@zitadel/api 0.1.0-alpha.9 → 1.0.0-alpha.21

package/dist/generated/endpoints/zitadelNextGen.mjs

@@ -10,249 +10,129 @@ import { customFetch } from "../../runtime/fetch.mjs";
 * OpenAPI spec version: 0.0.1
 */
 var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
-	authorizeDevice: () => authorizeDevice,
-	authorizeGet: () => authorizeGet,
+	beginUserPasskeyRegistration: () => beginUserPasskeyRegistration,
+	completeClaim: () => completeClaim,
 	createAuthAttempt: () => createAuthAttempt,
+	createBranding: () => createBranding,
 	createFlow: () => createFlow,
 	createFlowDefinition: () => createFlowDefinition,
+	createGrant: () => createGrant,
 	createHandoff: () => createHandoff,
 	createProject: () => createProject,
+	createRelease: () => createRelease,
 	createSchema: () => createSchema,
 	createSession: () => createSession,
 	createTeam: () => createTeam,
 	createUser: () => createUser,
 	deleteFlowDefinition: () => deleteFlowDefinition,
-	endSession: () => endSession,
+	deleteGrant: () => deleteGrant,
+	deleteTeam: () => deleteTeam,
+	deleteUserByID: () => deleteUserByID,
 	exchangeHandoff: () => exchangeHandoff,
+	finishUserPasskeyRegistration: () => finishUserPasskeyRegistration,
 	getAuthAttempt: () => getAuthAttempt,
-	getAuthorizeDeviceUrl: () => getAuthorizeDeviceUrl,
-	getAuthorizeGetUrl: () => getAuthorizeGetUrl,
+	getBeginUserPasskeyRegistrationUrl: () => getBeginUserPasskeyRegistrationUrl,
+	getBrandingById: () => getBrandingById,
+	getClaimStatus: () => getClaimStatus,
+	getCompleteClaimUrl: () => getCompleteClaimUrl,
 	getCreateAuthAttemptUrl: () => getCreateAuthAttemptUrl,
+	getCreateBrandingUrl: () => getCreateBrandingUrl,
 	getCreateFlowDefinitionUrl: () => getCreateFlowDefinitionUrl,
 	getCreateFlowUrl: () => getCreateFlowUrl,
+	getCreateGrantUrl: () => getCreateGrantUrl,
 	getCreateHandoffUrl: () => getCreateHandoffUrl,
 	getCreateProjectUrl: () => getCreateProjectUrl,
+	getCreateReleaseUrl: () => getCreateReleaseUrl,
 	getCreateSchemaUrl: () => getCreateSchemaUrl,
 	getCreateSessionUrl: () => getCreateSessionUrl,
 	getCreateTeamUrl: () => getCreateTeamUrl,
 	getCreateUserUrl: () => getCreateUserUrl,
 	getDeleteFlowDefinitionUrl: () => getDeleteFlowDefinitionUrl,
-	getEndSessionUrl: () => getEndSessionUrl,
+	getDeleteGrantUrl: () => getDeleteGrantUrl,
+	getDeleteTeamUrl: () => getDeleteTeamUrl,
+	getDeleteUserByIDUrl: () => getDeleteUserByIDUrl,
+	getEnvironmentByName: () => getEnvironmentByName,
+	getEvent: () => getEvent,
 	getExchangeHandoffUrl: () => getExchangeHandoffUrl,
+	getFinishUserPasskeyRegistrationUrl: () => getFinishUserPasskeyRegistrationUrl,
 	getFlowDefinition: () => getFlowDefinition,
 	getFlowStep: () => getFlowStep,
 	getGetAuthAttemptUrl: () => getGetAuthAttemptUrl,
+	getGetBrandingByIdUrl: () => getGetBrandingByIdUrl,
+	getGetClaimStatusUrl: () => getGetClaimStatusUrl,
+	getGetEnvironmentByNameUrl: () => getGetEnvironmentByNameUrl,
+	getGetEventUrl: () => getGetEventUrl,
 	getGetFlowDefinitionUrl: () => getGetFlowDefinitionUrl,
 	getGetFlowStepUrl: () => getGetFlowStepUrl,
+	getGetGrantUrl: () => getGetGrantUrl,
 	getGetHealthUrl: () => getGetHealthUrl,
-	getGetKeysUrl: () => getGetKeysUrl,
 	getGetLiveUrl: () => getGetLiveUrl,
 	getGetMySessionUrl: () => getGetMySessionUrl,
 	getGetMyUserUrl: () => getGetMyUserUrl,
-	getGetOpenIDConfigurationUrl: () => getGetOpenIDConfigurationUrl,
 	getGetProjectUrl: () => getGetProjectUrl,
 	getGetReadyUrl: () => getGetReadyUrl,
+	getGetReleaseByIdUrl: () => getGetReleaseByIdUrl,
 	getGetSchemaByIdUrl: () => getGetSchemaByIdUrl,
 	getGetSessionUrl: () => getGetSessionUrl,
 	getGetTeamUrl: () => getGetTeamUrl,
-	getGetTokenUrl: () => getGetTokenUrl,
 	getGetUserByIDUrl: () => getGetUserByIDUrl,
-	getGetUserInfoUrl: () => getGetUserInfoUrl,
+	getGrant: () => getGrant,
 	getHealth: () => getHealth,
-	getIntrospectUrl: () => getIntrospectUrl,
+	getInitClaimUrl: () => getInitClaimUrl,
 	getIssueChallengeUrl: () => getIssueChallengeUrl,
-	getKeys: () => getKeys,
+	getListBrandingUrl: () => getListBrandingUrl,
+	getListEnvironmentsUrl: () => getListEnvironmentsUrl,
+	getListEventsUrl: () => getListEventsUrl,
 	getListFlowDefinitionsUrl: () => getListFlowDefinitionsUrl,
-	getListSessionsUrl: () => getListSessionsUrl,
-	getListUsersUrl: () => getListUsersUrl,
+	getListReleasesUrl: () => getListReleasesUrl,
+	getListSchemasUrl: () => getListSchemasUrl,
+	getListUserPasskeysUrl: () => getListUserPasskeysUrl,
+	getListUserTeamsUrl: () => getListUserTeamsUrl,
 	getLive: () => getLive,
 	getMySession: () => getMySession,
 	getMyUser: () => getMyUser,
-	getOpenIDConfiguration: () => getOpenIDConfiguration,
+	getPatchProjectUrl: () => getPatchProjectUrl,
 	getProject: () => getProject,
+	getQueryProjectsUrl: () => getQueryProjectsUrl,
+	getQuerySessionsUrl: () => getQuerySessionsUrl,
+	getQueryTeamsUrl: () => getQueryTeamsUrl,
+	getQueryUsersUrl: () => getQueryUsersUrl,
 	getReady: () => getReady,
+	getReleaseById: () => getReleaseById,
 	getRevokeMySessionUrl: () => getRevokeMySessionUrl,
 	getRevokeSessionUrl: () => getRevokeSessionUrl,
-	getRevokeTokenUrl: () => getRevokeTokenUrl,
 	getSchemaById: () => getSchemaById,
 	getSession: () => getSession,
 	getSetUserPasswordUrl: () => getSetUserPasswordUrl,
-	getSubmitFlowEventUrl: () => getSubmitFlowEventUrl,
 	getSubmitFlowStepUrl: () => getSubmitFlowStepUrl,
 	getTeam: () => getTeam,
-	getToken: () => getToken,
