@zitadel/api 0.1.0-alpha.9 → 1.0.0-alpha.21

package/dist/zitadelNextGen-C8m49W5h.d.mts

@@ -0,0 +1,671 @@
+import { $a as GetUserByIDParams, $d as CreateHandoff200, $i as ListFlowDefinitions200, Aa as ListEnvironments200, An as QueryUsers200, Bf as CreateFlowDefinition201, Bl as ExchangeHandoffBody, Bu as CreateUser201, Do as GetSession200, E as UpdateTeam200, Ea as ListEvents200, Ep as CreateBrandingParams, Eu as CreateUserParams, Fa as ListBranding200Item, Fc as GetEventParams, Fo as GetSchemaByIdParams, Ft as SubmitFlowStep200, Gc as GetEnvironmentByNameParams, Go as GetReleaseByIdParams, Gs as GetGrant200, Hi as ListReleasesParams, Ho as GetSchemaById200, Id as CreateReleaseBody, Jc as GetClaimStatusParams, Jd as CreateProjectBody, La as IssueChallengeBody, Ll as FinishUserPasskeyRegistration201, Lp as CreateAuthAttemptBody, Ls as GetGrantParams, Ma as ListBrandingParams, Mr as QueryProjectsBody, Nd as CreateSchema201, Ni as ListSchemasParams, Np as CreateBranding201, Ns as GetHealthDefault, Oa as ListEnvironmentsParams, Od as CreateSchemaBody, Ou as CreateUserBody, Pd as CreateReleaseParams, Qa as InitClaim201, Ri as ListSchemas200, Rl as ExchangeHandoffParams, Rn as QueryTeamsParams, Rp as CreateAuthAttempt201, Sf as CreateFlowDefinitionBody, Sr as QuerySessions200, Td as CreateSchemaParams, Tl as FinishUserPasskeyRegistrationBody, Ud as CreateRelease200, Va as IssueChallenge201, Vn as QueryTeamsBody, Wc as GetEvent200, Wi as ListReleases200, Xp as CompleteClaimBody, Xr as PatchProjectBody, Xu as CreateTeamBody, Zd as CreateProject201, Zo as GetReadyDefault, _f as CreateGrant201, al as GetClaimStatus200, ao as GetUserByID200, bc as GetFlowDefinition200, cm as CompleteClaim200, ds as GetMyUser200, ec as GetFlowStep200, ef as CreateGrantParams, fd as CreateSessionBody, gd as CreateSession201, gi as ListUserTeams200, gn as QueryUsersBody, h as UpdateTeamBody, ha as ListEventsParams, hu as DeleteGrantParams, ii as ListUserTeamsParams, ir as QueryTeams200, ji as ListUserPasskeys200, k as UpdateFlowDefinitionBody, kp as CreateBrandingBody, ks as GetLiveDefault, ld as CreateTeam201, lr as QuerySessionsBody, lt as SubmitFlowStepBody, ml as GetAuthAttempt200, n as VerifyChallengeProofBody, nf as CreateGrantBody, np as CreateFlowBody, os as GetProject200, q as UpdateFlowDefinition200, qc as GetEnvironmentByName200, qi as ListFlowDefinitionsParams, ql as ExchangeHandoff200, qo as GetReleaseById200, qr as QueryProjects200, qu as CreateTeamParams, r as VerifyChallengeProof200, ri as PatchProject200, sp as CreateFlow201, sr as QuerySessionsParams, tn as SetUserPasswordBody, ul as GetBrandingById200, um as BeginUserPasskeyRegistrationBody, vo as GetTeam200, xm as BeginUserPasskeyRegistration201, xs as GetMySession200, yi as ListUserPasskeysParams, zd as CreateRelease201 } from "./index-BK4Q468Q.mjs";
+
+//#region src/generated/endpoints/zitadelNextGen.d.ts
+declare namespace zitadelNextGen_d_exports {
+  export { beginUserPasskeyRegistration, completeClaim, createAuthAttempt, createBranding, createFlow, createFlowDefinition, createGrant, createHandoff, createProject, createRelease, createSchema, createSession, createTeam, createUser, deleteFlowDefinition, deleteGrant, deleteTeam, deleteUserByID, exchangeHandoff, finishUserPasskeyRegistration, getAuthAttempt, getBeginUserPasskeyRegistrationUrl, getBrandingById, getClaimStatus, getCompleteClaimUrl, getCreateAuthAttemptUrl, getCreateBrandingUrl, getCreateFlowDefinitionUrl, getCreateFlowUrl, getCreateGrantUrl, getCreateHandoffUrl, getCreateProjectUrl, getCreateReleaseUrl, getCreateSchemaUrl, getCreateSessionUrl, getCreateTeamUrl, getCreateUserUrl, getDeleteFlowDefinitionUrl, getDeleteGrantUrl, getDeleteTeamUrl, getDeleteUserByIDUrl, getEnvironmentByName, getEvent, getExchangeHandoffUrl, getFinishUserPasskeyRegistrationUrl, getFlowDefinition, getFlowStep, getGetAuthAttemptUrl, getGetBrandingByIdUrl, getGetClaimStatusUrl, getGetEnvironmentByNameUrl, getGetEventUrl, getGetFlowDefinitionUrl, getGetFlowStepUrl, getGetGrantUrl, getGetHealthUrl, getGetLiveUrl, getGetMySessionUrl, getGetMyUserUrl, getGetProjectUrl, getGetReadyUrl, getGetReleaseByIdUrl, getGetSchemaByIdUrl, getGetSessionUrl, getGetTeamUrl, getGetUserByIDUrl, getGrant, getHealth, getInitClaimUrl, getIssueChallengeUrl, getListBrandingUrl, getListEnvironmentsUrl, getListEventsUrl, getListFlowDefinitionsUrl, getListReleasesUrl, getListSchemasUrl, getListUserPasskeysUrl, getListUserTeamsUrl, getLive, getMySession, getMyUser, getPatchProjectUrl, getProject, getQueryProjectsUrl, getQuerySessionsUrl, getQueryTeamsUrl, getQueryUsersUrl, getReady, getReleaseById, getRevokeMySessionUrl, getRevokeSessionUrl, getSchemaById, getSession, getSetUserPasswordUrl, getSubmitFlowStepUrl, getTeam, getUpdateFlowDefinitionUrl, getUpdateTeamUrl, getUserByID, getVerifyChallengeProofUrl, initClaim, issueChallenge, listBranding, listEnvironments, listEvents, listFlowDefinitions, listReleases, listSchemas, listUserPasskeys, listUserTeams, patchProject, queryProjects, querySessions, queryTeams, queryUsers, revokeMySession, revokeSession, setUserPassword, submitFlowStep, updateFlowDefinition, updateTeam, verifyChallengeProof };
