@zitadel/api 1.0.0-alpha.21 → 1.0.0-alpha.22

package/src/generated/endpoints/zitadelNextGen.zod.ts

@@ -2245,7 +2245,11 @@ export const InitClaimParams = zod.object({
  * Polled by the CLI while a browser completes the claim. Authorized by the
 project secret that initiated the challenge. Returns `pending`, or
 `completed` with the owning team, the claim timestamp, and the dashboard
-URL once the browser leg has finished.
+URL once the project is claimed. The claim grant, not the polled
+challenge, is the source of truth: a project claimed through another
+concurrent challenge also reports `completed`, and a completed claim
+keeps reporting `completed` past this challenge's expiry and past the
+project's claim window.
 
  * @summary Get claim status
  */
@@ -2328,6 +2332,46 @@ export const CompleteClaimResponse = zod
   })
   .describe("The result of a completed project claim.");
 
+/**
+ * Read by the claim page in the browser to show how long is left to claim the
+project. Unauthenticated by design: the claim page runs this before the
+developer has signed in, and holding the `challenge_id` from the claim URL
+is the authorization — the same capability `claim/complete` accepts. It
+reveals only the window, never the project itself, and unlike
+`claim/complete` it spends nothing, so a reload is free.
+
+ * @summary Get the claim window for a project
+ */
+export const getClaimWindowPathProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const GetClaimWindowParams = zod.object({
+  project_id: zod.string().regex(getClaimWindowPathProjectIdRegExp),
+});
+
+export const getClaimWindowQueryChallengeIdRegExp = new RegExp("^ch_[a-zA-Z0-9_-]+$");
+
+export const GetClaimWindowQueryParams = zod.strictObject({
+  challenge_id: zod
+    .string()
+    .regex(getClaimWindowQueryChallengeIdRegExp)
+    .describe("The challenge from the claim URL."),
+});
+
+export const GetClaimWindowResponse = zod
+  .object({
+    expires_at: zod.iso
+      .datetime({ offset: true })
+      .describe("The time when the project's claim window closes."),
+    expired: zod
+      .boolean()
+      .describe(
+        "Whether the window has already closed. Reported alongside `expires_at`\nrather than left to the client so a skewed browser clock cannot show a\nclaimable project as expired, or the reverse.\n",
+      ),
+  })
+  .describe(
+    "How long the project can still be claimed. Derived from the project's\ncreation time and the fixed 14-day claim window (ADR 046); it does not\ndepend on the challenge, which has its own much shorter expiry.\n",
+  );
+
 /**
  * Creates an anonymous session shell with no user and no factors (`state: building`).
 
@@ -2505,7 +2549,7 @@ export const QuerySessionsResponse = zod
             })
             .optional()
             .describe(
-              "A resolved reference to a user (ADR 058 §3). Fields are role-named, not\nproperty-named, so responses can mix users from different schemas.\n`identifier` and `display` are resolved independently from the user\nschema's `x-identifier` and `x-display` designations, live at read time.\nClients render `display`, falling back to `identifier`, then `user_id`.\n",
+              "A resolved reference to a user (ADR 058 §3). Fields are role-named, not\nproperty-named, so responses can mix users from different schemas.\n`identifier` and `display` are resolved independently from the user\nschema's `x-identifier` and `x-display` designations, live at read time.\nClients render `display`, falling back to `identifier`, then `user_id`.\nMissing or deleted users degrade to `user_id` only.\n",
             ),
           factors: zod
             .array(
@@ -2721,7 +2765,7 @@ export const ExchangeHandoffResponse = zod
           })
           .optional()
           .describe(
-            "A resolved reference to a user (ADR 058 §3). Fields are role-named, not\nproperty-named, so responses can mix users from different schemas.\n`identifier` and `display` are resolved independently from the user\nschema's `x-identifier` and `x-display` designations, live at read time.\nClients render `display`, falling back to `identifier`, then `user_id`.\n",
+            "A resolved reference to a user (ADR 058 §3). Fields are role-named, not\nproperty-named, so responses can mix users from different schemas.\n`identifier` and `display` are resolved independently from the user\nschema's `x-identifier` and `x-display` designations, live at read time.\nClients render `display`, falling back to `identifier`, then `user_id`.\nMissing or deleted users degrade to `user_id` only.\n",
           ),
         factors: zod
           .array(
@@ -2891,7 +2935,7 @@ export const GetSessionResponse = zod
       })
       .optional()
       .describe(
-        "A resolved reference to a user (ADR 058 §3). Fields are role-named, not\nproperty-named, so responses can mix users from different schemas.\n`identifier` and `display` are resolved independently from the user\nschema's `x-identifier` and `x-display` designations, live at read time.\nClients render `display`, falling back to `identifier`, then `user_id`.\n",
+        "A resolved reference to a user (ADR 058 §3). Fields are role-named, not\nproperty-named, so responses can mix users from different schemas.\n`identifier` and `display` are resolved independently from the user\nschema's `x-identifier` and `x-display` designations, live at read time.\nClients render `display`, falling back to `identifier`, then `user_id`.\nMissing or deleted users degrade to `user_id` only.\n",
       ),
     factors: zod
       .array(
@@ -3065,7 +3109,7 @@ export const GetMySessionResponse = zod
       })
       .optional()
       .describe(
-        "A resolved reference to a user (ADR 058 §3). Fields are role-named, not\nproperty-named, so responses can mix users from different schemas.\n`identifier` and `display` are resolved independently from the user\nschema's `x-identifier` and `x-display` designations, live at read time.\nClients render `display`, falling back to `identifier`, then `user_id`.\n",
+        "A resolved reference to a user (ADR 058 §3). Fields are role-named, not\nproperty-named, so responses can mix users from different schemas.\n`identifier` and `display` are resolved independently from the user\nschema's `x-identifier` and `x-display` designations, live at read time.\nClients render `display`, falling back to `identifier`, then `user_id`.\nMissing or deleted users degrade to `user_id` only.\n",
       ),
     factors: zod
       .array(
@@ -3638,12 +3682,17 @@ export const GetSchemaByIdResponse = zod
   );
 
 /**
- * Creates a new flow definition.
+ * Publishes a new flow definition revision.
 Flow definitions are templates that define the sequence of steps (capabilities)
 for a particular user journey (e.g., registration, login, password reset).
 
 Flow definitions are created based on the flow definition schema, which includes the flow's purpose, audience, and the steps involved.
 
+Every call allocates a new opaque id. Revisions of one flow share its
+`name`; posting a definition under an existing `name` publishes a new
+revision of that flow, it is not a conflict. List with `name` to see a
+flow's revisions, newest by creation time first.
+
  * @summary Create a new flow definition
  */
 export const createFlowDefinitionBodyProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
@@ -3669,7 +3718,7 @@ export const CreateFlowDefinitionBody = zod
           .string()
           .regex(createFlowDefinitionBodyFlowDefinitionNameRegExp)
           .describe(
-            "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
+            "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Every revision of a flow shares its\n`name`; publishing a definition under an existing `name` adds a\nrevision to that flow. Renaming is not supported — the `name` is part\nof the public contract another definition may reference. Acts as the\nhuman display label as well; no separate slug.\n",
           ),
         status: zod
           .enum(["active", "draft"])
@@ -3867,8 +3916,9 @@ export const CreateFlowDefinitionBody = zod
   );
 
 /**
- * Retrieves a list of all flow definitions.
+ * Retrieves a list of all flow definitions, newest by creation time first.
 This endpoint can be used to view existing flow definitions and their configurations.
+Filter by `name` to list the revisions of one flow.
 