 	getUpdateFlowDefinitionUrl: () => getUpdateFlowDefinitionUrl,
+	getUpdateTeamUrl: () => getUpdateTeamUrl,
 	getUserByID: () => getUserByID,
-	getUserInfo: () => getUserInfo,
 	getVerifyChallengeProofUrl: () => getVerifyChallengeProofUrl,
-	introspect: () => introspect,
+	initClaim: () => initClaim,
 	issueChallenge: () => issueChallenge,
+	listBranding: () => listBranding,
+	listEnvironments: () => listEnvironments,
+	listEvents: () => listEvents,
 	listFlowDefinitions: () => listFlowDefinitions,
-	listSessions: () => listSessions,
-	listUsers: () => listUsers,
+	listReleases: () => listReleases,
+	listSchemas: () => listSchemas,
+	listUserPasskeys: () => listUserPasskeys,
+	listUserTeams: () => listUserTeams,
+	patchProject: () => patchProject,
+	queryProjects: () => queryProjects,
+	querySessions: () => querySessions,
+	queryTeams: () => queryTeams,
+	queryUsers: () => queryUsers,
 	revokeMySession: () => revokeMySession,
 	revokeSession: () => revokeSession,
-	revokeToken: () => revokeToken,
 	setUserPassword: () => setUserPassword,
-	submitFlowEvent: () => submitFlowEvent,
 	submitFlowStep: () => submitFlowStep,
 	updateFlowDefinition: () => updateFlowDefinition,
+	updateTeam: () => updateTeam,
 	verifyChallengeProof: () => verifyChallengeProof
 });
-const getGetOpenIDConfigurationUrl = () => {
-	return `${getProxyPath()}/.well-known/openid-configuration`;
-};
-/**
-* Retrieve the OpenID Connect configuration
-* @summary Get OpenID Connect configuration
-*/
-const getOpenIDConfiguration = async (options) => {
-	return customFetch(getGetOpenIDConfigurationUrl(), {
-		...options,
-		method: "GET"
-	});
-};
-const getAuthorizeGetUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/auth/authorize?${stringifiedParams}` : `${getProxyPath()}/auth/authorize`;
-};
-/**
-* @summary Authorize a user
-*/
-const authorizeGet = async (params, options) => {
-	return customFetch(getAuthorizeGetUrl(params), {
-		...options,
-		method: "GET"
-	});
-};
-const getAuthorizeDeviceUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/auth/device-authorization?${stringifiedParams}` : `${getProxyPath()}/auth/device-authorization`;
-};
-/**
-* @summary Authorize a device
-*/
-const authorizeDevice = async (params, options) => {
-	return customFetch(getAuthorizeDeviceUrl(params), {
-		...options,
-		method: "GET"
-	});
-};
-const getEndSessionUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/auth/end-session?${stringifiedParams}` : `${getProxyPath()}/auth/end-session`;
-};
-/**
-* @summary End a session
-*/
-const endSession = async (params, options) => {
-	return customFetch(getEndSessionUrl(params), {
-		...options,
-		method: "GET"
-	});
-};
-const getIntrospectUrl = () => {
-	return `${getProxyPath()}/auth/introspect`;
-};
-/**
-* @summary Introspect a token
-*/
-const introspect = async (introspectBody, options) => {
-	const formUrlEncoded = new URLSearchParams();
-	formUrlEncoded.append(`token`, introspectBody.token);
-	if (introspectBody.token_type_hint !== void 0) formUrlEncoded.append(`token_type_hint`, introspectBody.token_type_hint);
-	return customFetch(getIntrospectUrl(), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-			...options?.headers
-		},
-		body: formUrlEncoded
-	});
-};
-const getGetKeysUrl = () => {
-	return `${getProxyPath()}/auth/keys`;
-};
-/**
-* @summary Get public keys
-*/
-const getKeys = async (options) => {
-	return customFetch(getGetKeysUrl(), {
-		...options,
-		method: "GET"
-	});
-};
-const getRevokeTokenUrl = () => {
-	return `${getProxyPath()}/auth/revoke`;
-};
-/**
-* @summary Revoke an access token or refresh token
-*/
-const revokeToken = async (revokeTokenBody, options) => {
-	const formUrlEncoded = new URLSearchParams();
-	if (revokeTokenBody.token !== void 0) formUrlEncoded.append(`token`, revokeTokenBody.token);
-	if (revokeTokenBody.token_type_hint !== void 0) formUrlEncoded.append(`token_type_hint`, revokeTokenBody.token_type_hint);
-	return customFetch(getRevokeTokenUrl(), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-			...options?.headers
-		},
-		body: formUrlEncoded
-	});
-};
-const getGetTokenUrl = () => {
-	return `${getProxyPath()}/auth/token`;
-};
-/**
-* @summary Get accesstoken
-*/
-const getToken = async (getTokenBody, options) => {
-	const formUrlEncoded = new URLSearchParams();
-	if (getTokenBody.code !== void 0) formUrlEncoded.append(`code`, getTokenBody.code);
-	if (getTokenBody.client_assertion !== void 0) formUrlEncoded.append(`client_assertion`, getTokenBody.client_assertion);
-	if (getTokenBody.client_assertion_type !== void 0) formUrlEncoded.append(`client_assertion_type`, getTokenBody.client_assertion_type);
-	if (getTokenBody.client_id !== void 0) formUrlEncoded.append(`client_id`, getTokenBody.client_id);
-	if (getTokenBody.client_secret !== void 0) formUrlEncoded.append(`client_secret`, getTokenBody.client_secret);
-	if (getTokenBody.code_verifier !== void 0) formUrlEncoded.append(`code_verifier`, getTokenBody.code_verifier);
-	if (getTokenBody.grant_type !== void 0) formUrlEncoded.append(`grant_type`, getTokenBody.grant_type);
-	if (getTokenBody.redirect_uri !== void 0) formUrlEncoded.append(`redirect_uri`, getTokenBody.redirect_uri);
-	return customFetch(getGetTokenUrl(), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-			...options?.headers
-		},
-		body: formUrlEncoded
-	});
-};
-const getGetUserInfoUrl = () => {
-	return `${getProxyPath()}/auth/userinfo`;
-};
-/**
-* @summary Get user info
-*/