+}
+declare const getGetHealthUrl: () => string;
+/**
+ * Check whether the server is healthy
+ * @summary Check server health
+ */
+declare const getHealth: (options?: RequestInit) => Promise<GetHealthDefault>;
+declare const getGetLiveUrl: () => string;
+/**
+ * Check whether the server is started
+ * @summary Check server liveness
+ */
+declare const getLive: (options?: RequestInit) => Promise<GetLiveDefault>;
+declare const getGetReadyUrl: () => string;
+/**
+ * Check whether the server is ready to accept requests
+ * @summary Check server readiness
+ */
+declare const getReady: (options?: RequestInit) => Promise<GetReadyDefault>;
+declare const getCreateUserUrl: (params: CreateUserParams) => string;
+/**
+ * @summary Create user
+ */
+declare const createUser: (createUserBody: CreateUserBody, params: CreateUserParams, options?: RequestInit) => Promise<CreateUser201>;
+declare const getQueryUsersUrl: () => string;
+/**
+ * Returns the users of a project, paginated with a cursor.
+
+The project comes from the credential, not from a parameter: the operation
+is bound to the token's own project by construction. This is why it takes
+no `project_id`, unlike the other query endpoints.
+
+ * @summary Query users
+ */
+declare const queryUsers: (queryUsersBody: QueryUsersBody, options?: RequestInit) => Promise<QueryUsers200>;
+declare const getGetUserByIDUrl: (userId: string, params?: GetUserByIDParams) => string;
+/**
+ * @summary Get user by ID
+ */
+declare const getUserByID: (userId: string, params?: GetUserByIDParams, options?: RequestInit) => Promise<GetUserByID200>;
+declare const getDeleteUserByIDUrl: (userId: string) => string;
+/**
+ * @summary Delete user by ID
+ */
+declare const deleteUserByID: (userId: string, options?: RequestInit) => Promise<void>;
+declare const getListUserPasskeysUrl: (userId: string, params?: ListUserPasskeysParams) => string;
+/**
+ * @summary List user passkeys
+ */
+declare const listUserPasskeys: (userId: string, params?: ListUserPasskeysParams, options?: RequestInit) => Promise<ListUserPasskeys200>;
+declare const getBeginUserPasskeyRegistrationUrl: (userId: string) => string;
+/**
+ * Starts a WebAuthn registration ceremony for the user and returns the
+creation options for `navigator.credentials.create()`. Complete the
+ceremony with `POST /users/{user_id}/passkeys/registrations/{registration_id}` within
+five minutes. Credentials already registered for the user are excluded
+automatically.
+
+ * @summary Begin passkey registration
+ */
+declare const beginUserPasskeyRegistration: (userId: string, beginUserPasskeyRegistrationBody: BeginUserPasskeyRegistrationBody, options?: RequestInit) => Promise<BeginUserPasskeyRegistration201>;
+declare const getFinishUserPasskeyRegistrationUrl: (userId: string, registrationId: string) => string;
+/**
+ * Verifies the attestation against the ceremony started by
+`POST /users/{user_id}/passkeys/registrations` and persists the new credential. A
+rejected attestation counts against the ceremony's failure budget and the
+ceremony stays open for a retry. An expired ceremony surfaces as
+`att.stale_challenge`; an unknown or already-consumed registration id
+surfaces as `att.not_found`.
+
+ * @summary Finish passkey registration
+ */
+declare const finishUserPasskeyRegistration: (userId: string, registrationId: string, finishUserPasskeyRegistrationBody: FinishUserPasskeyRegistrationBody, options?: RequestInit) => Promise<FinishUserPasskeyRegistration201>;
+declare const getSetUserPasswordUrl: (userId: string) => string;
+/**
+ * @summary Set user password
+ */
+declare const setUserPassword: (userId: string, setUserPasswordBody: SetUserPasswordBody, options?: RequestInit) => Promise<void>;
+declare const getListUserTeamsUrl: (userId: string, params?: ListUserTeamsParams) => string;
+/**
+ * The user's team roster, ordered by team name. Each entry carries the
+team's name, so a client renders a page without resolving ids one by one.
