
+			name: zod.string().optional(),
+			status: zod.string().optional(),
+			user_schema: zod.string().optional(),
+			purposes: zod.record(zod.string(), zod.string()).optional(),
+			audience: zod.object({
+				app_ids: zod.array(zod.string()).optional(),
+				team_ids: zod.array(zod.string()).optional()
+			}).optional()
+		}).describe("Shared allowlisted fields for `flowdef.created` (full snapshot) and\n`flowdef.updated` (delta: only changed fields present). Steps are omitted.\n")
+	})).describe("Wide event with event_type=flowdef.updated.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOnefourOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("project.created"),
+		payload: zod.object({
+			name: zod.string().optional(),
+			preview_origins: zod.array(zod.string()).optional()
+		}).describe("Shared allowlisted fields for `project.created` (full snapshot) and\n`project.updated` (delta: only changed fields present).\n")
+	})).describe("Wide event with event_type=project.created.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOnefiveOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("project.deleted"),
+		payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+	})).describe("Wide event with event_type=project.deleted.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOnesixOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("project.updated"),
+		payload: zod.object({
+			name: zod.string().optional(),
+			preview_origins: zod.array(zod.string()).optional()
+		}).describe("Shared allowlisted fields for `project.created` (full snapshot) and\n`project.updated` (delta: only changed fields present).\n")
+	})).describe("Wide event with event_type=project.updated.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOnesevenOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("request.api"),
+		payload: zod.object({
+			operation_id: zod.string(),
+			method: zod.enum([
+				"GET",
+				"POST",
+				"PUT",
+				"PATCH",
+				"DELETE",
+				"HEAD",
+				"OPTIONS"
+			]).describe("HTTP method."),
+			route_template: zod.string(),
+			status: zod.number().min(100).max(599),
+			duration_ms: zod.number().min(0)
+		}).describe("Payload for `request.api` events.")
+	})).describe("Wide event with event_type=request.api.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOneeightOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("schema.created"),
+		payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+	})).describe("Wide event with event_type=schema.created.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseOnenineOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("session.deleted"),
+		payload: zod.object({ reason: zod.string().optional() }).describe("Payload for `session.deleted` events.")
+	})).describe("Wide event with event_type=session.deleted.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseTwozeroOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("session.established"),
+		payload: zod.object({ user_id: zod.string().optional() }).describe("Payload for `session.established` events.")
+	})).describe("Wide event with event_type=session.established.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseTwooneOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("team.created"),
+		payload: zod.object({ name: zod.string().optional() }).describe("Shared allowlisted fields for `team.created` (snapshot) and\n`team.updated` (delta: only changed fields present).\n")
+	})).describe("Wide event with event_type=team.created.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseTwotwoOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("team.deactivated"),
+		payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+	})).describe("Wide event with event_type=team.deactivated.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseTwothreeOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("team.updated"),
+		payload: zod.object({ name: zod.string().optional() }).describe("Shared allowlisted fields for `team.created` (snapshot) and\n`team.updated` (delta: only changed fields present).\n")
+	})).describe("Wide event with event_type=team.updated.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseTwofourOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("user.create.failed"),
+		payload: zod.object({ key_name: zod.string().optional() }).describe("Payload for `user.create.failed` events.")