-const getUserInfo = async (options) => {
-	return customFetch(getGetUserInfoUrl(), {
-		...options,
-		method: "GET"
-	});
-};
 const getGetHealthUrl = () => {
 	return `${getProxyPath()}/healthz`;
 };
@@ -314,21 +194,27 @@ const createUser = async (createUserBody, params, options) => {
 		body: JSON.stringify(createUserBody)
 	});
 };
-const getListUsersUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/users?${stringifiedParams}` : `${getProxyPath()}/users`;
+const getQueryUsersUrl = () => {
+	return `${getProxyPath()}/users/query`;
 };
 /**
-* @summary List users
+* Returns the users of a project, paginated with a cursor.
+
+The project comes from the credential, not from a parameter: the operation
+is bound to the token's own project by construction. This is why it takes
+no `project_id`, unlike the other query endpoints.
+
+* @summary Query users
 */
-const listUsers = async (params, options) => {
-	return customFetch(getListUsersUrl(params), {
+const queryUsers = async (queryUsersBody, options) => {
+	return customFetch(getQueryUsersUrl(), {
 		...options,
-		method: "GET"
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(queryUsersBody)
 	});
 };
 const getGetUserByIDUrl = (userId, params) => {
@@ -348,19 +234,90 @@ const getUserByID = async (userId, params, options) => {
 		method: "GET"
 	});
 };
-const getSetUserPasswordUrl = (userId, params) => {
+const getDeleteUserByIDUrl = (userId) => {
+	return `${getProxyPath()}/users/${userId}`;
+};
+/**
+* @summary Delete user by ID
+*/
+const deleteUserByID = async (userId, options) => {
+	return customFetch(getDeleteUserByIDUrl(userId), {
+		...options,
+		method: "DELETE"
+	});
+};
+const getListUserPasskeysUrl = (userId, params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/password?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/password`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/passkeys?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/passkeys`;
+};
+/**
+* @summary List user passkeys
+*/
+const listUserPasskeys = async (userId, params, options) => {
+	return customFetch(getListUserPasskeysUrl(userId, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getBeginUserPasskeyRegistrationUrl = (userId) => {
+	return `${getProxyPath()}/users/${userId}/passkeys/registrations`;
+};
+/**
+* Starts a WebAuthn registration ceremony for the user and returns the
+creation options for `navigator.credentials.create()`. Complete the
+ceremony with `POST /users/{user_id}/passkeys/registrations/{registration_id}` within
+five minutes. Credentials already registered for the user are excluded
+automatically.
+
+* @summary Begin passkey registration
+*/
+const beginUserPasskeyRegistration = async (userId, beginUserPasskeyRegistrationBody, options) => {
+	return customFetch(getBeginUserPasskeyRegistrationUrl(userId), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(beginUserPasskeyRegistrationBody)
+	});
+};
+const getFinishUserPasskeyRegistrationUrl = (userId, registrationId) => {
+	return `${getProxyPath()}/users/${userId}/passkeys/registrations/${registrationId}`;
+};
+/**
+* Verifies the attestation against the ceremony started by
+`POST /users/{user_id}/passkeys/registrations` and persists the new credential. A
+rejected attestation counts against the ceremony's failure budget and the
+ceremony stays open for a retry. An expired ceremony surfaces as
+`att.stale_challenge`; an unknown or already-consumed registration id
+surfaces as `att.not_found`.
+
+* @summary Finish passkey registration
+*/
+const finishUserPasskeyRegistration = async (userId, registrationId, finishUserPasskeyRegistrationBody, options) => {
+	return customFetch(getFinishUserPasskeyRegistrationUrl(userId, registrationId), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(finishUserPasskeyRegistrationBody)
+	});
+};
+const getSetUserPasswordUrl = (userId) => {
+	return `${getProxyPath()}/users/${userId}/password`;
 };
 /**
 * @summary Set user password
 */
-const setUserPassword = async (userId, setUserPasswordBody, params, options) => {
-	return customFetch(getSetUserPasswordUrl(userId, params), {
+const setUserPassword = async (userId, setUserPasswordBody, options) => {
+	return customFetch(getSetUserPasswordUrl(userId), {
 		...options,
 		method: "PUT",
 		headers: {
@@ -370,6 +327,31 @@ const setUserPassword = async (userId, setUserPasswordBody, params, options) =>
 		body: JSON.stringify(setUserPasswordBody)
 	});
 };
+const getListUserTeamsUrl = (userId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/teams?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/teams`;
+};
+/**
+* The user's team roster, ordered by team name. Each entry carries the
+team's name, so a client renders a page without resolving ids one by one.
+
+This is the N:N roster and it is not lifecycle ownership: the single team
+that owns the user's lifecycle is reported as `metadata.lifecycle_owner_team_id`
+on the user read endpoints. Memberships the user was removed from are not
+returned.
+
+* @summary List the teams a user belongs to
+*/
+const listUserTeams = async (userId, params, options) => {
+	return customFetch(getListUserTeamsUrl(userId, params), {
+		...options,
+		method: "GET"
+	});
+};
 const getGetMyUserUrl = () => {
 	return `${getProxyPath()}/users/me`;
 };
@@ -391,7 +373,7 @@ the first capability step. Creates a new session implicitly unless
 `session_id` is provided (for step-up / reauth on an existing session).
 