  * @summary List flow definitions
  */
@@ -3876,6 +3926,7 @@ export const listFlowDefinitionsQueryLimitDefault = 20;
 export const listFlowDefinitionsQueryLimitMax = 100;
 
 export const listFlowDefinitionsQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const listFlowDefinitionsQueryNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
 
 export const ListFlowDefinitionsQueryParams = zod.strictObject({
   limit: zod
@@ -3898,6 +3949,13 @@ export const ListFlowDefinitionsQueryParams = zod.strictObject({
     .enum(["login", "register", "recovery", "profiling", "reauth", "link_account"])
     .optional()
     .describe("Filter flow definitions by purpose (e.g., registration, login)."),
+  name: zod
+    .string()
+    .regex(listFlowDefinitionsQueryNameRegExp)
+    .optional()
+    .describe(
+      "The flow name to filter by. Every revision of a flow shares its\n`name`, so the result is that flow's revisions, newest by creation\ntime first.\n",
+    ),
   expand: zod
     .array(
       zod
@@ -3926,397 +3984,401 @@ export const listFlowDefinitionsResponseFlowDefinitionsItemUserSchemaOneSchemaOn
 
 export const listFlowDefinitionsResponseFlowDefinitionsItemUserSchemaOneSchemaOnePropertiesXAuditDefault = false;
 