+
+This is the N:N roster and it is not lifecycle ownership: the single team
+that owns the user's lifecycle is reported as `metadata.lifecycle_owner_team_id`
+on the user read endpoints. Memberships the user was removed from are not
+returned.
+
+ * @summary List the teams a user belongs to
+ */
+declare const listUserTeams: (userId: string, params?: ListUserTeamsParams, options?: RequestInit) => Promise<ListUserTeams200>;
+declare const getGetMyUserUrl: () => string;
+/**
+ * @summary Get my user information
+ */
+declare const getMyUser: (options?: RequestInit) => Promise<GetMyUser200>;
+declare const getCreateFlowUrl: () => string;
+/**
+ * Resolves a flow definition based on purpose + audience context and returns
+the first capability step. Creates a new session implicitly unless
+`session_id` is provided (for step-up / reauth on an existing session).
+
+The response contains an `id` field — the flow handle. Use it as the path
+parameter for all subsequent `/flow/{id}/submit` calls.
+
+The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
+the flow's orchestration state (current step, collected data, history).
+The server is stateless between requests — all flow state lives in this
+cookie. The browser sends it automatically on subsequent requests.
+
+ * @summary Start a new flow
+ */
+declare const createFlow: (createFlowBody: CreateFlowBody, options?: RequestInit) => Promise<CreateFlow201>;
+declare const getGetFlowStepUrl: (id: string) => string;
+/**
+ * Returns the current capability step without advancing the state machine.
+Useful for page reloads or re-rendering after a network error.
+
+ * @summary Get current step (re-render)
+ */
+declare const getFlowStep: (id: string, options?: RequestInit) => Promise<GetFlowStep200>;
+declare const getSubmitFlowStepUrl: (id: string) => string;
+/**
+ * Submits user input for the current step. The server validates,
+processes (e.g., verifies a credential), advances the state machine
+through any invisible steps, and returns the next visible step.
+
+The response sets an updated encrypted `HttpOnly` cookie (`_zflow`)
+with the new flow state. The server is stateless — all orchestration
+state is carried in this cookie between requests.
+
+**Important:** The `id` in the response may differ from the `id` used in
+the request. This happens when a flow pivots (pushes a new flow onto the
+stack) or when a stacked flow completes (auto-pops to the parent flow).
+Always use the `id` from the latest response for the next request.
+
+## Flow completion
+
+When `step.type` is `complete`, the flow is terminal. The `step.behavior`
+field tells the frontend what to do:
+
+| `behavior`   | Action                                                     |
+|------------- |------------------------------------------------------------|
+| `redirect`   | Navigate to `redirect_uri` (OIDC/SAML auth request done). |
+| `show`       | Render the step as a success screen (e.g., registration).  |
+
+A `complete` step is only returned when the **entire flow stack** is done.
+If a stacked flow (e.g., recovery pivoted from login) finishes, the server
+auto-pops to the parent flow and returns the parent's next step — the
+frontend never sees a `complete` for intermediate flows.
+
+ * @summary Submit step data and advance
+ */
+declare const submitFlowStep: (id: string, submitFlowStepBody: SubmitFlowStepBody, options?: RequestInit) => Promise<SubmitFlowStep200>;
+declare const getCreateAuthAttemptUrl: () => string;
+/**
+ * Starts a new authentication attempt. This is the entry point for the auth_attempts state machine.
+
+An attempt is an ephemeral (15-minute TTL) state machine that drives a single authentication round.
+It accepts factor challenges, verifies proofs, and completes into a session or handoff token.
+
+Accepts a project_id and challenge_nonce (from POST /bootstrap/challenge). For step-up re-auth,
+also include session_id to add factors to an existing session.
+
+ * @summary Create a new authentication attempt
+ */
+declare const createAuthAttempt: (createAuthAttemptBody: CreateAuthAttemptBody, options?: RequestInit) => Promise<CreateAuthAttempt201>;
+declare const getGetAuthAttemptUrl: (attemptId: string) => string;
+/**
+ * Polls the current state of an authentication attempt.
+
+Returns the attempt's state, available factors for the next challenge,
+challenges issued so far, and any errors preventing progress.
+
+Use this for polling during long-running factor verifications (e.g., waiting for
+a federated IdP callback or a device flow).
+
+ * @summary Get authentication attempt state
+ */
+declare const getAuthAttempt: (attemptId: string, options?: RequestInit) => Promise<GetAuthAttempt200>;
+declare const getIssueChallengeUrl: (attemptId: string) => string;
+/**
+ * Issues a single-factor verification challenge within an auth attempt.
+
+This advances the authentication state machine by requesting a specific factor method
+(password, passkey, TOTP, OTP via SMS, etc.). The server responds with challenge details
+including method, metadata, and any UI hints. The client then verifies the proof
+by calling POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.