 The response contains an `id` field — the flow handle. Use it as the path
-parameter for all subsequent `/flow/{id}/submit` and `/flow/{id}/event` calls.
+parameter for all subsequent `/flow/{id}/submit` calls.
 
 The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
 the flow's orchestration state (current step, collected data, history).
@@ -471,26 +453,6 @@ const submitFlowStep = async (id, submitFlowStepBody, options) => {
 		body: JSON.stringify(submitFlowStepBody)
 	});
 };
-const getSubmitFlowEventUrl = (id) => {
-	return `${getProxyPath()}/flow/${id}/event`;
-};
-/**
-* Submits telemetry or fingerprint data from the frontend.
-Does not advance the state machine. Used for risk evaluation.
-
-* @summary Submit client-side event
-*/
-const submitFlowEvent = async (id, submitFlowEventBody, options) => {
-	return customFetch(getSubmitFlowEventUrl(id), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(submitFlowEventBody)
-	});
-};
 const getCreateAuthAttemptUrl = () => {
 	return `${getProxyPath()}/auth_attempts`;
 };
@@ -628,6 +590,23 @@ const createProject = async (createProjectBody, options) => {
 		body: JSON.stringify(createProjectBody)
 	});
 };
+const getQueryProjectsUrl = () => {
+	return `${getProxyPath()}/projects/query`;
+};
+/**
+* @summary Query projects
+*/
+const queryProjects = async (queryProjectsBody, options) => {
+	return customFetch(getQueryProjectsUrl(), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(queryProjectsBody)
+	});
+};
 const getGetProjectUrl = (projectId) => {
 	return `${getProxyPath()}/projects/${projectId}`;
 };
@@ -642,6 +621,87 @@ const getProject = async (projectId, options) => {
 		method: "GET"
 	});
 };
+const getPatchProjectUrl = (projectId) => {
+	return `${getProxyPath()}/projects/${projectId}`;
+};
+/**
+* Updates the state of a project.
+
+* @summary Update project
+*/
+const patchProject = async (projectId, patchProjectBody, options) => {
+	return customFetch(getPatchProjectUrl(projectId), {
+		...options,
+		method: "PATCH",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(patchProjectBody)
+	});
+};
+const getInitClaimUrl = (projectId) => {
+	return `${getProxyPath()}/projects/${projectId}/claim/init`;
+};
+/**
+* Starts a claim challenge for an unclaimed project. Authenticated by the
+project secret, this mints a single-use, short-lived challenge and returns
+the `claim_url` the developer opens in a browser to complete the claim,
+together with the `challenge_id` the CLI polls with. The exact expiry is
+carried by `expires_at` on the response.
+
+* @summary Initialize a project claim
+*/
+const initClaim = async (projectId, options) => {
+	return customFetch(getInitClaimUrl(projectId), {
+		...options,
+		method: "POST"
+	});
+};
+const getGetClaimStatusUrl = (projectId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/projects/${projectId}/claim/status?${stringifiedParams}` : `${getProxyPath()}/projects/${projectId}/claim/status`;
+};
+/**
+* Polled by the CLI while a browser completes the claim. Authorized by the
+project secret that initiated the challenge. Returns `pending`, or
+`completed` with the owning team, the claim timestamp, and the dashboard
+URL once the browser leg has finished.
+
+* @summary Get claim status
+*/
+const getClaimStatus = async (projectId, params, options) => {
+	return customFetch(getGetClaimStatusUrl(projectId, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getCompleteClaimUrl = (projectId) => {
+	return `${getProxyPath()}/projects/${projectId}/claim/complete`;
+};
+/**
+* Called by the browser after the developer authenticates on the claim page.
+Authenticated by the `__nextgen_session` cookie, it attaches the project to
+the developer's personal team using the `challenge_id` from the claim URL as
+its single-use, browser-safe authorization.
+
+* @summary Complete a project claim
+*/
+const completeClaim = async (projectId, completeClaimBody, options) => {
+	return customFetch(getCompleteClaimUrl(projectId), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(completeClaimBody)
+	});
+};
 const getCreateSessionUrl = () => {
 	return `${getProxyPath()}/sessions`;
 };
@@ -654,8 +714,16 @@ Use this explicitly when you want to:
 can be correlated with the eventual authenticated session from the start.
 - Track anonymous state (bot detection, device fingerprint) that survives until authentication.
 
-The returned `session_token` authorises GET and DELETE on this session.
-It is superseded when a handoff exchange completes — clients must replace it at that point.
+Creating a session is an app-plane operation on the project credential
+(`session.write`). The returned `session_token` is a session credential for the
+end-user client, not a management scope: it is delivered as the
+`__nextgen_session` cookie and authorises the self-service operations
+`GET /sessions/me` and `DELETE /sessions/me` (`nextgenSession` scheme). The
+by-id operations `GET /sessions/{session_id}` and `DELETE /sessions/{session_id}`
+are operator endpoints and require `session.read` / `session.delete` instead.
+
+The `session_token` is superseded when a handoff exchange completes — clients must
+replace it at that point.
 
 Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
 full session TTL when the first authentication factor is written via a completing `auth_attempt`.
@@ -673,24 +741,30 @@ const createSession = async (createSessionBody, options) => {
 		body: JSON.stringify(createSessionBody)
 	});
 };
-const getListSessionsUrl = (params) => {
+const getQuerySessionsUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions?${stringifiedParams}` : `${getProxyPath()}/sessions`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/query?${stringifiedParams}` : `${getProxyPath()}/sessions/query`;
 };
 /**
-* Returns a paginated list of sessions for a project.
-Requires a project service key (OAuth2 client credentials).
+* Returns the sessions of a project, paginated with a cursor.
+Sessions of every lifecycle state are returned; each carries its `state`.
+Requires `session.read` permission.
 