-export const ListFlowDefinitionsResponse = zod.object({
-  flow_definitions: zod.array(
-    zod.object({
-      id: zod.string().describe("Unique identifier for the flow definition."),
-      project_id: zod
-        .string()
-        .describe("Identifier of the project this flow definition belongs to."),
-      flow_definition: zod
-        .object({
-          name: zod
-            .string()
-            .regex(listFlowDefinitionsResponseFlowDefinitionsItemFlowDefinitionNameRegExp)
-            .describe(
-              "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
-            ),
-          status: zod
-            .enum(["active", "draft"])
-            .describe(
-              "The lifecycle state of this flow definition. \n\nactive: The flow definition is ready to be used. The flow engine can select it for new flows.\ndraft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.\n\nAllowed transitions:\n- draft -> active: To activate the flow definition.\n- active -> draft: To remove the flow definition from active use immediately.\n",
-            ),
-          user_schema: zod
-            .string()
-            .describe(
-              "Server-assigned identifier of the user schema this flow operates on,\nas returned by `POST \/schemas`. Opaque to the client — the shape is a\nserver implementation detail. Step `fields` reference properties\ndefined in the resolved schema; the engine resolves field types, validation, and\nimplicit outcomes from schema annotations at runtime.\n",
-            ),
-          purposes: zod
-            .record(zod.string(), zod.string())
-            .describe(
-              "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login\/register\nflow) by listing one entry per purpose.\n",
-            ),
-          audience: zod
-            .object({
-              team_ids: zod
-                .array(zod.string())
-                .optional()
-                .describe(
-                  "Restrict to specific teams (organizations). Empty means no team restriction.",
-                ),
-              app_ids: zod
-                .array(zod.string())
-                .optional()
-                .describe("Restrict to specific applications. Empty means no app restriction."),
-            })
-            .optional()
-            .describe(
-              'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
-            ),
-          steps: zod
-            .array(
-              zod
-                .object({
-                  name: zod
-                    .string()
-                    .describe(
-                      "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
-                    ),
-                  fields: zod
-                    .array(zod.string())
-                    .default(
-                      listFlowDefinitionsResponseFlowDefinitionsItemFlowDefinitionStepsItemFieldsDefault,
-                    )
-                    .describe(
-                      "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
-                    ),
-                  actions: zod
-                    .array(
-                      zod
-                        .object({
-                          name: zod
+export const ListFlowDefinitionsResponse = zod
+  .object({
+    flow_definitions: zod.array(
+      zod.object({
+        id: zod.string().describe("Unique identifier for the flow definition."),
+        project_id: zod
+          .string()
+          .describe("Identifier of the project this flow definition belongs to."),
+        flow_definition: zod
+          .object({
+            name: zod
+              .string()
+              .regex(listFlowDefinitionsResponseFlowDefinitionsItemFlowDefinitionNameRegExp)
+              .describe(
+                "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Every revision of a flow shares its\n`name`; publishing a definition under an existing `name` adds a\nrevision to that flow. Renaming is not supported — the `name` is part\nof the public contract another definition may reference. Acts as the\nhuman display label as well; no separate slug.\n",
+              ),
+            status: zod
+              .enum(["active", "draft"])
+              .describe(
+                "The lifecycle state of this flow definition. \n\nactive: The flow definition is ready to be used. The flow engine can select it for new flows.\ndraft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.\n\nAllowed transitions:\n- draft -> active: To activate the flow definition.\n- active -> draft: To remove the flow definition from active use immediately.\n",
+              ),
+            user_schema: zod
+              .string()
+              .describe(
+                "Server-assigned identifier of the user schema this flow operates on,\nas returned by `POST \/schemas`. Opaque to the client — the shape is a\nserver implementation detail. Step `fields` reference properties\ndefined in the resolved schema; the engine resolves field types, validation, and\nimplicit outcomes from schema annotations at runtime.\n",
+              ),
+            purposes: zod
+              .record(zod.string(), zod.string())
+              .describe(
+                "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login\/register\nflow) by listing one entry per purpose.\n",
+              ),
+            audience: zod
+              .object({
+                team_ids: zod
+                  .array(zod.string())
+                  .optional()
+                  .describe(
+                    "Restrict to specific teams (organizations). Empty means no team restriction.",
+                  ),
+                app_ids: zod
+                  .array(zod.string())
+                  .optional()
+                  .describe("Restrict to specific applications. Empty means no app restriction."),
+              })
+              .optional()
+              .describe(
+                'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
+              ),
+            steps: zod
+              .array(
+                zod
+                  .object({
+                    name: zod
+                      .string()
+                      .describe(
+                        "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
+                      ),
+                    fields: zod
+                      .array(zod.string())
+                      .default(
+                        listFlowDefinitionsResponseFlowDefinitionsItemFlowDefinitionStepsItemFieldsDefault,
+                      )
+                      .describe(
+                        "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
+                      ),
+                    actions: zod
+                      .array(
+                        zod
+                          .object({
+                            name: zod
+                              .string()
+                              .describe(
+                                "Action identifier. Sent back in the submit request as `action`.",
+                              ),
+                            kind: zod
+                              .enum(["submit", "passkey", "passkey_register", "navigate", "back"])
+                              .describe(
+                                "Classifies how the engine handles this action:\n- `submit`: collect the step's fields and run validate\/dispatch\/on_success.\n- `passkey`: issue a WebAuthn assertion challenge; the matching transition\n  fires once the returned assertion verifies.\n- `passkey_register`: issue a WebAuthn registration challenge; the matching\n  transition fires once the returned attestation verifies.\n- `navigate`: route through the transition without running the input\n  pipeline. Used for pure-routing actions declared in the flow definition.\n- `back`: return the user to the previous step. Surfaced by the engine\n  when going back is available.\n",
+                              ),
+                            primary: zod
+                              .boolean()
+                              .default(
+                                listFlowDefinitionsResponseFlowDefinitionsItemFlowDefinitionStepsItemActionsItemPrimaryDefault,
+                              )
+                              .describe(
+                                "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
+                              ),
+                            text_key: zod
+                              .string()
+                              .optional()
+                              .describe(
+                                "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
+                              ),
+                          })
+                          .describe(
+                            "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`; the engine resolves the action's\ndeclared `kind` to decide how to handle the submission.\n",
+                          ),
+                      )
+                      .default(
+                        listFlowDefinitionsResponseFlowDefinitionsItemFlowDefinitionStepsItemActionsDefault,
+                      )
+                      .describe(
+                        "Ordered list of actions the user can take. The action name is what the\nfrontend sends back in the submit request. If omitted, the engine\nprovides a default `submit` action.\n",
+                      ),
+                    gates: zod
+                      .record(
+                        zod.string(),
+                        zod
+                          .object({
+                            kind: zod
+                              .enum(["captcha"])
+                              .describe(
+                                "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
+                              ),
+                            provider: zod
+                              .string()
+                              .describe(
+                                "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                              ),
+                            config: zod
+                              .record(zod.string(), zod.unknown())
+                              .optional()
+                              .describe(
+                                "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                              ),
+                          })
+                          .describe(
+                            "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
+                          ),
+                      )
+                      .default(
+                        listFlowDefinitionsResponseFlowDefinitionsItemFlowDefinitionStepsItemGatesDefault,
+                      )
+                      .describe(
+                        'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
+                      ),
+                    sso_providers: zod
+                      .array(
+                        zod
+                          .object({
+                            id: zod.string().describe("Provider instance identifier."),
+                            name: zod.string().describe("Display name for the provider."),
+                            template: zod
+                              .string()
+                              .describe("Template hint for rendering (logo, colors)."),
+                          })
+                          .describe("An available SSO identity provider."),
+                      )
+                      .default(
+                        listFlowDefinitionsResponseFlowDefinitionsItemFlowDefinitionStepsItemSsoProvidersDefault,
+                      )
+                      .describe("Available SSO identity providers for this step."),
+                    on_success: zod
+                      .enum(["create_user"])
+                      .optional()
+                      .describe(
+                        "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
+                      ),
+                    complete: zod
+                      .enum(["redirect", "show"])
+                      .optional()
+                      .describe(
+                        "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
+                      ),
+                    transitions: zod
+                      .record(
+                        zod.string(),
+                        zod.object({
+                          target: zod
                             .string()
                             .describe(
-                              "Action identifier. Sent back in the submit request as `action`.",
-                            ),
-                          kind: zod
-                            .enum(["submit", "passkey", "passkey_register", "navigate", "back"])
-                            .describe(
-                              "Classifies how the engine handles this action:\n- `submit`: collect the step's fields and run validate\/dispatch\/on_success.\n- `passkey`: issue a WebAuthn assertion challenge; the matching transition\n  fires once the returned assertion verifies.\n- `passkey_register`: issue a WebAuthn registration challenge; the matching\n  transition fires once the returned attestation verifies.\n- `navigate`: route through the transition without running the input\n  pipeline. Used for pure-routing actions declared in the flow definition.\n- `back`: return the user to the previous step. Surfaced by the engine\n  when going back is available.\n",
-                            ),
-                          primary: zod
-                            .boolean()
-                            .default(
-                              listFlowDefinitionsResponseFlowDefinitionsItemFlowDefinitionStepsItemActionsItemPrimaryDefault,
-                            )
-                            .describe(
-                              "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
+                              "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
                             ),
-                          text_key: zod
-                            .string()
+                          action: zod
+                            .union([zod.enum(["switch", "pivot"]), zod.null()])
                             .optional()
                             .describe(
-                              "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
-                            ),
-                        })
-                        .describe(
-                          "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`; the engine resolves the action's\ndeclared `kind` to decide how to handle the submission.\n",
-                        ),
-                    )