+
+ * @summary Issue a factor challenge
+ */
+declare const issueChallenge: (attemptId: string, issueChallengeBody: IssueChallengeBody, options?: RequestInit) => Promise<IssueChallenge201>;
+declare const getVerifyChallengeProofUrl: (attemptId: string, challengeId: string) => string;
+/**
+ * Submits a proof (credential, code, assertion) to verify a factor challenge.
+
+The proof format depends on the challenge method. For example:
+- `password` method: { password: "…" }
+- `totp` method: { totp: { code: "123456" } }
+- `passkey` method: { passkey: { assertion: "…" } }
+- `recovery_code` method: { recovery_code: "…" }
+
+On successful verification, the factor is written to the auth attempt.
+The attempt moves to the next pending challenge or completes if all required factors are verified.
+
+ * @summary Verify a factor proof
+ */
+declare const verifyChallengeProof: (attemptId: string, challengeId: string, verifyChallengeProofBody: VerifyChallengeProofBody, options?: RequestInit) => Promise<VerifyChallengeProof200>;
+declare const getCreateHandoffUrl: (attemptId: string) => string;
+/**
+ * Completes the authentication attempt and mints a `handoff_token`.
+
+Call this after all required factors have been verified and the attempt is in `completed` state.
+The handoff token is short-lived (≤60 seconds) and must be exchanged at
+POST /sessions/exchange to receive the final session and session_token.
+
+The handoff token is:
+- Single-use (atomic exchange, no retry)
+- Audience-bound (requires matching project key for exchange)
+- Idempotency-safe within a 5-minute window (see conventions)
+
+ * @summary Complete authentication and create handoff token
+ */
+declare const createHandoff: (attemptId: string, options?: RequestInit) => Promise<CreateHandoff200>;
+declare const getCreateProjectUrl: () => string;
+/**
+ * @summary Create project
+ */
+declare const createProject: (createProjectBody: CreateProjectBody, options?: RequestInit) => Promise<CreateProject201>;
+declare const getQueryProjectsUrl: () => string;
+/**
+ * @summary Query projects
+ */
+declare const queryProjects: (queryProjectsBody: QueryProjectsBody, options?: RequestInit) => Promise<QueryProjects200>;
+declare const getGetProjectUrl: (projectId: string) => string;
+/**
+ * Returns the current state of a project.
+
+ * @summary Get project
+ */
+declare const getProject: (projectId: string, options?: RequestInit) => Promise<GetProject200>;
+declare const getPatchProjectUrl: (projectId: string) => string;
+/**
+ * Updates the state of a project.
+
+ * @summary Update project
+ */
+declare const patchProject: (projectId: string, patchProjectBody: PatchProjectBody, options?: RequestInit) => Promise<PatchProject200>;
+declare const getInitClaimUrl: (projectId: string) => string;
+/**
+ * Starts a claim challenge for an unclaimed project. Authenticated by the
+project secret, this mints a single-use, short-lived challenge and returns
+the `claim_url` the developer opens in a browser to complete the claim,
+together with the `challenge_id` the CLI polls with. The exact expiry is
+carried by `expires_at` on the response.
+
+ * @summary Initialize a project claim
+ */
+declare const initClaim: (projectId: string, options?: RequestInit) => Promise<InitClaim201>;
+declare const getGetClaimStatusUrl: (projectId: string, params: GetClaimStatusParams) => string;
+/**
+ * Polled by the CLI while a browser completes the claim. Authorized by the
+project secret that initiated the challenge. Returns `pending`, or
+`completed` with the owning team, the claim timestamp, and the dashboard
+URL once the browser leg has finished.
+
+ * @summary Get claim status
+ */
+declare const getClaimStatus: (projectId: string, params: GetClaimStatusParams, options?: RequestInit) => Promise<GetClaimStatus200>;
+declare const getCompleteClaimUrl: (projectId: string) => string;
+/**
+ * Called by the browser after the developer authenticates on the claim page.
+Authenticated by the `__nextgen_session` cookie, it attaches the project to
+the developer's personal team using the `challenge_id` from the claim URL as
+its single-use, browser-safe authorization.
+
+ * @summary Complete a project claim
+ */
+declare const completeClaim: (projectId: string, completeClaimBody: CompleteClaimBody, options?: RequestInit) => Promise<CompleteClaim200>;
+declare const getCreateSessionUrl: () => string;
+/**
+ * Creates an anonymous session shell with no user and no factors (`state: building`).
+
+This is optional — an `auth_attempt` will create a session implicitly if none is provided.
+Use this explicitly when you want to:
+- Pre-allocate a `session_id` before the user is known, so device/telemetry signals
+  can be correlated with the eventual authenticated session from the start.
+- Track anonymous state (bot detection, device fingerprint) that survives until authentication.
+
+Creating a session is an app-plane operation on the project credential
+(`session.write`). The returned `session_token` is a session credential for the
+end-user client, not a management scope: it is delivered as the
+`__nextgen_session` cookie and authorises the self-service operations
+`GET /sessions/me` and `DELETE /sessions/me` (`nextgenSession` scheme). The
+by-id operations `GET /sessions/{session_id}` and `DELETE /sessions/{session_id}`
+are operator endpoints and require `session.read` / `session.delete` instead.
+
+The `session_token` is superseded when a handoff exchange completes — clients must
+replace it at that point.