-* @summary List sessions
+* @summary Query sessions
 */
-const listSessions = async (params, options) => {
-	return customFetch(getListSessionsUrl(params), {
+const querySessions = async (querySessionsBody, params, options) => {
+	return customFetch(getQuerySessionsUrl(params), {
 		...options,
-		method: "GET"
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(querySessionsBody)
 	});
 };
 const getExchangeHandoffUrl = (params) => {
@@ -733,13 +807,8 @@ const exchangeHandoff = async (exchangeHandoffBody, params, options) => {
 		body: JSON.stringify(exchangeHandoffBody)
 	});
 };
-const getGetSessionUrl = (sessionId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}` : `${getProxyPath()}/sessions/${sessionId}`;
+const getGetSessionUrl = (sessionId) => {
+	return `${getProxyPath()}/sessions/${sessionId}`;
 };
 /**
 * Returns the current state of a session including its factors and all currently
@@ -751,30 +820,30 @@ against the same `session_id`) to restore a dropped assurance level.
 
 * @summary Get session state
 */
-const getSession = async (sessionId, params, options) => {
-	return customFetch(getGetSessionUrl(sessionId, params), {
+const getSession = async (sessionId, options) => {
+	return customFetch(getGetSessionUrl(sessionId), {
 		...options,
 		method: "GET"
 	});
 };
-const getRevokeSessionUrl = (sessionId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}` : `${getProxyPath()}/sessions/${sessionId}`;
+const getRevokeSessionUrl = (sessionId) => {
+	return `${getProxyPath()}/sessions/${sessionId}`;
 };
 /**
-* Revokes the session immediately (`state: revoked`). This is the logout operation.
+* Permanently deletes the session, terminating it immediately.
 
-The session_token issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated.
+This is the operator revoke path and requires the `session.delete` scope on a
+project-bound credential. End-user logout with the `__nextgen_session` cookie is
+`DELETE /sessions/me` (`nextgenSession` scheme).
+
+Idempotent: deleting a session that does not exist (or was already deleted)
+still returns 204. After deletion, any tokens derived from the session are
+invalidated.
 
 * @summary Revoke session
 */
-const revokeSession = async (sessionId, params, options) => {
-	return customFetch(getRevokeSessionUrl(sessionId, params), {
+const revokeSession = async (sessionId, options) => {
+	return customFetch(getRevokeSessionUrl(sessionId), {
 		...options,
 		method: "DELETE"
 	});
@@ -802,10 +871,12 @@ const getRevokeMySessionUrl = () => {
 	return `${getProxyPath()}/sessions/me`;
 };
 /**
-* Revokes the session immediately (`state: revoked`). This is the logout operation.
+* Logs out by permanently deleting the session.
 
-The __nextgen_session cookie issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated including the cookie itself, which is cleared in the response.
+The `__nextgen_session` cookie issued at creation (or superseded by a handoff
+exchange) is required. Idempotent: if the session is already gone this still
+returns 204. Any tokens derived from the session are invalidated, and the
+cookie itself is cleared in the response.
 
 * @summary Revoke my session
 */
@@ -824,10 +895,12 @@ const getCreateSchemaUrl = (params) => {
 	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas?${stringifiedParams}` : `${getProxyPath()}/schemas`;
 };
 /**
-* Create a new schema. The schema definition must include a unique $id field,
-which will be used to identify the schema in future requests. The $id must
-be a valid URI and should ideally point to the location where the schema
-can be accessed.
+* Create a new schema. The optional `$id` field is the JSON Schema document
+URI used to identify the schema in future requests (GitOps-stable identity,
+not a free-form resource primary key). When `$id` is omitted, the server
+generates a `sch_*` URL. When provided, `$id` must be unique within the
+project and should ideally be a valid URI pointing at where the schema can
+be accessed.
 
 The schema can either be a concrete schema, e.g. a user schema, or a
 schema-url which will be resolved by the server.
@@ -845,6 +918,26 @@ const createSchema = async (createSchemaBody, params, options) => {
 		body: JSON.stringify(createSchemaBody)
 	});
 };
+const getListSchemasUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas?${stringifiedParams}` : `${getProxyPath()}/schemas`;
+};
+/**
+* Retrieve a list of all schemas available in the system. This endpoint
+supports pagination and filtering based on schema attributes.
+
+* @summary List all schemas
+*/
+const listSchemas = async (params, options) => {
+	return customFetch(getListSchemasUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
 const getGetSchemaByIdUrl = (id, params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
@@ -854,7 +947,10 @@ const getGetSchemaByIdUrl = (id, params) => {
 	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas/${id}?${stringifiedParams}` : `${getProxyPath()}/schemas/${id}`;
 };
 /**
-* Get a schema by its ID. This will return the default revision of the schema.
+* Get a schema by its ID. A schema ID identifies one immutable revision, so
+this returns exactly that revision. To find the current revision of an
+object type, list with `revisions=latest`.
+
 * @summary Get schema by ID
 */
 const getSchemaById = async (id, params, options) => {
@@ -871,7 +967,7 @@ const getCreateFlowDefinitionUrl = () => {
 Flow definitions are templates that define the sequence of steps (capabilities)
 for a particular user journey (e.g., registration, login, password reset).
 
-Flow definitions are created based on the flow meta schema, which includes the flow's purpose, audience, and the steps involved.
+Flow definitions are created based on the flow definition schema, which includes the flow's purpose, audience, and the steps involved.
 