+	})).describe("Wide event with event_type=user.create.failed.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseTwofiveOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("user.created"),
+		payload: zod.object({
+			schema_id: zod.string().optional(),
+			attribute_keys: zod.array(zod.string()).optional(),
+			attributes: zod.record(zod.string(), zod.unknown()).optional()
+		}).describe("Payload for `user.created`. Identity is `entity_id`; attribute values\nappear only for schema fields marked `x-audit`.\n")
+	})).describe("Wide event with event_type=user.created.\n"),
+	zod.object({
+		id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+		project_id: zod.string().regex(getEventResponseTwosixOneProjectIdRegExp),
+		team_id: zod.union([zod.string(), zod.null()]).optional().describe("Emit-time team scope, when the actor operated under a team."),
+		event_type: zod.string().describe("Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs/design/api/events-catalog.md.\n"),
+		category: zod.enum([
+			"request",
+			"auth",
+			"session",
+			"admin",
+			"entity",
+			"signal"
+		]).describe("Wide-event category."),
+		occurred_at: zod.iso.datetime({ offset: true }).describe("When the action happened (server/storage clock, dialect-owned)."),
+		created_at: zod.iso.datetime({ offset: true }).describe("When the row was inserted (server/storage clock, dialect-owned)."),
+		actor_id: zod.union([zod.string(), zod.null()]).optional().describe("Who triggered the event."),
+		actor_type: zod.union([zod.enum([
+			"human",
+			"service",
+			"system",
+			"agent"
+		]), zod.null()]).optional().describe("Actor kind."),
+		entity_type: zod.union([zod.string(), zod.null()]).optional().describe("Resource type affected."),
+		entity_id: zod.union([zod.string(), zod.null()]).optional().describe("Resource id affected."),
+		client_id: zod.string().describe("Application or agent that produced the event."),
+		token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+		delegation_type: zod.enum([
+			"direct",
+			"delegated",
+			"pat_shared",
+			"exchanged"
+		]).optional().describe("Delegation kind (omit when unset)."),
+		delegation_id: zod.string().optional(),
+		grantor: zod.string().optional(),
+		fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+		request_id: zod.union([zod.string(), zod.null()]).optional().describe("HTTP request correlation id."),
+		session_id: zod.union([zod.string(), zod.null()]).optional().describe("Session correlation id."),
+		flow_id: zod.union([zod.string(), zod.null()]).optional().describe("Login flow correlation id."),
+		metadata: zod.record(zod.string(), zod.unknown()).optional().describe("Additional emit-time metadata (already redacted).")
+	}).describe("Shared wide-event envelope (ADR 048 / ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n").and(zod.object({
+		event_type: zod.literal("user.deleted"),
+		payload: zod.object({}).describe("Empty payload for event types with no typed fields\n(e.g. `project.deleted`, `user.deleted`, `session.expired`).\n")
+	})).describe("Wide event with event_type=user.deleted.\n")
+]).describe("Discriminated wide-event union (ADR 048 / ADR 049). Clients select the\nmember via event_type; each member carries a typed payload.\n");
 //#endregion