+
+Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
+full session TTL when the first authentication factor is written via a completing `auth_attempt`.
+
+ * @summary Create an anonymous session shell
+ */
+declare const createSession: (createSessionBody: CreateSessionBody, options?: RequestInit) => Promise<CreateSession201>;
+declare const getQuerySessionsUrl: (params: QuerySessionsParams) => string;
+/**
+ * Returns the sessions of a project, paginated with a cursor.
+Sessions of every lifecycle state are returned; each carries its `state`.
+Requires `session.read` permission.
+
+ * @summary Query sessions
+ */
+declare const querySessions: (querySessionsBody: QuerySessionsBody, params: QuerySessionsParams, options?: RequestInit) => Promise<QuerySessions200>;
+declare const getExchangeHandoffUrl: (params: ExchangeHandoffParams) => string;
+/**
+ * Consumes a one-time `handoff_token` minted by `POST /auth_attempts/{id}/handoff`
+and returns the resulting session and a `session_token`.
+
+The server resolves the originating `auth_attempt` from the token and then:
+
+| Originating auth_attempt | Outcome |
+|---|---|
+| No `session_id` | A new authenticated session is **created**. |
+| `session_id` points to an anonymous shell | Existing session is **upgraded** — user and factors written in, TTL reset to full session TTL. |
+| `session_id` points to an active session (step-up) | Existing session is **upgraded** — new factors merged, `assurance_levels[]` expanded. |
+
+The response shape is identical in all three cases.
+
+The `session_token` supersedes any previously issued `session_token` for the same session.
+Clients must replace their stored token at this point.
+
+Requires a project service key (OAuth2 client credentials).
+
+ * @summary Exchange handoff token for a session
+ */
+declare const exchangeHandoff: (exchangeHandoffBody: ExchangeHandoffBody, params: ExchangeHandoffParams, options?: RequestInit) => Promise<ExchangeHandoff200>;
+declare const getGetSessionUrl: (sessionId: string) => string;
+/**
+ * Returns the current state of a session including its factors and all currently
+satisfied assurance levels.
+
+`assurance_levels[]` may shrink over time as factor freshness windows expire,
+without the session itself expiring. Use step-up authentication (a new `auth_attempt`
+against the same `session_id`) to restore a dropped assurance level.
+
+ * @summary Get session state
+ */
+declare const getSession: (sessionId: string, options?: RequestInit) => Promise<GetSession200>;
+declare const getRevokeSessionUrl: (sessionId: string) => string;
+/**
+ * Permanently deletes the session, terminating it immediately.
+
+This is the operator revoke path and requires the `session.delete` scope on a
+project-bound credential. End-user logout with the `__nextgen_session` cookie is
+`DELETE /sessions/me` (`nextgenSession` scheme).
+
+Idempotent: deleting a session that does not exist (or was already deleted)
+still returns 204. After deletion, any tokens derived from the session are
+invalidated.
+
+ * @summary Revoke session
+ */
+declare const revokeSession: (sessionId: string, options?: RequestInit) => Promise<void>;
+declare const getGetMySessionUrl: () => string;
+/**
+ * Returns the current state of the current session including its factors and all currently
+satisfied assurance levels.
+
+`assurance_levels[]` may shrink over time as factor freshness windows expire,
+without the session itself expiring. Use step-up authentication (a new `auth_attempt`
+against the same `session_id`) to restore a dropped assurance level.
+
+ * @summary Get my session state
+ */
+declare const getMySession: (options?: RequestInit) => Promise<GetMySession200>;
+declare const getRevokeMySessionUrl: () => string;
+/**
+ * Logs out by permanently deleting the session.
+
+The `__nextgen_session` cookie issued at creation (or superseded by a handoff
+exchange) is required. Idempotent: if the session is already gone this still
+returns 204. Any tokens derived from the session are invalidated, and the
+cookie itself is cleared in the response.
+
+ * @summary Revoke my session
+ */
+declare const revokeMySession: (options?: RequestInit) => Promise<void>;
+declare const getCreateSchemaUrl: (params: CreateSchemaParams) => string;
+/**
+ * Create a new schema. The optional `$id` field is the JSON Schema document
+URI used to identify the schema in future requests (GitOps-stable identity,
+not a free-form resource primary key). When `$id` is omitted, the server
+generates a `sch_*` URL. When provided, `$id` must be unique within the
+project and should ideally be a valid URI pointing at where the schema can
+be accessed.
+
+The schema can either be a concrete schema, e.g. a user schema, or a
+schema-url which will be resolved by the server.
+
+ * @summary Create new schema
+ */
+declare const createSchema: (createSchemaBody: CreateSchemaBody, params: CreateSchemaParams, options?: RequestInit) => Promise<CreateSchema201>;
+declare const getListSchemasUrl: (params: ListSchemasParams) => string;
+/**
+ * Retrieve a list of all schemas available in the system. This endpoint
+supports pagination and filtering based on schema attributes.
+
+ * @summary List all schemas
+ */
+declare const listSchemas: (params: ListSchemasParams, options?: RequestInit) => Promise<ListSchemas200>;
+declare const getGetSchemaByIdUrl: (id: string, params?: GetSchemaByIdParams) => string;
+/**
+ * Get a schema by its ID. A schema ID identifies one immutable revision, so
+this returns exactly that revision. To find the current revision of an
+object type, list with `revisions=latest`.