 * @summary Create a new flow definition
 */
@@ -906,107 +1002,488 @@ const listFlowDefinitions = async (params, options) => {
 		method: "GET"
 	});
 };
-const getGetFlowDefinitionUrl = (id, params) => {
+const getGetFlowDefinitionUrl = (id) => {
+	return `${getProxyPath()}/flow_definitions/${id}`;
+};
+/**
+* Get a flow definition by id
+* @summary Get a flow definition by id
+*/
+const getFlowDefinition = async (id, options) => {
+	return customFetch(getGetFlowDefinitionUrl(id), {
+		...options,
+		method: "GET"
+	});
+};
+const getUpdateFlowDefinitionUrl = (id) => {
+	return `${getProxyPath()}/flow_definitions/${id}`;
+};
+/**
+* Update a flow definition by id. This endpoint replaces the existing flow definition.
+If `flow_definition.status` is omitted, the current status is preserved
+
+* @summary Update a flow definition by id
+*/
+const updateFlowDefinition = async (id, updateFlowDefinitionBody, options) => {
+	return customFetch(getUpdateFlowDefinitionUrl(id), {
+		...options,
+		method: "PUT",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(updateFlowDefinitionBody)
+	});
+};
+const getDeleteFlowDefinitionUrl = (id) => {
+	return `${getProxyPath()}/flow_definitions/${id}`;
+};
+/**
+* Delete a flow definition by id.
+If the flow definition is currently being used by a flow, the deletion will fail.
+If the flow definition is the last active flow definition for a given purpose, the deletion will fail to prevent disruption of new flows being started for that purpose.
+
+* @summary Delete a flow definition by id
+*/
+const deleteFlowDefinition = async (id, options) => {
+	return customFetch(getDeleteFlowDefinitionUrl(id), {
+		...options,
+		method: "DELETE"
+	});
+};
+const getCreateTeamUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams?${stringifiedParams}` : `${getProxyPath()}/teams`;
 };
 /**
-* Get a flow definition by id
-* @summary Get a flow definition by id
+* @summary Create team
 */
-const getFlowDefinition = async (id, params, options) => {
-	return customFetch(getGetFlowDefinitionUrl(id, params), {
+const createTeam = async (createTeamBody, params, options) => {
+	return customFetch(getCreateTeamUrl(params), {
 		...options,
-		method: "GET"
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createTeamBody)
 	});
 };
-const getUpdateFlowDefinitionUrl = (id, params) => {
+const getQueryTeamsUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/query?${stringifiedParams}` : `${getProxyPath()}/teams/query`;
 };
 /**
-* Update a flow definition by id
-* @summary Update a flow definition by id
+* Returns the teams of a project, paginated with a cursor.
+
+* @summary Query teams
+*/
+const queryTeams = async (queryTeamsBody, params, options) => {
+	return customFetch(getQueryTeamsUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(queryTeamsBody)
+	});
+};
+const getGetTeamUrl = (teamId) => {
+	return `${getProxyPath()}/teams/${teamId}`;
+};
+/**
+* Returns a Team by its id.
+
+* @summary Get team
 */
-const updateFlowDefinition = async (id, updateFlowDefinitionBody, params, options) => {
-	return customFetch(getUpdateFlowDefinitionUrl(id, params), {
+const getTeam = async (teamId, options) => {
+	return customFetch(getGetTeamUrl(teamId), {
+		...options,
+		method: "GET"
+	});
+};
+const getDeleteTeamUrl = (teamId) => {
+	return `${getProxyPath()}/teams/${teamId}`;
+};
+/**
+* Deactivates the team.
+
+The team is tombstoned rather than erased: it stays readable through
+getTeam with status `deactivated`. Its memberships are removed and the
+users whose lifecycle it owns are deactivated with it.
+
+The request is idempotent. Deleting a team that is already deactivated
+or doesn't exist succeeds without changing anything.
+
+* @summary Delete team
+*/
+const deleteTeam = async (teamId, options) => {
+	return customFetch(getDeleteTeamUrl(teamId), {
+		...options,
+		method: "DELETE"
+	});
+};
+const getUpdateTeamUrl = (teamId) => {
+	return `${getProxyPath()}/teams/${teamId}`;
+};
+/**
+* Update team. Only active teams can be updated.
+
+* @summary Update team
+*/
+const updateTeam = async (teamId, updateTeamBody, options) => {
+	return customFetch(getUpdateTeamUrl(teamId), {
 		...options,
 		method: "PATCH",
 		headers: {
 			"Content-Type": "application/json",
 			...options?.headers
 		},
-		body: JSON.stringify(updateFlowDefinitionBody)
+		body: JSON.stringify(updateTeamBody)
 	});
 };
-const getDeleteFlowDefinitionUrl = (id, params) => {
+const getListEnvironmentsUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/environments?${stringifiedParams}` : `${getProxyPath()}/environments`;
 };
 /**
-* Delete a flow definition by id
-* @summary Delete a flow definition by id
+* Lists the project's environments ordered by name.
+
+* @summary List environments
 */
-const deleteFlowDefinition = async (id, params, options) => {
-	return customFetch(getDeleteFlowDefinitionUrl(id, params), {
+const listEnvironments = async (params, options) => {
+	return customFetch(getListEnvironmentsUrl(params), {
 		...options,
-		method: "DELETE"
+		method: "GET"
 	});
 };
-const getCreateTeamUrl = (params) => {
+const getGetEnvironmentByNameUrl = (name, params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams?${stringifiedParams}` : `${getProxyPath()}/teams`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/environments/${name}?${stringifiedParams}` : `${getProxyPath()}/environments/${name}`;
 };
 /**
-* @summary Create team
+* Reads one environment of the project by its name.
+
+The lookup is scoped to the project in `project_id`: a name that exists in
+another project answers `env.not_found` exactly as an unused name does.
+
+* @summary Get an environment by name
 */
-const createTeam = async (params, createTeamBody, options) => {
-	return customFetch(getCreateTeamUrl(params), {
+const getEnvironmentByName = async (name, params, options) => {
+	return customFetch(getGetEnvironmentByNameUrl(name, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getCreateBrandingUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/branding?${stringifiedParams}` : `${getProxyPath()}/branding`;
+};
+/**
+* Publishes a new immutable branding revision for the project. Branding
+revisions cannot be updated or deleted; every edit publishes a new
+revision, and flow responses resolve the latest revision per project
+(see ADR 040).
+
+The `liquid_template` is validated lexically on save (size, encoding,
+banned patterns such as `<script>` tags, inline event handlers, and the
+`| raw` filter). Authoritative LiquidJS validation runs at authoring
+time via `zitadel plan` / `zitadel apply`.
+
+* @summary Publish a new branding revision
+*/
+const createBranding = async (createBrandingBody, params, options) => {
+	return customFetch(getCreateBrandingUrl(params), {
 		...options,
 		method: "POST",
 		headers: {
 			"Content-Type": "application/json",
 			...options?.headers
 		},
-		body: JSON.stringify(createTeamBody)
+		body: JSON.stringify(createBrandingBody)
 	});
 };
-const getGetTeamUrl = (teamId, params) => {
+const getListBrandingUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}` : `${getProxyPath()}/teams/${teamId}`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/branding?${stringifiedParams}` : `${getProxyPath()}/branding`;
 };
 /**
-* Returns the current state of a team.
+* Lists branding revisions for the project, newest first, capped at the
+100 most recent. The first entry is the revision flow responses
+currently resolve. Deliberately unpaginated in v1 — list endpoints
+gain a real query mechanism together (ADR 031); advertising pagination
+parameters the server ignores would be worse than none.
 