-                    .default(
-                      listFlowDefinitionsResponseFlowDefinitionsItemFlowDefinitionStepsItemActionsDefault,
-                    )
-                    .describe(
-                      "Ordered list of actions the user can take. The action name is what the\nfrontend sends back in the submit request. If omitted, the engine\nprovides a default `submit` action.\n",
-                    ),
-                  gates: zod
-                    .record(
-                      zod.string(),
-                      zod
-                        .object({
-                          kind: zod
-                            .enum(["captcha"])
-                            .describe(
-                              "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
-                            ),
-                          provider: zod
-                            .string()
-                            .describe(
-                              "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                              "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
                             ),
-                          config: zod
-                            .record(zod.string(), zod.unknown())
+                          purpose: zod
+                            .union([
+                              zod.enum([
+                                "login",
+                                "register",
+                                "recovery",
+                                "profiling",
+                                "reauth",
+                                "link_account",
+                              ]),
+                              zod.null(),
+                            ])
                             .optional()
                             .describe(
-                              "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                              "Local re-purposing. When set, taking this transition changes the\nflow's current purpose to this value — the dispatch mode a step's\nchallenges run under — while the flow's original purpose stays\npinned. Must be a purpose this definition serves, and `target`\nmust be that purpose's entry step. Mutually exclusive with\n`action`: a transition either re-purposes within this flow or\ntargets another flow, never both.\nExample: a \"Sign up\" navigation on the login identifier step\n(`{ target: register, purpose: register }`).\n",
                             ),
-                        })
-                        .describe(
-                          "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
-                        ),
-                    )
-                    .default(
-                      listFlowDefinitionsResponseFlowDefinitionsItemFlowDefinitionStepsItemGatesDefault,
-                    )
-                    .describe(
-                      'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
-                    ),
-                  sso_providers: zod
-                    .array(
-                      zod
-                        .object({
-                          id: zod.string().describe("Provider instance identifier."),
-                          name: zod.string().describe("Display name for the provider."),
-                          template: zod
-                            .string()
-                            .describe("Template hint for rendering (logo, colors)."),
-                        })
-                        .describe("An available SSO identity provider."),
-                    )
-                    .default(
-                      listFlowDefinitionsResponseFlowDefinitionsItemFlowDefinitionStepsItemSsoProvidersDefault,
-                    )
-                    .describe("Available SSO identity providers for this step."),
-                  on_success: zod
-                    .enum(["create_user"])
-                    .optional()
-                    .describe(
-                      "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
-                    ),
-                  complete: zod
-                    .enum(["redirect", "show"])
-                    .optional()
-                    .describe(
-                      "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
-                    ),
-                  transitions: zod
-                    .record(
-                      zod.string(),
-                      zod.object({
-                        target: zod
-                          .string()
-                          .describe(
-                            "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
-                          ),
-                        action: zod
-                          .union([zod.enum(["switch", "pivot"]), zod.null()])
-                          .optional()
-                          .describe(
-                            "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
-                          ),
-                        purpose: zod
-                          .union([
-                            zod.enum([
-                              "login",
-                              "register",
-                              "recovery",
-                              "profiling",
-                              "reauth",
-                              "link_account",
-                            ]),
-                            zod.null(),
-                          ])
-                          .optional()
+                        }),
+                      )
+                      .optional()
+                      .describe(
+                        "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
+                      ),
+                  })
+                  .describe(
+                    "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
+                  ),
+              )
+              .min(1)
+              .describe(
+                "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
+              ),
+          })
+          .describe(
+            "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project\/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST \/flow.\n",
+          ),
+        user_schema: zod
+          .union([
+            zod
+              .object({
+                id: zod
+                  .string()
+                  .describe(
+                    "The resource id: the server-minted `sch_\*` identifier, or the\ncustomer-supplied `$id` URI when the document declared one at creation.\n",
+                  ),
+                schema: zod
+                  .object({
+                    objectType: zod
+                      .string()
+                      .max(
+                        listFlowDefinitionsResponseFlowDefinitionsItemUserSchemaOneSchemaOneObjectTypeMax,
+                      )
+                      .optional()
+                      .describe(
+                        "The type of user this schema describes. This is a customer chosen name.\n",
+                      ),
+                    kind: zod
+                      .literal("user-schema")
+                      .describe("Discriminator value for a user schema create request."),
+                    metaSchema: zod.url().describe("The user Schema version used for this schema."),
+                    "x-auth-methods": zod
+                      .object({
+                        password: zod
+                          .object({
+                            enabled: zod
+                              .boolean()
+                              .describe("Whether the authentication method is enabled or not"),
+                          })
+                          .optional(),
+                        passkey: zod
+                          .object({
+                            enabled: zod
+                              .boolean()
+                              .describe("Whether the authentication method is enabled or not"),
+                          })
+                          .optional(),
+                        magic_link: zod
+                          .object({
+                            enabled: zod
+                              .boolean()
+                              .describe("Whether the authentication method is enabled or not"),
+                          })
+                          .optional(),
+                        sso: zod
+                          .object({
+                            enabled: zod
+                              .boolean()
+                              .describe("Whether the authentication method is enabled or not"),
+                          })
+                          .optional(),
+                        otp: zod
+                          .object({
+                            enabled: zod
+                              .boolean()
+                              .describe("Whether the authentication method is enabled or not"),
+                          })
+                          .optional(),
+                      })
+                      .describe(
+                        "A list of authentication methods supported by the user definition.",
+                      ),
+                    "x-identifier": zod
+                      .string()
+                      .min(1)
+                      .optional()
+                      .describe(
+                        'Path of the leaf property whose value identifies a user (nested leaves\nare addressed by their dot-joined attribute path). The property must\ncarry `x-unique` \"project\". Required when an auth method needing\nidentifier-first dispatch (password) is enabled. Passkey is exempt:\ndiscoverable credentials identify the user through the assertion\nitself, so passkey-only and API-managed schemas may designate nothing;\nflows using identifier-first passkey are validated at the flow level\ninstead.\n',
+                      ),
+                    "x-display": zod
+                      .array(zod.string().min(1))
+                      .min(1)
+                      .optional()
+                      .describe(
+                        "Ordered leaf property paths whose values, joined with a space, render\nthe user's display name.\n",
+                      ),
+                    properties: zod
+                      .record(
+                        zod.string(),
+                        zod
+                          .object({
+                            "x-unique": zod
+                              .union([zod.enum(["unspecified", "project", "team"]), zod.null()])
+                              .optional()
+                              .describe("The level of uniqueness for this property, if applicable"),
+                            "x-claim": zod
+                              .union([zod.string(), zod.null()])
+                              .optional()
+                              .describe("The claim name for this property, if applicable"),
+                            "x-audit": zod
+                              .boolean()
+                              .default(
+                                listFlowDefinitionsResponseFlowDefinitionsItemUserSchemaOneSchemaOnePropertiesXAuditDefault,
+                              )
+                              .describe(
+                                "Whether this property's value may appear in audit event payloads. Audit\npayloads are deny-by-default: a property without this annotation\ncontributes its key but never its value.\n",
+                              ),
+                            properties: zod
+                              .record(zod.string(), zod.unknown())
+                              .optional()
+                              .describe(
+                                "A map of additional properties for the user definition, where the key is\nthe property name and the value is the property schema.\n",
+                              ),
+                          })
                           .describe(
-                            "Local re-purposing. When set, taking this transition changes the\nflow's current purpose to this value — the dispatch mode a step's\nchallenges run under — while the flow's original purpose stays\npinned. Must be a purpose this definition serves, and `target`\nmust be that purpose's entry step. Mutually exclusive with\n`action`: a transition either re-purposes within this flow or\ntargets another flow, never both.\nExample: a \"Sign up\" navigation on the login identifier step\n(`{ target: register, purpose: register }`).\n",
+                            'This schema is missing `\"allOf\": [{\"$ref\": \"https:\/\/json-schema.org\/draft\/2020-12\/schema\"}],`.\nThis is done because a lot of code generators cannot handle that.\n\nNative JSON Schema keywords such as `type`, `format`, `title` and `writeOnly`\nare accepted without being listed below. `writeOnly: true` is reserved for a\nvalue that may be written but is never returned by the read API; nothing\nenforces it today, so responses still include write-only properties.\n',
                           ),
-                      }),
-                    )
-                    .optional()
-                    .describe(
-                      "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
-                    ),
-                })
-                .describe(
-                  "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
-                ),
-            )
-            .min(1)
-            .describe(
-              "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
-            ),
-        })
+                      )
+                      .optional()
+                      .describe(
+                        "A map of additional properties for the user definition, where the\nkey is the property name and the value is the property schema\n",
+                      ),
+                  })
+                  .describe(
+                    'This schema is missing `\"allOf\": [{\"$ref\": \"https:\/\/json-schema.org\/draft\/2020-12\/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n',
+                  )
+                  .describe("The customer-authored JSON Schema document, served verbatim."),
+                metadata: zod.object({
+                  created_at: zod.iso
+                    .datetime({ offset: true })
+                    .describe("The time when the schema was created."),
+                }),
+              })
+              .describe(
+                "A schema resource: the server-owned envelope around a customer-authored\nJSON Schema document.\n\n`schema` is the customer-authored document, served verbatim: its keys and\ncontents are defined entirely by its author. The rest of the object — `id`,\n`metadata` — is the server-owned envelope. Keeping the two apart means the\ndocument may declare any property (including `id` or `metadata`) without\ncolliding with the envelope, and the resource `id` stays distinguishable\nfrom the document's own `$id`.\n",