-export { CompleteClaimBody, CompleteClaimParams, CompleteClaimResponse, CreateAuthAttemptBody, CreateBrandingBody, CreateBrandingQueryParams, CreateFlowBody, CreateFlowDefinitionBody, CreateHandoffHeader, CreateHandoffParams, CreateHandoffResponse, CreateProjectBody, CreateSchemaBody, CreateSchemaQueryParams, CreateSessionBody, CreateTeamBody, CreateTeamQueryParams, CreateUserBody, CreateUserQueryParams, DeleteFlowDefinitionParams, DeleteFlowDefinitionQueryParams, DeleteTeamParams, DeleteTeamQueryParams, DeleteUserByIDParams, DeleteUserByIDQueryParams, ExchangeHandoffBody, ExchangeHandoffHeader, ExchangeHandoffQueryParams, ExchangeHandoffResponse, GetAuthAttemptParams, GetAuthAttemptResponse, GetBrandingByIdParams, GetBrandingByIdQueryParams, GetBrandingByIdResponse, GetClaimStatusParams, GetClaimStatusQueryParams, GetClaimStatusResponse, GetFlowDefinitionParams, GetFlowDefinitionQueryParams, GetFlowDefinitionResponse, GetFlowStepParams, GetFlowStepResponse, GetMySessionResponse, GetMyUserResponse, GetProjectParams, GetProjectResponse, GetSchemaByIdParams, GetSchemaByIdQueryParams, GetSchemaByIdResponse, GetSessionParams, GetSessionQueryParams, GetSessionResponse, GetTeamParams, GetTeamQueryParams, GetTeamResponse, GetUserByIDParams, GetUserByIDQueryParams, GetUserByIDResponse, InitClaimParams, IssueChallengeBody, IssueChallengeParams, ListBrandingQueryParams, ListBrandingResponse, ListBrandingResponseItem, ListFlowDefinitionsQueryParams, ListFlowDefinitionsResponse, ListSchemasQueryParams, ListSchemasResponse, ListSchemasResponseItem, ListUserPasskeysParams, ListUserPasskeysQueryParams, ListUserPasskeysResponse, ListUserTeamsParams, ListUserTeamsQueryParams, ListUserTeamsResponse, ListUsersQueryParams, ListUsersResponse, PatchProjectBody, PatchProjectParams, PatchProjectResponse, QueryProjectsBody, QueryProjectsResponse, QuerySessionsBody, QuerySessionsQueryParams, QuerySessionsResponse, QueryTeamsBody, QueryTeamsQueryParams, QueryTeamsResponse, RevokeSessionParams, RevokeSessionQueryParams, SetUserPasswordBody, SetUserPasswordParams, SetUserPasswordQueryParams, SubmitFlowStepBody, SubmitFlowStepHeader, SubmitFlowStepParams, SubmitFlowStepResponse, UpdateFlowDefinitionBody, UpdateFlowDefinitionParams, UpdateFlowDefinitionQueryParams, UpdateFlowDefinitionResponse, UpdateTeamBody, UpdateTeamParams, UpdateTeamQueryParams, UpdateTeamResponse, VerifyChallengeProofBody, VerifyChallengeProofHeader, VerifyChallengeProofParams, VerifyChallengeProofResponse, completeClaimBodyChallengeIdRegExp, completeClaimPathProjectIdRegExp, completeClaimResponseProjectIdRegExp, completeClaimResponseTeamIdRegExp, createAuthAttemptBodyProjectIdRegExp, createAuthAttemptBodySessionIdOneRegExp, createBrandingBodyLayoutDefault, createBrandingBodyLiquidTemplateMax, createBrandingQueryProjectIdRegExp, createFlowBodyDryRunDefault, createFlowBodyFlowDefinitionNameRegExp, createFlowBodyProjectIdRegExp, createFlowBodySchemaVersionRegExp, createFlowDefinitionBodyFlowDefinitionNameRegExp, createFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault, createFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault, createFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault, createFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault, createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault, createFlowDefinitionBodyProjectIdRegExp, createHandoffPathAttemptIdRegExp, createProjectBodySeedDefaultsDefault, createSchemaBodyOneObjectTypeMax, createSchemaBodyOnePropertiesXEditableDefault, createSchemaBodyOnePropertiesXMfaDefault, createSchemaBodyOnePropertiesXSensitiveDefault, createSchemaBodyOneXAuthMethodsMagicLinkPositionMin, createSchemaBodyOneXAuthMethodsOtpPositionMin, createSchemaBodyOneXAuthMethodsPasskeyPositionMin, createSchemaBodyOneXAuthMethodsPasswordPositionMin, createSchemaBodyOneXAuthMethodsSsoPositionMin, createSchemaQueryProjectIdRegExp, createSchemaQueryTeamIdRegExp, createSessionBodyProjectIdRegExp, createTeamBodyNameMax, createTeamQueryProjectIdRegExp, createUserBodyIdRegExp, createUserQueryProjectIdRegExp, createUserQueryTeamIdRegExp, deleteFlowDefinitionQueryProjectIdRegExp, deleteTeamPathTeamIdRegExp, deleteTeamQueryProjectIdRegExp, deleteUserByIDPathUserIdRegExp, deleteUserByIDQueryProjectIdRegExp, exchangeHandoffQueryProjectIdRegExp, exchangeHandoffResponseSessionFactorsItemPayloadOneUserIdRegExp, exchangeHandoffResponseSessionProjectIdRegExp, exchangeHandoffResponseSessionSessionIdRegExp, exchangeHandoffResponseSessionUserIdOneRegExp, getAuthAttemptPathAttemptIdRegExp, getAuthAttemptResponseAttemptIdRegExp, getAuthAttemptResponseChallengesItemChallengeIdRegExp, getAuthAttemptResponseCompletedFactorsItemPayloadOneUserIdRegExp, getAuthAttemptResponseProjectIdRegExp, getAuthAttemptResponseSessionIdOneRegExp, getAuthAttemptResponseUserIdOneRegExp, getBrandingByIdQueryProjectIdRegExp, getBrandingByIdResponseBrandingLayoutDefault, getBrandingByIdResponseBrandingLiquidTemplateMax, getClaimStatusPathProjectIdRegExp, getClaimStatusQueryChallengeIdRegExp, getClaimStatusResponseTwoTeamIdRegExp, getFlowDefinitionQueryProjectIdRegExp, getFlowDefinitionResponseFlowDefinitionNameRegExp, getFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault, getFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault, getFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault, getFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault, getFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault, getFlowStepResponseBrandingLayoutDefault, getFlowStepResponseBrandingLiquidTemplateMax, getFlowStepResponseStepActionsDefault, getFlowStepResponseStepActionsItemPrimaryDefault, getFlowStepResponseStepFieldsDefault, getFlowStepResponseStepFieldsItemRequiredDefault, getFlowStepResponseStepFieldsItemValidationMaxLengthMin, getFlowStepResponseStepFieldsItemValidationMinLengthMin, getFlowStepResponseStepGatesDefault, getFlowStepResponseStepSsoProvidersDefault, getMySessionResponseFactorsItemPayloadOneUserIdRegExp, getMySessionResponseProjectIdRegExp, getMySessionResponseSessionIdRegExp, getMySessionResponseUserIdOneRegExp, getMyUserResponseIdRegExp, getProjectPathProjectIdRegExp, getSchemaByIdQueryProjectIdRegExp, getSchemaByIdQueryTeamIdRegExp, getSchemaByIdResponseOneObjectTypeMax, getSchemaByIdResponseOnePropertiesXEditableDefault, getSchemaByIdResponseOnePropertiesXMfaDefault, getSchemaByIdResponseOnePropertiesXSensitiveDefault, getSchemaByIdResponseOneXAuthMethodsMagicLinkPositionMin, getSchemaByIdResponseOneXAuthMethodsOtpPositionMin, getSchemaByIdResponseOneXAuthMethodsPasskeyPositionMin, getSchemaByIdResponseOneXAuthMethodsPasswordPositionMin, getSchemaByIdResponseOneXAuthMethodsSsoPositionMin, getSessionPathSessionIdRegExp, getSessionQueryProjectIdRegExp, getSessionResponseFactorsItemPayloadOneUserIdRegExp, getSessionResponseProjectIdRegExp, getSessionResponseSessionIdRegExp, getSessionResponseUserIdOneRegExp, getTeamPathTeamIdRegExp, getTeamQueryProjectIdRegExp, getUserByIDPathUserIdRegExp, getUserByIDQueryProjectIdRegExp, getUserByIDQueryTeamIdRegExp, getUserByIDResponseIdRegExp, initClaimPathProjectIdRegExp, issueChallengePathAttemptIdRegExp, listBrandingQueryProjectIdRegExp, listFlowDefinitionsQueryLimitDefault, listFlowDefinitionsQueryLimitMax, listFlowDefinitionsQueryProjectIdRegExp, listFlowDefinitionsResponseFlowDefinitionsItemNameRegExp, listSchemasQueryObjectTypeMax, listSchemasQueryOffsetDefault, listSchemasQueryOffsetMin, listSchemasQueryProjectIdRegExp, listUserPasskeysPathUserIdRegExp, listUserPasskeysQueryLimitDefault, listUserPasskeysQueryLimitMax, listUserPasskeysQueryProjectIdRegExp, listUserTeamsPathUserIdRegExp, listUserTeamsQueryLimitDefault, listUserTeamsQueryLimitMax, listUserTeamsQueryProjectIdRegExp, listUsersQueryLimitDefault, listUsersQueryLimitMax, listUsersResponseUsersItemIdRegExp, patchProjectPathProjectIdRegExp, queryProjectsBodyLimitDefault, queryProjectsBodyLimitMax, querySessionsBodyLimitDefault, querySessionsBodyLimitMax, querySessionsQueryProjectIdRegExp, querySessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp, querySessionsResponseSessionsItemProjectIdRegExp, querySessionsResponseSessionsItemSessionIdRegExp, querySessionsResponseSessionsItemUserIdOneRegExp, queryTeamsBodyLimitDefault, queryTeamsBodyLimitMax, queryTeamsQueryProjectIdRegExp, revokeSessionPathSessionIdRegExp, revokeSessionQueryProjectIdRegExp, setUserPasswordPathUserIdRegExp, setUserPasswordQueryProjectIdRegExp, submitFlowStepResponseBrandingLayoutDefault, submitFlowStepResponseBrandingLiquidTemplateMax, submitFlowStepResponseStepActionsDefault, submitFlowStepResponseStepActionsItemPrimaryDefault, submitFlowStepResponseStepFieldsDefault, submitFlowStepResponseStepFieldsItemRequiredDefault, submitFlowStepResponseStepFieldsItemValidationMaxLengthMin, submitFlowStepResponseStepFieldsItemValidationMinLengthMin, submitFlowStepResponseStepGatesDefault, submitFlowStepResponseStepSsoProvidersDefault, updateFlowDefinitionBodyFlowDefinitionNameRegExp, updateFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault, updateFlowDefinitionQueryProjectIdRegExp, updateFlowDefinitionResponseFlowDefinitionNameRegExp, updateFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault, updateTeamBodyNameMax, updateTeamPathTeamIdRegExp, updateTeamQueryProjectIdRegExp, verifyChallengeProofPathAttemptIdRegExp, verifyChallengeProofPathChallengeIdRegExp, verifyChallengeProofResponseAttemptIdRegExp, verifyChallengeProofResponseChallengesItemChallengeIdRegExp, verifyChallengeProofResponseCompletedFactorsItemPayloadOneUserIdRegExp, verifyChallengeProofResponseProjectIdRegExp, verifyChallengeProofResponseSessionIdOneRegExp, verifyChallengeProofResponseUserIdOneRegExp };
+export { CompleteClaimBody, CompleteClaimParams, CompleteClaimResponse, CreateAuthAttemptBody, CreateBrandingBody, CreateBrandingQueryParams, CreateFlowBody, CreateFlowDefinitionBody, CreateHandoffHeader, CreateHandoffParams, CreateHandoffResponse, CreateProjectBody, CreateSchemaBody, CreateSchemaQueryParams, CreateSessionBody, CreateTeamBody, CreateTeamQueryParams, CreateUserBody, CreateUserQueryParams, DeleteFlowDefinitionParams, DeleteTeamParams, DeleteUserByIDParams, ExchangeHandoffBody, ExchangeHandoffHeader, ExchangeHandoffQueryParams, ExchangeHandoffResponse, GetAuthAttemptParams, GetAuthAttemptResponse, GetBrandingByIdParams, GetBrandingByIdResponse, GetClaimStatusParams, GetClaimStatusQueryParams, GetClaimStatusResponse, GetEventParams, GetEventQueryParams, GetEventResponse, GetFlowDefinitionParams, GetFlowDefinitionResponse, GetFlowStepParams, GetFlowStepResponse, GetMySessionResponse, GetMyUserResponse, GetProjectParams, GetProjectResponse, GetSchemaByIdParams, GetSchemaByIdQueryParams, GetSchemaByIdResponse, GetSessionParams, GetSessionResponse, GetTeamParams, GetTeamResponse, GetUserByIDParams, GetUserByIDQueryParams, GetUserByIDResponse, InitClaimParams, IssueChallengeBody, IssueChallengeParams, ListBrandingQueryParams, ListBrandingResponse, ListBrandingResponseItem, ListEventsQueryParams, ListEventsResponse, ListFlowDefinitionsQueryParams, ListFlowDefinitionsResponse, ListSchemasQueryParams, ListSchemasResponse, ListSchemasResponseItem, ListUserPasskeysParams, ListUserPasskeysQueryParams, ListUserPasskeysResponse, ListUserTeamsParams, ListUserTeamsQueryParams, ListUserTeamsResponse, ListUsersQueryParams, ListUsersResponse, PatchProjectBody, PatchProjectParams, PatchProjectResponse, QueryProjectsBody, QueryProjectsResponse, QuerySessionsBody, QuerySessionsQueryParams, QuerySessionsResponse, QueryTeamsBody, QueryTeamsQueryParams, QueryTeamsResponse, RevokeSessionParams, SetUserPasswordBody, SetUserPasswordParams, SubmitFlowStepBody, SubmitFlowStepHeader, SubmitFlowStepParams, SubmitFlowStepResponse, UpdateFlowDefinitionBody, UpdateFlowDefinitionParams, UpdateFlowDefinitionResponse, UpdateTeamBody, UpdateTeamParams, UpdateTeamResponse, VerifyChallengeProofBody, VerifyChallengeProofHeader, VerifyChallengeProofParams, VerifyChallengeProofResponse, completeClaimBodyChallengeIdRegExp, completeClaimPathProjectIdRegExp, completeClaimResponseProjectIdRegExp, completeClaimResponseTeamIdRegExp, createAuthAttemptBodyProjectIdRegExp, createAuthAttemptBodySessionIdOneRegExp, createBrandingBodyLayoutDefault, createBrandingBodyLiquidTemplateMax, createBrandingQueryProjectIdRegExp, createFlowBodyDryRunDefault, createFlowBodyFlowDefinitionNameRegExp, createFlowBodyProjectIdRegExp, createFlowBodySchemaVersionRegExp, createFlowDefinitionBodyFlowDefinitionNameRegExp, createFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault, createFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault, createFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault, createFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault, createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault, createFlowDefinitionBodyProjectIdRegExp, createHandoffPathAttemptIdRegExp, createProjectBodySeedDefaultsDefault, createSchemaBodyOneObjectTypeMax, createSchemaBodyOnePropertiesXAuditDefault, createSchemaQueryProjectIdRegExp, createSchemaQueryTeamIdRegExp, createSessionBodyProjectIdRegExp, createTeamBodyNameMax, createTeamQueryProjectIdRegExp, createUserQueryProjectIdRegExp, createUserQueryTeamIdRegExp, deleteTeamPathTeamIdRegExp, deleteUserByIDPathUserIdRegExp, exchangeHandoffQueryProjectIdRegExp, exchangeHandoffResponseSessionFactorsItemPayloadOneUserIdRegExp, exchangeHandoffResponseSessionProjectIdRegExp, exchangeHandoffResponseSessionSessionIdRegExp, exchangeHandoffResponseSessionUserIdOneRegExp, getAuthAttemptPathAttemptIdRegExp, getAuthAttemptResponseAttemptIdRegExp, getAuthAttemptResponseChallengesItemChallengeIdRegExp, getAuthAttemptResponseCompletedFactorsItemPayloadOneUserIdRegExp, getAuthAttemptResponseProjectIdRegExp, getAuthAttemptResponseSessionIdOneRegExp, getAuthAttemptResponseUserIdOneRegExp, getBrandingByIdResponseBrandingLayoutDefault, getBrandingByIdResponseBrandingLiquidTemplateMax, getClaimStatusPathProjectIdRegExp, getClaimStatusQueryChallengeIdRegExp, getClaimStatusResponseTwoTeamIdRegExp, getEventQueryProjectIdRegExp, getEventResponseEightOneProjectIdRegExp, getEventResponseFiveOneProjectIdRegExp, getEventResponseFourOneProjectIdRegExp, getEventResponseNineOneProjectIdRegExp, getEventResponseOneOneProjectIdRegExp, getEventResponseOneeightOneProjectIdRegExp, getEventResponseOnefiveOneProjectIdRegExp, getEventResponseOnefourOneProjectIdRegExp, getEventResponseOnenineOneProjectIdRegExp, getEventResponseOneoneOneProjectIdRegExp, getEventResponseOnesevenOneProjectIdRegExp, getEventResponseOnesevenTwoPayloadDurationMsMin, getEventResponseOnesevenTwoPayloadStatusMax, getEventResponseOnesevenTwoPayloadStatusMin, getEventResponseOnesixOneProjectIdRegExp, getEventResponseOnethreeOneProjectIdRegExp, getEventResponseOnetwoOneProjectIdRegExp, getEventResponseOnezeroOneProjectIdRegExp, getEventResponseSevenOneProjectIdRegExp, getEventResponseSixOneProjectIdRegExp, getEventResponseThreeOneProjectIdRegExp, getEventResponseTwoOneProjectIdRegExp, getEventResponseTwofiveOneProjectIdRegExp, getEventResponseTwofourOneProjectIdRegExp, getEventResponseTwooneOneProjectIdRegExp, getEventResponseTwosixOneProjectIdRegExp, getEventResponseTwothreeOneProjectIdRegExp, getEventResponseTwotwoOneProjectIdRegExp, getEventResponseTwozeroOneProjectIdRegExp, getFlowDefinitionResponseFlowDefinitionNameRegExp, getFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault, getFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault, getFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault, getFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault, getFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault, getFlowStepResponseBrandingLayoutDefault, getFlowStepResponseBrandingLiquidTemplateMax, getFlowStepResponseStepActionsDefault, getFlowStepResponseStepActionsItemPrimaryDefault, getFlowStepResponseStepFieldsDefault, getFlowStepResponseStepFieldsItemRequiredDefault, getFlowStepResponseStepFieldsItemValidationMaxLengthMin, getFlowStepResponseStepFieldsItemValidationMinLengthMin, getFlowStepResponseStepGatesDefault, getFlowStepResponseStepSsoProvidersDefault, getMySessionResponseFactorsItemPayloadOneUserIdRegExp, getMySessionResponseProjectIdRegExp, getMySessionResponseSessionIdRegExp, getMySessionResponseUserIdOneRegExp, getMyUserResponseIdRegExp, getProjectPathProjectIdRegExp, getSchemaByIdQueryTeamIdRegExp, getSchemaByIdResponseOneObjectTypeMax, getSchemaByIdResponseOnePropertiesXAuditDefault, getSessionPathSessionIdRegExp, getSessionResponseFactorsItemPayloadOneUserIdRegExp, getSessionResponseProjectIdRegExp, getSessionResponseSessionIdRegExp, getSessionResponseUserIdOneRegExp, getTeamPathTeamIdRegExp, getUserByIDPathUserIdRegExp, getUserByIDQueryTeamIdRegExp, getUserByIDResponseIdRegExp, initClaimPathProjectIdRegExp, issueChallengePathAttemptIdRegExp, listBrandingQueryProjectIdRegExp, listEventsQueryLimitDefault, listEventsQueryLimitMax, listEventsQueryOrderDefault, listEventsQueryProjectIdRegExp, listEventsResponseDataItemEightOneProjectIdRegExp, listEventsResponseDataItemFiveOneProjectIdRegExp, listEventsResponseDataItemFourOneProjectIdRegExp, listEventsResponseDataItemNineOneProjectIdRegExp, listEventsResponseDataItemOneOneProjectIdRegExp, listEventsResponseDataItemOneeightOneProjectIdRegExp, listEventsResponseDataItemOnefiveOneProjectIdRegExp, listEventsResponseDataItemOnefourOneProjectIdRegExp, listEventsResponseDataItemOnenineOneProjectIdRegExp, listEventsResponseDataItemOneoneOneProjectIdRegExp, listEventsResponseDataItemOnesevenOneProjectIdRegExp, listEventsResponseDataItemOnesevenTwoPayloadDurationMsMin, listEventsResponseDataItemOnesevenTwoPayloadStatusMax, listEventsResponseDataItemOnesevenTwoPayloadStatusMin, listEventsResponseDataItemOnesixOneProjectIdRegExp, listEventsResponseDataItemOnethreeOneProjectIdRegExp, listEventsResponseDataItemOnetwoOneProjectIdRegExp, listEventsResponseDataItemOnezeroOneProjectIdRegExp, listEventsResponseDataItemSevenOneProjectIdRegExp, listEventsResponseDataItemSixOneProjectIdRegExp, listEventsResponseDataItemThreeOneProjectIdRegExp, listEventsResponseDataItemTwoOneProjectIdRegExp, listEventsResponseDataItemTwofiveOneProjectIdRegExp, listEventsResponseDataItemTwofourOneProjectIdRegExp, listEventsResponseDataItemTwooneOneProjectIdRegExp, listEventsResponseDataItemTwosixOneProjectIdRegExp, listEventsResponseDataItemTwothreeOneProjectIdRegExp, listEventsResponseDataItemTwotwoOneProjectIdRegExp, listEventsResponseDataItemTwozeroOneProjectIdRegExp, listFlowDefinitionsQueryLimitDefault, listFlowDefinitionsQueryLimitMax, listFlowDefinitionsQueryProjectIdRegExp, listFlowDefinitionsResponseFlowDefinitionsItemNameRegExp, listSchemasQueryObjectTypeMax, listSchemasQueryOffsetDefault, listSchemasQueryOffsetMin, listSchemasQueryProjectIdRegExp, listUserPasskeysPathUserIdRegExp, listUserPasskeysQueryLimitDefault, listUserPasskeysQueryLimitMax, listUserTeamsPathUserIdRegExp, listUserTeamsQueryLimitDefault, listUserTeamsQueryLimitMax, listUsersQueryLimitDefault, listUsersQueryLimitMax, listUsersResponseUsersItemIdRegExp, patchProjectPathProjectIdRegExp, queryProjectsBodyLimitDefault, queryProjectsBodyLimitMax, querySessionsBodyLimitDefault, querySessionsBodyLimitMax, querySessionsQueryProjectIdRegExp, querySessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp, querySessionsResponseSessionsItemProjectIdRegExp, querySessionsResponseSessionsItemSessionIdRegExp, querySessionsResponseSessionsItemUserIdOneRegExp, queryTeamsBodyLimitDefault, queryTeamsBodyLimitMax, queryTeamsQueryProjectIdRegExp, revokeSessionPathSessionIdRegExp, setUserPasswordPathUserIdRegExp, submitFlowStepResponseBrandingLayoutDefault, submitFlowStepResponseBrandingLiquidTemplateMax, submitFlowStepResponseStepActionsDefault, submitFlowStepResponseStepActionsItemPrimaryDefault, submitFlowStepResponseStepFieldsDefault, submitFlowStepResponseStepFieldsItemRequiredDefault, submitFlowStepResponseStepFieldsItemValidationMaxLengthMin, submitFlowStepResponseStepFieldsItemValidationMinLengthMin, submitFlowStepResponseStepGatesDefault, submitFlowStepResponseStepSsoProvidersDefault, updateFlowDefinitionBodyFlowDefinitionNameRegExp, updateFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault, updateFlowDefinitionResponseFlowDefinitionNameRegExp, updateFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault, updateTeamBodyNameMax, updateTeamPathTeamIdRegExp, verifyChallengeProofPathAttemptIdRegExp, verifyChallengeProofPathChallengeIdRegExp, verifyChallengeProofResponseAttemptIdRegExp, verifyChallengeProofResponseChallengesItemChallengeIdRegExp, verifyChallengeProofResponseCompletedFactorsItemPayloadOneUserIdRegExp, verifyChallengeProofResponseProjectIdRegExp, verifyChallengeProofResponseSessionIdOneRegExp, verifyChallengeProofResponseUserIdOneRegExp };
 
 //# sourceMappingURL=zitadelNextGen.zod.mjs.map