+
+ * @summary Get schema by ID
+ */
+declare const getSchemaById: (id: string, params?: GetSchemaByIdParams, options?: RequestInit) => Promise<GetSchemaById200>;
+declare const getCreateFlowDefinitionUrl: () => string;
+/**
+ * Creates a new flow definition.
+Flow definitions are templates that define the sequence of steps (capabilities)
+for a particular user journey (e.g., registration, login, password reset).
+
+Flow definitions are created based on the flow definition schema, which includes the flow's purpose, audience, and the steps involved.
+
+ * @summary Create a new flow definition
+ */
+declare const createFlowDefinition: (createFlowDefinitionBody: CreateFlowDefinitionBody, options?: RequestInit) => Promise<CreateFlowDefinition201>;
+declare const getListFlowDefinitionsUrl: (params: ListFlowDefinitionsParams) => string;
+/**
+ * Retrieves a list of all flow definitions.
+This endpoint can be used to view existing flow definitions and their configurations.
+
+ * @summary List flow definitions
+ */
+declare const listFlowDefinitions: (params: ListFlowDefinitionsParams, options?: RequestInit) => Promise<ListFlowDefinitions200>;
+declare const getGetFlowDefinitionUrl: (id: string) => string;
+/**
+ * Get a flow definition by id
+ * @summary Get a flow definition by id
+ */
+declare const getFlowDefinition: (id: string, options?: RequestInit) => Promise<GetFlowDefinition200>;
+declare const getUpdateFlowDefinitionUrl: (id: string) => string;
+/**
+ * Update a flow definition by id. This endpoint replaces the existing flow definition.
+If `flow_definition.status` is omitted, the current status is preserved
+
+ * @summary Update a flow definition by id
+ */
+declare const updateFlowDefinition: (id: string, updateFlowDefinitionBody: UpdateFlowDefinitionBody, options?: RequestInit) => Promise<UpdateFlowDefinition200>;
+declare const getDeleteFlowDefinitionUrl: (id: string) => string;
+/**
+ * Delete a flow definition by id.
+If the flow definition is currently being used by a flow, the deletion will fail.
+If the flow definition is the last active flow definition for a given purpose, the deletion will fail to prevent disruption of new flows being started for that purpose.
+
+ * @summary Delete a flow definition by id
+ */
+declare const deleteFlowDefinition: (id: string, options?: RequestInit) => Promise<void>;
+declare const getCreateTeamUrl: (params: CreateTeamParams) => string;
+/**
+ * @summary Create team
+ */
+declare const createTeam: (createTeamBody: CreateTeamBody, params: CreateTeamParams, options?: RequestInit) => Promise<CreateTeam201>;
+declare const getQueryTeamsUrl: (params: QueryTeamsParams) => string;
+/**
+ * Returns the teams of a project, paginated with a cursor.
+
+ * @summary Query teams
+ */
+declare const queryTeams: (queryTeamsBody: QueryTeamsBody, params: QueryTeamsParams, options?: RequestInit) => Promise<QueryTeams200>;
+declare const getGetTeamUrl: (teamId: string) => string;
+/**
+ * Returns a Team by its id.
+
+ * @summary Get team
+ */
+declare const getTeam: (teamId: string, options?: RequestInit) => Promise<GetTeam200>;
+declare const getDeleteTeamUrl: (teamId: string) => string;
+/**
+ * Deactivates the team.
+
+The team is tombstoned rather than erased: it stays readable through
+getTeam with status `deactivated`. Its memberships are removed and the
+users whose lifecycle it owns are deactivated with it.
+
+The request is idempotent. Deleting a team that is already deactivated
+or doesn't exist succeeds without changing anything.
+
+ * @summary Delete team
+ */
+declare const deleteTeam: (teamId: string, options?: RequestInit) => Promise<void>;
+declare const getUpdateTeamUrl: (teamId: string) => string;
+/**
+ * Update team. Only active teams can be updated.
+
+ * @summary Update team
+ */
+declare const updateTeam: (teamId: string, updateTeamBody: UpdateTeamBody, options?: RequestInit) => Promise<UpdateTeam200>;
+declare const getListEnvironmentsUrl: (params: ListEnvironmentsParams) => string;
+/**
+ * Lists the project's environments ordered by name.
+
+ * @summary List environments
+ */
+declare const listEnvironments: (params: ListEnvironmentsParams, options?: RequestInit) => Promise<ListEnvironments200>;
+declare const getGetEnvironmentByNameUrl: (name: string, params: GetEnvironmentByNameParams) => string;
+/**
+ * Reads one environment of the project by its name.
+
+The lookup is scoped to the project in `project_id`: a name that exists in
+another project answers `env.not_found` exactly as an unused name does.
+
+ * @summary Get an environment by name
+ */
+declare const getEnvironmentByName: (name: string, params: GetEnvironmentByNameParams, options?: RequestInit) => Promise<GetEnvironmentByName200>;
+declare const getCreateBrandingUrl: (params: CreateBrandingParams) => string;
+/**
+ * Publishes a new immutable branding revision for the project. Branding
+revisions cannot be updated or deleted; every edit publishes a new
+revision, and flow responses resolve the latest revision per project
+(see ADR 040).