+              ),
+            zod.null(),
+          ])
+          .optional()
+          .describe(
+            "The user schema this flow operates on: the same object\n`GET \/schemas\/{id}` returns. Present only when the request asked for it\nwith `expand=user_schema`; `null` when it was requested but the\nreferenced schema no longer resolves or the caller may not read it.\n",
+          ),
+        created_at: zod.iso.datetime({ offset: true }),
+        updated_at: zod.iso.datetime({ offset: true }),
+      }),
+    ),
+    next_page_token: zod
+      .union([zod.string(), zod.null()])
+      .optional()
+      .describe(
+        "The token to retrieve the next page of results. Absent if there are no more results.",
+      ),
+  })
+  .describe("List of flow definitions, newest by creation time first.");
+
+/**
+ * Get a flow definition by id
+ * @summary Get a flow definition by id
+ */
+export const GetFlowDefinitionParams = zod.object({
+  id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
+});
+
+export const getFlowDefinitionResponseFlowDefinitionNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
+export const getFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault = [];
+export const getFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault = false;
+export const getFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault = [];
+export const getFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault = {} as const;
+export const getFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault = [];
+export const getFlowDefinitionResponseUserSchemaOneSchemaOneObjectTypeMax = 256;
+
+export const getFlowDefinitionResponseUserSchemaOneSchemaOnePropertiesXAuditDefault = false;
+
+export const GetFlowDefinitionResponse = zod.object({
+  id: zod.string().describe("Unique identifier for the flow definition."),
+  project_id: zod.string().describe("Identifier of the project this flow definition belongs to."),
+  flow_definition: zod
+    .object({
+      name: zod
+        .string()
+        .regex(getFlowDefinitionResponseFlowDefinitionNameRegExp)
+        .describe(
+          "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Every revision of a flow shares its\n`name`; publishing a definition under an existing `name` adds a\nrevision to that flow. Renaming is not supported — the `name` is part\nof the public contract another definition may reference. Acts as the\nhuman display label as well; no separate slug.\n",
+        ),
+      status: zod
+        .enum(["active", "draft"])
         .describe(
-          "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project\/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST \/flow.\n",
-        ),
-      user_schema: zod
-        .union([
-          zod
-            .object({
-              id: zod
-                .string()
-                .describe(
-                  "The resource id: the server-minted `sch_\*` identifier, or the\ncustomer-supplied `$id` URI when the document declared one at creation.\n",
-                ),
-              schema: zod
-                .object({
-                  objectType: zod
-                    .string()
-                    .max(
-                      listFlowDefinitionsResponseFlowDefinitionsItemUserSchemaOneSchemaOneObjectTypeMax,
-                    )
-                    .optional()
-                    .describe(
-                      "The type of user this schema describes. This is a customer chosen name.\n",
-                    ),
-                  kind: zod
-                    .literal("user-schema")
-                    .describe("Discriminator value for a user schema create request."),
-                  metaSchema: zod.url().describe("The user Schema version used for this schema."),
-                  "x-auth-methods": zod
-                    .object({
-                      password: zod
-                        .object({
-                          enabled: zod
-                            .boolean()
-                            .describe("Whether the authentication method is enabled or not"),
-                        })
-                        .optional(),
-                      passkey: zod
-                        .object({
-                          enabled: zod
-                            .boolean()
-                            .describe("Whether the authentication method is enabled or not"),
-                        })
-                        .optional(),
-                      magic_link: zod
-                        .object({
-                          enabled: zod
-                            .boolean()
-                            .describe("Whether the authentication method is enabled or not"),
-                        })
-                        .optional(),
-                      sso: zod
-                        .object({
-                          enabled: zod
-                            .boolean()
-                            .describe("Whether the authentication method is enabled or not"),
-                        })
-                        .optional(),
-                      otp: zod
-                        .object({
-                          enabled: zod
-                            .boolean()
-                            .describe("Whether the authentication method is enabled or not"),
-                        })
-                        .optional(),
-                    })
-                    .describe("A list of authentication methods supported by the user definition."),
-                  "x-identifier": zod
-                    .string()
-                    .min(1)
-                    .optional()
-                    .describe(
-                      'Path of the leaf property whose value identifies a user (nested leaves\nare addressed by their dot-joined attribute path). The property must\ncarry `x-unique` \"project\". Required when an auth method needing\nidentifier-first dispatch (password) is enabled. Passkey is exempt:\ndiscoverable credentials identify the user through the assertion\nitself, so passkey-only and API-managed schemas may designate nothing;\nflows using identifier-first passkey are validated at the flow level\ninstead.\n',
-                    ),
-                  "x-display": zod
-                    .array(zod.string().min(1))
-                    .min(1)
-                    .optional()
-                    .describe(
-                      "Ordered leaf property paths whose values, joined with a space, render\nthe user's display name.\n",
-                    ),
-                  properties: zod
-                    .record(
-                      zod.string(),
-                      zod
-                        .object({
-                          "x-unique": zod
-                            .union([zod.enum(["unspecified", "project", "team"]), zod.null()])
-                            .optional()
-                            .describe("The level of uniqueness for this property, if applicable"),
-                          "x-claim": zod
-                            .union([zod.string(), zod.null()])
-                            .optional()
-                            .describe("The claim name for this property, if applicable"),
-                          "x-audit": zod
-                            .boolean()
-                            .default(
-                              listFlowDefinitionsResponseFlowDefinitionsItemUserSchemaOneSchemaOnePropertiesXAuditDefault,
-                            )
-                            .describe(
-                              "Whether this property's value may appear in audit event payloads. Audit\npayloads are deny-by-default: a property without this annotation\ncontributes its key but never its value.\n",
-                            ),
-                          properties: zod
-                            .record(zod.string(), zod.unknown())
-                            .optional()
-                            .describe(
-                              "A map of additional properties for the user definition, where the key is\nthe property name and the value is the property schema.\n",
-                            ),
-                        })
-                        .describe(
-                          'This schema is missing `\"allOf\": [{\"$ref\": \"https:\/\/json-schema.org\/draft\/2020-12\/schema\"}],`.\nThis is done because a lot of code generators cannot handle that.\n\nNative JSON Schema keywords such as `type`, `format`, `title` and `writeOnly`\nare accepted without being listed below. `writeOnly: true` is reserved for a\nvalue that may be written but is never returned by the read API; nothing\nenforces it today, so responses still include write-only properties.\n',
-                        ),
-                    )
-                    .optional()
-                    .describe(
-                      "A map of additional properties for the user definition, where the\nkey is the property name and the value is the property schema\n",
-                    ),
-                })
-                .describe(
-                  'This schema is missing `\"allOf\": [{\"$ref\": \"https:\/\/json-schema.org\/draft\/2020-12\/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n',
-                )
-                .describe("The customer-authored JSON Schema document, served verbatim."),
-              metadata: zod.object({
-                created_at: zod.iso
-                  .datetime({ offset: true })
-                  .describe("The time when the schema was created."),
-              }),
-            })
-            .describe(
-              "A schema resource: the server-owned envelope around a customer-authored\nJSON Schema document.\n\n`schema` is the customer-authored document, served verbatim: its keys and\ncontents are defined entirely by its author. The rest of the object — `id`,\n`metadata` — is the server-owned envelope. Keeping the two apart means the\ndocument may declare any property (including `id` or `metadata`) without\ncolliding with the envelope, and the resource `id` stays distinguishable\nfrom the document's own `$id`.\n",
-            ),
-          zod.null(),
-        ])
-        .optional()
-        .describe(
-          "The user schema this flow operates on: the same object\n`GET \/schemas\/{id}` returns. Present only when the request asked for it\nwith `expand=user_schema`; `null` when it was requested but the\nreferenced schema no longer resolves or the caller may not read it.\n",
-        ),
-      created_at: zod.iso.datetime({ offset: true }),
-      updated_at: zod.iso.datetime({ offset: true }),
-    }),
-  ),
-  next_page_token: zod
-    .union([zod.string(), zod.null()])
-    .optional()
-    .describe(
-      "The token to retrieve the next page of results. Absent if there are no more results.",
-    ),
-});
-
-/**
- * Get a flow definition by id
- * @summary Get a flow definition by id
- */
-export const GetFlowDefinitionParams = zod.object({
-  id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
-});
-
-export const getFlowDefinitionResponseFlowDefinitionNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
-export const getFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault = [];
-export const getFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault = false;
-export const getFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault = [];
-export const getFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault = {} as const;
-export const getFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault = [];
-export const getFlowDefinitionResponseUserSchemaOneSchemaOneObjectTypeMax = 256;
-
-export const getFlowDefinitionResponseUserSchemaOneSchemaOnePropertiesXAuditDefault = false;
-
-export const GetFlowDefinitionResponse = zod.object({
-  id: zod.string().describe("Unique identifier for the flow definition."),
-  project_id: zod.string().describe("Identifier of the project this flow definition belongs to."),
-  flow_definition: zod
-    .object({
-      name: zod
-        .string()
-        .regex(getFlowDefinitionResponseFlowDefinitionNameRegExp)
-        .describe(
-          "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
-        ),
-      status: zod
-        .enum(["active", "draft"])
-        .describe(
-          "The lifecycle state of this flow definition. \n\nactive: The flow definition is ready to be used. The flow engine can select it for new flows.\ndraft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.\n\nAllowed transitions:\n- draft -> active: To activate the flow definition.\n- active -> draft: To remove the flow definition from active use immediately.\n",
+          "The lifecycle state of this flow definition. \n\nactive: The flow definition is ready to be used. The flow engine can select it for new flows.\ndraft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.\n\nAllowed transitions:\n- draft -> active: To activate the flow definition.\n- active -> draft: To remove the flow definition from active use immediately.\n",
         ),
       user_schema: zod
         .string()
@@ -4669,7 +4731,7 @@ export const UpdateFlowDefinitionBody = zod
           .string()
           .regex(updateFlowDefinitionBodyFlowDefinitionNameRegExp)
           .describe(
-            "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
+            "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Every revision of a flow shares its\n`name`; publishing a definition under an existing `name` adds a\nrevision to that flow. Renaming is not supported — the `name` is part\nof the public contract another definition may reference. Acts as the\nhuman display label as well; no separate slug.\n",
           ),
         status: zod
           .enum(["active", "draft"])
@@ -4885,7 +4947,7 @@ export const UpdateFlowDefinitionResponse = zod.object({
         .string()
         .regex(updateFlowDefinitionResponseFlowDefinitionNameRegExp)
         .describe(
-          "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
+          "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Every revision of a flow shares its\n`name`; publishing a definition under an existing `name` adds a\nrevision to that flow. Renaming is not supported — the `name` is part\nof the public contract another definition may reference. Acts as the\nhuman display label as well; no separate slug.\n",
         ),
       status: zod
         .enum(["active", "draft"])
@@ -6121,6 +6183,321 @@ export const CreateGrantBody = zod.object({
     ),
 });
 