-* @summary Get team
+* @summary List branding revisions
+*/
+const listBranding = async (params, options) => {
+	return customFetch(getListBrandingUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetBrandingByIdUrl = (id) => {
+	return `${getProxyPath()}/branding/${id}`;
+};
+/**
+* Retrieves a single branding revision, including its stored configuration.
+* @summary Get a branding revision by ID
+*/
+const getBrandingById = async (id, options) => {
+	return customFetch(getGetBrandingByIdUrl(id), {
+		...options,
+		method: "GET"
+	});
+};
+const getCreateReleaseUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/releases?${stringifiedParams}` : `${getProxyPath()}/releases`;
+};
+/**
+* Bundles a release from revisions that already exist, supplied as
+`(kind, revision_id)` pairs. No new revisions are allocated — use the
+per-kind create endpoints for that, then pin the ids here.
+
+Every referenced `revision_id` must exist in the project. Each one's handle
+is read from the revision itself and recorded on the release, so a resource
+is always pinned under the identity it declares.
+
+Creating a release does not deploy it. A release is environment-agnostic
+and the same release can later be deployed to any number of environments
+unchanged.
+
+Idempotent on the pinned set: metadata is excluded from the comparison, so
+re-submitting the same revisions with a different `message` returns the
+release that already pins them rather than creating a second one.
+
+* @summary Create a release
+*/
+const createRelease = async (createReleaseBody, params, options) => {
+	return customFetch(getCreateReleaseUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createReleaseBody)
+	});
+};
+const getListReleasesUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/releases?${stringifiedParams}` : `${getProxyPath()}/releases`;
+};
+/**
+* Lists the project's releases, newest first.
+
+Entries carry metadata only — the pinned set is omitted. Read one release
+with `GET /releases/{release_id}` to get its pointers.
+
+* @summary List releases
+*/
+const listReleases = async (params, options) => {
+	return customFetch(getListReleasesUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetReleaseByIdUrl = (releaseId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/releases/${releaseId}?${stringifiedParams}` : `${getProxyPath()}/releases/${releaseId}`;
+};
+/**
+* Reads one release: its metadata and the `(kind, handle, revision_id)`
+tuples it pins.
+
+Does not embed resource content. Resolve each `revision_id` through the
+per-kind read endpoints when the bytes are needed.
+
+The lookup is scoped to the project in `project_id`: a release id belonging
+to another project answers not found exactly as an unknown id does, so the
+endpoint cannot be used to probe for releases in projects the caller cannot
+read.
+
+* @summary Get a release by id
+*/
+const getReleaseById = async (releaseId, params, options) => {
+	return customFetch(getGetReleaseByIdUrl(releaseId, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getCreateGrantUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/grants?${stringifiedParams}` : `${getProxyPath()}/grants`;
+};
+/**
+* Bind a user or team to `project.viewer`, `project.editor`, or
+`project.admin` on the project identified by the `project-id` header.
+IDs are `asgn_<opaque>`. Owning-team (`project.team`) grants are not
+created here — claim owns that path. An unrevoked grant with the same
+principal and relation occupies the unique key even after `expires_at`;
+DELETE it before re-creating.
+
+* @summary Create grant
+*/
+const createGrant = async (createGrantBody, params, options) => {
+	return customFetch(getCreateGrantUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createGrantBody)
+	});
+};
+const getGetGrantUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/grants/${id}?${stringifiedParams}` : `${getProxyPath()}/grants/${id}`;
+};
+/**
+* Loads a grant by `(project_id, id)` that this API manages (user or team
+bound to viewer, editor, or admin) and that has not been revoked.
+"Active" here means not revoked: expired grants stay visible so the
+client can DELETE before re-granting the same binding. Authorization
+still ignores expired grants. Grants are not registered in
+`resource_scope_index`; project scope is required on the query (same as
+events). Misses, revoked rows, project-secret setup (`sk_proj`),
+owning-team (`relation=team`) rows, and cross-project ids return 404.
+
+* @summary Get grant
+*/
+const getGrant = async (id, params, options) => {
+	return customFetch(getGetGrantUrl(id, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getDeleteGrantUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/grants/${id}?${stringifiedParams}` : `${getProxyPath()}/grants/${id}`;
+};
+/**
+* Soft-revokes a grant this API manages and emits `authz.revoked`.
+Already-revoked, missing, project-secret setup, and owning-team grants
+return 404. The row is not un-revoked. Expired grants can still be
+revoked so the unique binding can be reused.
+
+* @summary Revoke grant
+*/
+const deleteGrant = async (id, params, options) => {
+	return customFetch(getDeleteGrantUrl(id, params), {
+		...options,
+		method: "DELETE"
+	});
+};
+const getListEventsUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (Array.isArray(value) && ["category", "event_type"].includes(key)) {
+			value.forEach((v) => {
+				normalizedParams.append(key, v === null ? "null" : v.toString());