+
+The `liquid_template` is validated lexically on save (size, encoding,
+banned patterns such as `<script>` tags, inline event handlers, and the
+`| raw` filter). Authoritative LiquidJS validation runs at authoring
+time via `zitadel plan` / `zitadel apply`.
+
+ * @summary Publish a new branding revision
+ */
+declare const createBranding: (createBrandingBody: CreateBrandingBody, params: CreateBrandingParams, options?: RequestInit) => Promise<CreateBranding201>;
+declare const getListBrandingUrl: (params: ListBrandingParams) => string;
+/**
+ * Lists branding revisions for the project, newest first, capped at the
+100 most recent. The first entry is the revision flow responses
+currently resolve. Deliberately unpaginated in v1 — list endpoints
+gain a real query mechanism together (ADR 031); advertising pagination
+parameters the server ignores would be worse than none.
+
+ * @summary List branding revisions
+ */
+declare const listBranding: (params: ListBrandingParams, options?: RequestInit) => Promise<ListBranding200Item[]>;
+declare const getGetBrandingByIdUrl: (id: string) => string;
+/**
+ * Retrieves a single branding revision, including its stored configuration.
+ * @summary Get a branding revision by ID
+ */
+declare const getBrandingById: (id: string, options?: RequestInit) => Promise<GetBrandingById200>;
+declare const getCreateReleaseUrl: (params: CreateReleaseParams) => string;
+/**
+ * Bundles a release from revisions that already exist, supplied as
+`(kind, revision_id)` pairs. No new revisions are allocated — use the
+per-kind create endpoints for that, then pin the ids here.
+
+Every referenced `revision_id` must exist in the project. Each one's handle
+is read from the revision itself and recorded on the release, so a resource
+is always pinned under the identity it declares.
+
+Creating a release does not deploy it. A release is environment-agnostic
+and the same release can later be deployed to any number of environments
+unchanged.
+
+Idempotent on the pinned set: metadata is excluded from the comparison, so
+re-submitting the same revisions with a different `message` returns the
+release that already pins them rather than creating a second one.
+
+ * @summary Create a release
+ */
+declare const createRelease: (createReleaseBody: CreateReleaseBody, params: CreateReleaseParams, options?: RequestInit) => Promise<CreateRelease200 | CreateRelease201>;
+declare const getListReleasesUrl: (params: ListReleasesParams) => string;
+/**
+ * Lists the project's releases, newest first.
+
+Entries carry metadata only — the pinned set is omitted. Read one release
+with `GET /releases/{release_id}` to get its pointers.
+
+ * @summary List releases
+ */
+declare const listReleases: (params: ListReleasesParams, options?: RequestInit) => Promise<ListReleases200>;
+declare const getGetReleaseByIdUrl: (releaseId: string, params: GetReleaseByIdParams) => string;
+/**
+ * Reads one release: its metadata and the `(kind, handle, revision_id)`
+tuples it pins.
+
+Does not embed resource content. Resolve each `revision_id` through the
+per-kind read endpoints when the bytes are needed.
+
+The lookup is scoped to the project in `project_id`: a release id belonging
+to another project answers not found exactly as an unknown id does, so the
+endpoint cannot be used to probe for releases in projects the caller cannot
+read.
+
+ * @summary Get a release by id
+ */
+declare const getReleaseById: (releaseId: string, params: GetReleaseByIdParams, options?: RequestInit) => Promise<GetReleaseById200>;
+declare const getCreateGrantUrl: (params: CreateGrantParams) => string;
+/**
+ * Bind a user or team to `project.viewer`, `project.editor`, or
+`project.admin` on the project identified by the `project-id` header.
+IDs are `asgn_<opaque>`. Owning-team (`project.team`) grants are not
+created here — claim owns that path. An unrevoked grant with the same
+principal and relation occupies the unique key even after `expires_at`;
+DELETE it before re-creating.
+
+ * @summary Create grant
+ */
+declare const createGrant: (createGrantBody: CreateGrantBody, params: CreateGrantParams, options?: RequestInit) => Promise<CreateGrant201>;
+declare const getGetGrantUrl: (id: string, params: GetGrantParams) => string;
+/**
+ * Loads a grant by `(project_id, id)` that this API manages (user or team
+bound to viewer, editor, or admin) and that has not been revoked.
+"Active" here means not revoked: expired grants stay visible so the
+client can DELETE before re-granting the same binding. Authorization
+still ignores expired grants. Grants are not registered in
+`resource_scope_index`; project scope is required on the query (same as
+events). Misses, revoked rows, project-secret setup (`sk_proj`),
+owning-team (`relation=team`) rows, and cross-project ids return 404.
+
+ * @summary Get grant
+ */
+declare const getGrant: (id: string, params: GetGrantParams, options?: RequestInit) => Promise<GetGrant200>;
+declare const getDeleteGrantUrl: (id: string, params: DeleteGrantParams) => string;
+/**
+ * Soft-revokes a grant this API manages and emits `authz.revoked`.
+Already-revoked, missing, project-secret setup, and owning-team grants
+return 404. The row is not un-revoked. Expired grants can still be
+revoked so the unique binding can be reused.