+/**
+ * Returns the collaboration grants of a project, paginated with a cursor.
+Only unrevoked grants this API manages are listed (user or team bound to
+viewer, editor, or admin), including expired grants so a client can
+DELETE before re-granting. Project-secret setup (`sk_proj`) and
+owning-team (`relation=team`) rows are not returned. Grants are not in
+`resource_scope_index`; project scope is required on the query (same as
+get). Requires `project.read`. `expand: ["principal"]` additionally
+requires `user.read` and `team.read` (documented on the expand enum;
+those scopes cannot be ANDed onto this security block because they are
+body-conditional).
+
+ * @summary Query grants
+ */
+export const queryGrantsQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const QueryGrantsQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(queryGrantsQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+export const queryGrantsBodyLimitDefault = 20;
+export const queryGrantsBodyLimitMax = 100;
+
+export const QueryGrantsBody = zod
+  .object({
+    limit: zod.number().min(1).max(queryGrantsBodyLimitMax).default(queryGrantsBodyLimitDefault),
+    page_token: zod
+      .union([zod.string(), zod.null()])
+      .optional()
+      .describe(
+        "Token to retrieve the next page of results. Must be sent with the same\n`sorting` as the request that issued the token. Omitting `sorting` reuses\nthe default sort and only succeeds when that default matches the token.\n",
+      ),
+    expand: zod
+      .array(
+        zod
+          .enum(["principal"])
+          .describe(
+            "A related object to embed on each returned grant (ADR 059).\n\n- `principal`: the principal named by `principal_id`, as `principal` on\n  each grant. The property is omitted entirely when not requested. When\n  requested, it is the same body `GET \/users\/{id}` serves for\n  `principal_type=user`, or `GET \/teams\/{id}` for `principal_type=team`,\n  and `null` when that principal cannot be loaded. Discriminate with the\n  grant's existing `principal_type`.\n\n  Requires `user.read` and `team.read` in addition to `project.read`.\n  Both are checked on the whole request before the list, because a mixed\n  page is the common case. A caller who may not read either resource\n  receives 403 rather than a silently missing `principal`.\n",
+          ),
+      )
+      .optional()
+      .describe(
+        "Related objects to embed on each grant (ADR 059). Omit it and no\nembedded object is returned. An unrecognised value is rejected.\n",
+      ),
+    sorting: zod
+      .object({
+        field: zod
+          .enum(["created_at", "expires_at", "id"])
+          .describe(
+            "Field to sort grants by. Default is `created_at` ascending with `id` as\nthe tiebreaker.\n",
+          ),
+        direction: zod.enum(["asc", "desc"]),
+      })
+      .optional(),
+    filter: zod
+      .array(
+        zod.object({
+          field: zod
+            .enum(["created_at", "principal_type", "principal_id", "relation", "expires_at"])
+            .describe(
+              "Field to filter grants by:\n- `created_at`: RFC3339 timestamp\n- `principal_type`: `user` or `team`\n- `principal_id`: principal id (`user_<opaque>` or `team_<opaque>`)\n- `relation`: `viewer`, `editor`, or `admin`\n- `expires_at`: RFC3339 timestamp (null when the grant does not expire)\n",
+            ),
+          value: zod
+            .union([zod.string(), zod.number(), zod.boolean(), zod.null()])
+            .optional()
+            .describe(
+              "Filter-value specifies which values can be filtered by a query endpoint. This\nis a union of types. When a value is specified which is not assignable to the\nfield which is being filtered, a 400 error will be returned.\n",
+            ),
+          operation: zod
+            .enum([
+              "equals",
+              "not_equals",
+              "contains",
+              "not_contains",
+              "less_than",
+              "less_than_or_equal",
+              "greater_than",
+              "greater_than_or_equal",
+            ])
+            .describe(
+              "Filter operation defines the operations which can be used when filtering on a\nquery endpoint.\n\nOn text fields, `contains` is a case-insensitive substring match. `equals`\ncompares the whole value and is case-sensitive unless the field documents\notherwise.\n",
+            ),
+        }),
+      )
+      .optional()
+      .describe("Filter criteria for querying grants. Combined with AND."),
+  })
+  .describe("Request to query the grants of a project.");
+
+export const queryGrantsResponseGrantsItemUserUserIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+export const queryGrantsResponseGrantsItemPrincipalOneOneOneIdRegExp = new RegExp(
+  "^user_[a-zA-Z0-9_-]+$",
+);
+
+export const QueryGrantsResponse = zod
+  .object({
+    grants: zod.array(
+      zod
+        .object({
+          id: zod.string().describe("Managed assignment id (`asgn_<opaque>`)."),
+          project_id: zod.string().describe("Project this grant is scoped to."),
+          principal_type: zod
+            .enum(["user", "team"])
+            .describe("Kind of principal bound by this grant."),
+          principal_id: zod.string().describe("Principal id (`user_<opaque>` or `team_<opaque>`)."),
+          object_type: zod
+            .enum(["project"])
+            .describe("Catalog object type. Always `project` for this API."),
+          relation: zod
+            .enum(["viewer", "editor", "admin"])
+            .describe("Catalog relation on the project."),
+          created_at: zod.iso.datetime({ offset: true }).describe("When the grant was created."),
+          expires_at: zod
+            .union([zod.iso.datetime({ offset: true }), zod.null()])
+            .optional()
+            .describe(
+              "When the grant expires. Null when it does not expire. GET still\nreturns expired unrevoked grants; authorization ignores them.\n",
+            ),
+          user: zod
+            .object({
+              user_id: zod.string().regex(queryGrantsResponseGrantsItemUserUserIdRegExp),
+              identifier: zod
+                .string()
+                .optional()
+                .describe(
+                  "The current value of the schema's designated identifier\n(`x-identifier`). Absent when the schema designates no identifier or\nthe user carries no value for it.\n",
+                ),
+              identifier_property: zod
+                .string()
+                .optional()
+                .describe(
+                  "The schema property `identifier` came from, so clients can reach the\nproperty's schema for semantics (a mailto link, a field label)\ninstead of guessing from the value. Present exactly when\n`identifier` is.\n",
+                ),
+              display: zod
+                .string()
+                .optional()
+                .describe(
+                  "The `x-display` rendering — the designated properties' values joined\nin list order. Purely presentational, with no source attribution.\nAbsent when the schema designates no display properties or the user\ncarries no values for them.\n",
+                ),
+            })
+            .optional()
+            .describe(
+              "A resolved reference to a user (ADR 058 §3). Fields are role-named, not\nproperty-named, so responses can mix users from different schemas.\n`identifier` and `display` are resolved independently from the user\nschema's `x-identifier` and `x-display` designations, live at read time.\nClients render `display`, falling back to `identifier`, then `user_id`.\nMissing or deleted users degrade to `user_id` only.\n",
+            ),
+          team: zod
+            .object({
+              team_id: zod
+                .string()
+                .describe("The referenced team's id (`team_<opaque>`). Always present."),
+              name: zod
+                .string()
+                .optional()
+                .describe("The team's name. Absent when the team can no longer be loaded."),
+            })
+            .optional()
+            .describe(
+              "A resolved reference to a team. Carries the team's id and name so a grant\nlist is readable without embedding the full Team body. Id and display ride\n`project.read` (ADR 059 rule 8): a reference field carrying only the\ntarget's id and display strings needs no gate of its own. Missing or\ndeleted teams degrade to `team_id` only.\n",
+            ),
+          principal: zod
+            .union([
+              zod
+                .union([
+                  zod
+                    .object({
+                      id: zod
+                        .string()
+                        .regex(queryGrantsResponseGrantsItemPrincipalOneOneOneIdRegExp),
+                      schema: zod
+                        .string()
+                        .describe(
+                          "The schema that defines the content of `attributes`. These schemas can be\ncreated using the `\/schemas` endpoint. A default schema is provided.\nThis schema can be retrieved using the same endpoint.\n",
+                        ),
+                      attributes: zod
+                        .record(zod.string(), zod.unknown())
+                        .describe(
+                          "The user's content, satisfying the schema named by `schema`. Property\nnames and types are determined entirely by that schema.\n",
+                        ),
+                      metadata: zod.object({
+                        created_at: zod.iso
+                          .datetime({ offset: true })
+                          .describe("The time when the user was created."),
+                        updated_at: zod.iso
+                          .datetime({ offset: true })
+                          .describe("The time when the user was last updated."),
+                        status: zod
+                          .enum(["active", "suspended", "deactivated", "pending_purge"])
+                          .describe("The status of the user."),
+                        lifecycle_owner_team_id: zod
+                          .union([zod.string(), zod.null()])