+			});
+			return;
+		}
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/events?${stringifiedParams}` : `${getProxyPath()}/events`;
+};
+/**
+* Returns project-scoped audit events, newest-first by keyset on
+`(created_at, id)` (ADR 027 / ADR 049). Pass `order=asc` for oldest-first.
+Requires `events.read`.
+
+Pre-claim projects return an empty list (events are stored but not
+visible until claim succeeds). Team-scoped credentials see only events
+whose emit-time `team_id` matches the credential team (enforced when
+team-scoped tokens exist).
+
+Clients discriminate each item via `event_type` (OpenAPI Event oneOf) —
+see docs/design/api/events-catalog.md.
+
+* @summary List events
+*/
+const listEvents = async (params, options) => {
+	return customFetch(getListEventsUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetEventUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/events/${id}?${stringifiedParams}` : `${getProxyPath()}/events/${id}`;
+};
+/**
+* Loads a single event by `(project_id, id)`. Requires `events.read`.
+Events are not registered in `resource_scope_index`; project scope is
+required on the query (ADR 049). Misses and cross-project ids return 404.
+
+Pre-claim projects return 404 (stored events stay invisible until claim).
+
+* @summary Get event by ID
 */
-const getTeam = async (teamId, params, options) => {
-	return customFetch(getGetTeamUrl(teamId, params), {
+const getEvent = async (id, params, options) => {
+	return customFetch(getGetEventUrl(id, params), {
 		...options,
 		method: "GET"
 	});
 };
 //#endregion
-export { authorizeDevice, authorizeGet, createAuthAttempt, createFlow, createFlowDefinition, createHandoff, createProject, createSchema, createSession, createTeam, createUser, deleteFlowDefinition, endSession, exchangeHandoff, getAuthAttempt, getAuthorizeDeviceUrl, getAuthorizeGetUrl, getCreateAuthAttemptUrl, getCreateFlowDefinitionUrl, getCreateFlowUrl, getCreateHandoffUrl, getCreateProjectUrl, getCreateSchemaUrl, getCreateSessionUrl, getCreateTeamUrl, getCreateUserUrl, getDeleteFlowDefinitionUrl, getEndSessionUrl, getExchangeHandoffUrl, getFlowDefinition, getFlowStep, getGetAuthAttemptUrl, getGetFlowDefinitionUrl, getGetFlowStepUrl, getGetHealthUrl, getGetKeysUrl, getGetLiveUrl, getGetMySessionUrl, getGetMyUserUrl, getGetOpenIDConfigurationUrl, getGetProjectUrl, getGetReadyUrl, getGetSchemaByIdUrl, getGetSessionUrl, getGetTeamUrl, getGetTokenUrl, getGetUserByIDUrl, getGetUserInfoUrl, getHealth, getIntrospectUrl, getIssueChallengeUrl, getKeys, getListFlowDefinitionsUrl, getListSessionsUrl, getListUsersUrl, getLive, getMySession, getMyUser, getOpenIDConfiguration, getProject, getReady, getRevokeMySessionUrl, getRevokeSessionUrl, getRevokeTokenUrl, getSchemaById, getSession, getSetUserPasswordUrl, getSubmitFlowEventUrl, getSubmitFlowStepUrl, getTeam, getToken, getUpdateFlowDefinitionUrl, getUserByID, getUserInfo, getVerifyChallengeProofUrl, introspect, issueChallenge, listFlowDefinitions, listSessions, listUsers, revokeMySession, revokeSession, revokeToken, setUserPassword, submitFlowEvent, submitFlowStep, zitadelNextGen_exports as t, updateFlowDefinition, verifyChallengeProof };
+export { beginUserPasskeyRegistration, completeClaim, createAuthAttempt, createBranding, createFlow, createFlowDefinition, createGrant, createHandoff, createProject, createRelease, createSchema, createSession, createTeam, createUser, deleteFlowDefinition, deleteGrant, deleteTeam, deleteUserByID, exchangeHandoff, finishUserPasskeyRegistration, getAuthAttempt, getBeginUserPasskeyRegistrationUrl, getBrandingById, getClaimStatus, getCompleteClaimUrl, getCreateAuthAttemptUrl, getCreateBrandingUrl, getCreateFlowDefinitionUrl, getCreateFlowUrl, getCreateGrantUrl, getCreateHandoffUrl, getCreateProjectUrl, getCreateReleaseUrl, getCreateSchemaUrl, getCreateSessionUrl, getCreateTeamUrl, getCreateUserUrl, getDeleteFlowDefinitionUrl, getDeleteGrantUrl, getDeleteTeamUrl, getDeleteUserByIDUrl, getEnvironmentByName, getEvent, getExchangeHandoffUrl, getFinishUserPasskeyRegistrationUrl, getFlowDefinition, getFlowStep, getGetAuthAttemptUrl, getGetBrandingByIdUrl, getGetClaimStatusUrl, getGetEnvironmentByNameUrl, getGetEventUrl, getGetFlowDefinitionUrl, getGetFlowStepUrl, getGetGrantUrl, getGetHealthUrl, getGetLiveUrl, getGetMySessionUrl, getGetMyUserUrl, getGetProjectUrl, getGetReadyUrl, getGetReleaseByIdUrl, getGetSchemaByIdUrl, getGetSessionUrl, getGetTeamUrl, getGetUserByIDUrl, getGrant, getHealth, getInitClaimUrl, getIssueChallengeUrl, getListBrandingUrl, getListEnvironmentsUrl, getListEventsUrl, getListFlowDefinitionsUrl, getListReleasesUrl, getListSchemasUrl, getListUserPasskeysUrl, getListUserTeamsUrl, getLive, getMySession, getMyUser, getPatchProjectUrl, getProject, getQueryProjectsUrl, getQuerySessionsUrl, getQueryTeamsUrl, getQueryUsersUrl, getReady, getReleaseById, getRevokeMySessionUrl, getRevokeSessionUrl, getSchemaById, getSession, getSetUserPasswordUrl, getSubmitFlowStepUrl, getTeam, getUpdateFlowDefinitionUrl, getUpdateTeamUrl, getUserByID, getVerifyChallengeProofUrl, initClaim, issueChallenge, listBranding, listEnvironments, listEvents, listFlowDefinitions, listReleases, listSchemas, listUserPasskeys, listUserTeams, patchProject, queryProjects, querySessions, queryTeams, queryUsers, revokeMySession, revokeSession, setUserPassword, submitFlowStep, zitadelNextGen_exports as t, updateFlowDefinition, updateTeam, verifyChallengeProof };
 
 //# sourceMappingURL=zitadelNextGen.mjs.map