+
+ * @summary Revoke grant
+ */
+declare const deleteGrant: (id: string, params: DeleteGrantParams, options?: RequestInit) => Promise<void>;
+declare const getListEventsUrl: (params: ListEventsParams) => string;
+/**
+ * Returns project-scoped audit events, newest-first by keyset on
+`(created_at, id)` (ADR 027 / ADR 049). Pass `order=asc` for oldest-first.
+Requires `events.read`.
+
+Pre-claim projects return an empty list (events are stored but not
+visible until claim succeeds). Team-scoped credentials see only events
+whose emit-time `team_id` matches the credential team (enforced when
+team-scoped tokens exist).
+
+Clients discriminate each item via `event_type` (OpenAPI Event oneOf) —
+see docs/design/api/events-catalog.md.
+
+ * @summary List events
+ */
+declare const listEvents: (params: ListEventsParams, options?: RequestInit) => Promise<ListEvents200>;
+declare const getGetEventUrl: (id: string, params: GetEventParams) => string;
+/**
+ * Loads a single event by `(project_id, id)`. Requires `events.read`.
+Events are not registered in `resource_scope_index`; project scope is
+required on the query (ADR 049). Misses and cross-project ids return 404.
+
+Pre-claim projects return 404 (stored events stay invisible until claim).
+
+ * @summary Get event by ID
+ */
+declare const getEvent: (id: string, params: GetEventParams, options?: RequestInit) => Promise<GetEvent200>;
+//#endregion
+export { getGetFlowDefinitionUrl as $, listReleases as $t, getCreateGrantUrl as A, getQueryProjectsUrl as At, getDeleteTeamUrl as B, getSetUserPasswordUrl as Bt, getBrandingById as C, getListUserPasskeysUrl as Ct, getCreateBrandingUrl as D, getMyUser as Dt, getCreateAuthAttemptUrl as E, getMySession as Et, getCreateSessionUrl as F, getReleaseById as Ft, getFinishUserPasskeyRegistrationUrl as G, getUserByID as Gt, getEnvironmentByName as H, getTeam as Ht, getCreateTeamUrl as I, getRevokeMySessionUrl as It, getGetAuthAttemptUrl as J, issueChallenge as Jt, getFlowDefinition as K, getVerifyChallengeProofUrl as Kt, getCreateUserUrl as L, getRevokeSessionUrl as Lt, getCreateProjectUrl as M, getQueryTeamsUrl as Mt, getCreateReleaseUrl as N, getQueryUsersUrl as Nt, getCreateFlowDefinitionUrl as O, getPatchProjectUrl as Ot, getCreateSchemaUrl as P, getReady as Pt, getGetEventUrl as Q, listFlowDefinitions as Qt, getDeleteFlowDefinitionUrl as R, getSchemaById as Rt, getBeginUserPasskeyRegistrationUrl as S, getListSchemasUrl as St, getCompleteClaimUrl as T, getLive as Tt, getEvent as U, getUpdateFlowDefinitionUrl as Ut, getDeleteUserByIDUrl as V, getSubmitFlowStepUrl as Vt, getExchangeHandoffUrl as W, getUpdateTeamUrl as Wt, getGetClaimStatusUrl as X, listEnvironments as Xt, getGetBrandingByIdUrl as Y, listBranding as Yt, getGetEnvironmentByNameUrl as Z, listEvents as Zt, deleteTeam as _, getListBrandingUrl as _t, createFlow as a, querySessions as an, getGetMyUserUrl as at, finishUserPasskeyRegistration as b, getListFlowDefinitionsUrl as bt, createHandoff as c, revokeMySession as cn, getGetReleaseByIdUrl as ct, createSchema as d, submitFlowStep as dn, getGetTeamUrl as dt, listSchemas as en, getGetFlowStepUrl as et, createSession as f, updateFlowDefinition as fn, getGetUserByIDUrl as ft, deleteGrant as g, getIssueChallengeUrl as gt, deleteFlowDefinition as h, zitadelNextGen_d_exports as hn, getInitClaimUrl as ht, createBranding as i, queryProjects as in, getGetMySessionUrl as it, getCreateHandoffUrl as j, getQuerySessionsUrl as jt, getCreateFlowUrl as k, getProject as kt, createProject as l, revokeSession as ln, getGetSchemaByIdUrl as lt, createUser as m, verifyChallengeProof as mn, getHealth as mt, completeClaim as n, listUserTeams as nn, getGetHealthUrl as nt, createFlowDefinition as o, queryTeams as on, getGetProjectUrl as ot, createTeam as p, updateTeam as pn, getGrant as pt, getFlowStep as q, initClaim as qt, createAuthAttempt as r, patchProject as rn, getGetLiveUrl as rt, createGrant as s, queryUsers as sn, getGetReadyUrl as st, beginUserPasskeyRegistration as t, listUserPasskeys as tn, getGetGrantUrl as tt, createRelease as u, setUserPassword as un, getGetSessionUrl as ut, deleteUserByID as v, getListEnvironmentsUrl as vt, getClaimStatus as w, getListUserTeamsUrl as wt, getAuthAttempt as x, getListReleasesUrl as xt, exchangeHandoff as y, getListEventsUrl as yt, getDeleteGrantUrl as z, getSession as zt };
+//# sourceMappingURL=zitadelNextGen-C8m49W5h.d.mts.map