+                          .optional()
+                          .describe(
+                            "The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team memberships: it decides who may deprovision the user, not\nwhich teams the user collaborates in. Memberships are their own paginated\nresource — `GET \/users\/{user_id}\/teams`.\n",
+                          ),
+                        lifecycle_owner_team: zod
+                          .union([
+                            zod
+                              .object({
+                                id: zod.string().describe("The unique identifier of the team."),
+                                name: zod.string().describe("The name of the team."),
+                                status: zod
+                                  .enum(["active", "deactivated"])
+                                  .describe(
+                                    "The lifecycle state of a team.\n\nactive: The team is available for use.\ndeactivated: The team is no longer active but is retained for historical and audit purposes.\n",
+                                  ),
+                                created_at: zod.iso
+                                  .datetime({ offset: true })
+                                  .describe("The time when the team was created."),
+                                updated_at: zod.iso
+                                  .datetime({ offset: true })
+                                  .describe("The time when the team was last updated."),
+                              })
+                              .describe("Details of a team."),
+                            zod.null(),
+                          ])
+                          .optional()
+                          .describe(
+                            'The team named by `lifecycle_owner_team_id`, present only when the\nrequest asked for it with `expand: [\"lifecycle_owner_team\"]` (ADR 059).\nAbsent means it was not requested; `null` means the user is self-owned\nand there is no owner to resolve.\n\nRequesting it does not guarantee it is present on every user. Today\n`team.read` is checked once for the whole request, so it is; once that\ncheck is per team, a page may contain a user whose owner the caller may\nnot read, and such a row answers with neither the team nor `null` —\n`null` already means self-owned. What it answers with instead is decided\nwith the granular scopes (#420); do not read the two cases above as the\ncomplete set.\n\nThis is the same representation `GET \/teams\/{team_id}` serves. It is a\nsingle team, not a collection, so it carries no cap and no truncation\nflag.\n',
+                          ),
+                      }),
+                      identifier: zod
+                        .string()
+                        .optional()
+                        .describe(
+                          "The current value of the user schema's designated identifier\n(`x-identifier`), resolved live at read time. Absent when the schema\ndesignates no identifier or the user carries no value for it.\n",
+                        ),
+                      identifier_property: zod
+                        .string()
+                        .optional()
+                        .describe(
+                          "The schema property `identifier` came from, so clients can reach the\nproperty's schema for semantics (a mailto link, a field label)\ninstead of guessing from the value. Present exactly when\n`identifier` is.\n",
+                        ),
+                      display: zod
+                        .string()
+                        .optional()
+                        .describe(
+                          "The `x-display` rendering — the designated properties' values joined\nin list order, resolved live at read time. Purely presentational.\nAbsent when the schema designates no display properties or the user\ncarries no values for them. Clients render `display`, falling back\nto `identifier`, then `id`.\n",
+                        ),
+                      teams: zod
+                        .array(
+                          zod
+                            .object({
+                              id: zod.string().describe("The unique identifier of the team."),
+                              name: zod.string().describe("The name of the team."),
+                              membership_status: zod
+                                .enum(["pending", "active", "inactive"])
+                                .describe(
+                                  "The user's participation state on this team. Memberships the user was\nremoved from are not returned.\n",
+                                ),
+                              created_at: zod.iso
+                                .datetime({ offset: true })
+                                .describe("The time when the user joined this team."),
+                              updated_at: zod.iso
+                                .datetime({ offset: true })
+                                .describe("The time when this membership was last changed."),
+                            })
+                            .describe(
+                              "One entry of a user's team roster: a team the user belongs to, with the\nmembership's participation state. The team's `name` travels with the entry, so\na page renders without a follow-up `POST \/teams\/query` per row.\n\nRoster membership is not lifecycle ownership. A user can belong to many teams\nwhile still owning their own lifecycle — that single owning team is reported\nas `metadata.lifecycle_owner_team_id` on the user itself.\n",
+                            ),
+                        )
+                        .optional()
+                        .describe(
+                          'The user\'s team memberships, present only when the request asked for them with\n`expand: [\"teams\"]` (ADR 059). Absent means it was not requested; `[]`\nmeans the user has none.\n\nDeliberately outside `metadata`: memberships are a related collection, not\npart of the server-owned envelope, and it is a different concept from\n`metadata.lifecycle_owner_team_id` (ADR 024).\n',
+                        ),
+                      teams_truncated: zod
+                        .boolean()
+                        .optional()
+                        .describe(
+                          "True when the user is on more teams than the embedded list carries. The\nembedded list is capped and cannot be paged; read them all at\n`GET \/users\/{user_id}\/teams`. Present only alongside `teams`.\n",
+                        ),
+                    })
+                    .describe(
+                      "A user represents an individual identity in the system. It can be used to\nrepresent a human user, but also a service account or any other type of\nidentity.\n\n`attributes` is the document that satisfies the user schema named by\n`schema`: its property names and types are defined entirely by that schema,\nand it is what the schema validates. The rest of the object — `id`,\n`schema`, `metadata` — is the server-owned envelope. Keeping the two apart\nmeans a schema may name a property `id` or `metadata` without colliding with\nthe envelope, and closed-world keywords (`additionalProperties: false`,\n`propertyNames`, `unevaluatedProperties`) behave as their author expects.\n",
+                    ),
+                  zod
+                    .object({
+                      id: zod.string().describe("The unique identifier of the team."),
+                      name: zod.string().describe("The name of the team."),
+                      status: zod
+                        .enum(["active", "deactivated"])
+                        .describe(
+                          "The lifecycle state of a team.\n\nactive: The team is available for use.\ndeactivated: The team is no longer active but is retained for historical and audit purposes.\n",
+                        ),
+                      created_at: zod.iso
+                        .datetime({ offset: true })
+                        .describe("The time when the team was created."),
+                      updated_at: zod.iso
+                        .datetime({ offset: true })
+                        .describe("The time when the team was last updated."),
+                    })
+                    .describe("Details of a team."),
+                ])
+                .describe(
+                  "The principal bound by a grant: the User body when `principal_type` is\n`user`, or the Team body when `principal_type` is `team`. Same\nrepresentation as `GET \/users\/{id}` and `GET \/teams\/{id}` respectively.\nClients discriminate with the grant's existing `principal_type`.\n",
+                ),
+              zod.null(),
+            ])
+            .optional()
+            .describe(
+              'The principal named by `principal_id`, present only when the request\nasked for it with `expand: [\"principal\"]` (ADR 059). Absent means it\nwas not requested; `null` means the principal cannot be loaded\n(deleted or missing). GET and create never set this field.\n\nWhen present, the body is the same representation `GET \/users\/{id}`\nserves for `principal_type=user`, or `GET \/teams\/{id}` for\n`principal_type=team`. Discriminate with the grant\'s existing\n`principal_type`.\n\nRequires `user.read` and `team.read` in addition to `project.read`.\nBoth are checked on the whole request before the list.\n',
+            ),
+        })
+        .describe("A collaboration grant binding a principal to a project relation."),
+    ),
+    next_page_token: zod
+      .union([zod.string(), zod.null()])
+      .optional()
+      .describe(
+        "Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results. The follow-up request must repeat the\nsame `sorting` that produced this token (omit only when both pages use the default).\n",
+      ),
+  })
+  .describe("Paginated list of grants.");
+
 /**
  * Loads a grant by `(project_id, id)` that this API manages (user or team
 bound to viewer, editor, or admin) and that has not been revoked.
@@ -6146,6 +6523,9 @@ export const GetGrantQueryParams = zod.strictObject({
     .describe("The unique identifier of the project"),
 });
 
+export const getGrantResponseUserUserIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+export const getGrantResponsePrincipalOneOneOneIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+
 export const GetGrantResponse = zod
   .object({
     id: zod.string().describe("Managed assignment id (`asgn_<opaque>`)."),
@@ -6161,7 +6541,187 @@ export const GetGrantResponse = zod
       .union([zod.iso.datetime({ offset: true }), zod.null()])
       .optional()
       .describe(
-        "When the grant expires. Null when it does not expire. GET still\nreturns expired unrevoked grants; authorization ignores them.\n",
+        "When the grant expires. Null when it does not expire. GET still\nreturns expired unrevoked grants; authorization ignores them.\n",
+      ),
+    user: zod
+      .object({
+        user_id: zod.string().regex(getGrantResponseUserUserIdRegExp),
+        identifier: zod
+          .string()
+          .optional()
+          .describe(
+            "The current value of the schema's designated identifier\n(`x-identifier`). Absent when the schema designates no identifier or\nthe user carries no value for it.\n",
+          ),
+        identifier_property: zod
+          .string()
+          .optional()
+          .describe(
+            "The schema property `identifier` came from, so clients can reach the\nproperty's schema for semantics (a mailto link, a field label)\ninstead of guessing from the value. Present exactly when\n`identifier` is.\n",
+          ),
+        display: zod
+          .string()
+          .optional()
+          .describe(
+            "The `x-display` rendering — the designated properties' values joined\nin list order. Purely presentational, with no source attribution.\nAbsent when the schema designates no display properties or the user\ncarries no values for them.\n",
+          ),
+      })
+      .optional()
+      .describe(
+        "A resolved reference to a user (ADR 058 §3). Fields are role-named, not\nproperty-named, so responses can mix users from different schemas.\n`identifier` and `display` are resolved independently from the user\nschema's `x-identifier` and `x-display` designations, live at read time.\nClients render `display`, falling back to `identifier`, then `user_id`.\nMissing or deleted users degrade to `user_id` only.\n",
+      ),
+    team: zod
+      .object({
+        team_id: zod
+          .string()
+          .describe("The referenced team's id (`team_<opaque>`). Always present."),
+        name: zod
+          .string()
+          .optional()
+          .describe("The team's name. Absent when the team can no longer be loaded."),
+      })
+      .optional()
+      .describe(
+        "A resolved reference to a team. Carries the team's id and name so a grant\nlist is readable without embedding the full Team body. Id and display ride\n`project.read` (ADR 059 rule 8): a reference field carrying only the\ntarget's id and display strings needs no gate of its own. Missing or\ndeleted teams degrade to `team_id` only.\n",
+      ),
+    principal: zod
+      .union([
+        zod
+          .union([
+            zod
+              .object({
+                id: zod.string().regex(getGrantResponsePrincipalOneOneOneIdRegExp),
+                schema: zod
+                  .string()
+                  .describe(
+                    "The schema that defines the content of `attributes`. These schemas can be\ncreated using the `\/schemas` endpoint. A default schema is provided.\nThis schema can be retrieved using the same endpoint.\n",
+                  ),
+                attributes: zod
+                  .record(zod.string(), zod.unknown())
+                  .describe(
+                    "The user's content, satisfying the schema named by `schema`. Property\nnames and types are determined entirely by that schema.\n",
+                  ),
+                metadata: zod.object({
+                  created_at: zod.iso
+                    .datetime({ offset: true })
+                    .describe("The time when the user was created."),
+                  updated_at: zod.iso
+                    .datetime({ offset: true })
+                    .describe("The time when the user was last updated."),
+                  status: zod
+                    .enum(["active", "suspended", "deactivated", "pending_purge"])
+                    .describe("The status of the user."),
+                  lifecycle_owner_team_id: zod
+                    .union([zod.string(), zod.null()])
+                    .optional()
+                    .describe(
+                      "The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team memberships: it decides who may deprovision the user, not\nwhich teams the user collaborates in. Memberships are their own paginated\nresource — `GET \/users\/{user_id}\/teams`.\n",
+                    ),
+                  lifecycle_owner_team: zod
+                    .union([
+                      zod
+                        .object({
+                          id: zod.string().describe("The unique identifier of the team."),
+                          name: zod.string().describe("The name of the team."),
+                          status: zod
+                            .enum(["active", "deactivated"])
+                            .describe(
+                              "The lifecycle state of a team.\n\nactive: The team is available for use.\ndeactivated: The team is no longer active but is retained for historical and audit purposes.\n",
+                            ),
+                          created_at: zod.iso
+                            .datetime({ offset: true })
+                            .describe("The time when the team was created."),
+                          updated_at: zod.iso
+                            .datetime({ offset: true })
+                            .describe("The time when the team was last updated."),
+                        })
+                        .describe("Details of a team."),
+                      zod.null(),
+                    ])
+                    .optional()
+                    .describe(
+                      'The team named by `lifecycle_owner_team_id`, present only when the\nrequest asked for it with `expand: [\"lifecycle_owner_team\"]` (ADR 059).\nAbsent means it was not requested; `null` means the user is self-owned\nand there is no owner to resolve.\n\nRequesting it does not guarantee it is present on every user. Today\n`team.read` is checked once for the whole request, so it is; once that\ncheck is per team, a page may contain a user whose owner the caller may\nnot read, and such a row answers with neither the team nor `null` —\n`null` already means self-owned. What it answers with instead is decided\nwith the granular scopes (#420); do not read the two cases above as the\ncomplete set.\n\nThis is the same representation `GET \/teams\/{team_id}` serves. It is a\nsingle team, not a collection, so it carries no cap and no truncation\nflag.\n',
+                    ),
+                }),
+                identifier: zod
+                  .string()
+                  .optional()
+                  .describe(
+                    "The current value of the user schema's designated identifier\n(`x-identifier`), resolved live at read time. Absent when the schema\ndesignates no identifier or the user carries no value for it.\n",
+                  ),
+                identifier_property: zod
+                  .string()
+                  .optional()
+                  .describe(
+                    "The schema property `identifier` came from, so clients can reach the\nproperty's schema for semantics (a mailto link, a field label)\ninstead of guessing from the value. Present exactly when\n`identifier` is.\n",
+                  ),
+                display: zod
+                  .string()
+                  .optional()
+                  .describe(
+                    "The `x-display` rendering — the designated properties' values joined\nin list order, resolved live at read time. Purely presentational.\nAbsent when the schema designates no display properties or the user\ncarries no values for them. Clients render `display`, falling back\nto `identifier`, then `id`.\n",
+                  ),
+                teams: zod
+                  .array(
+                    zod
+                      .object({
+                        id: zod.string().describe("The unique identifier of the team."),
+                        name: zod.string().describe("The name of the team."),
+                        membership_status: zod
+                          .enum(["pending", "active", "inactive"])
+                          .describe(
+                            "The user's participation state on this team. Memberships the user was\nremoved from are not returned.\n",
+                          ),
+                        created_at: zod.iso
+                          .datetime({ offset: true })
+                          .describe("The time when the user joined this team."),
+                        updated_at: zod.iso
+                          .datetime({ offset: true })
+                          .describe("The time when this membership was last changed."),
+                      })
+                      .describe(
+                        "One entry of a user's team roster: a team the user belongs to, with the\nmembership's participation state. The team's `name` travels with the entry, so\na page renders without a follow-up `POST \/teams\/query` per row.\n\nRoster membership is not lifecycle ownership. A user can belong to many teams\nwhile still owning their own lifecycle — that single owning team is reported\nas `metadata.lifecycle_owner_team_id` on the user itself.\n",
+                      ),
+                  )
+                  .optional()
+                  .describe(
+                    'The user\'s team memberships, present only when the request asked for them with\n`expand: [\"teams\"]` (ADR 059). Absent means it was not requested; `[]`\nmeans the user has none.\n\nDeliberately outside `metadata`: memberships are a related collection, not\npart of the server-owned envelope, and it is a different concept from\n`metadata.lifecycle_owner_team_id` (ADR 024).\n',
+                  ),
+                teams_truncated: zod
+                  .boolean()
+                  .optional()
+                  .describe(
+                    "True when the user is on more teams than the embedded list carries. The\nembedded list is capped and cannot be paged; read them all at\n`GET \/users\/{user_id}\/teams`. Present only alongside `teams`.\n",
+                  ),
+              })
+              .describe(
+                "A user represents an individual identity in the system. It can be used to\nrepresent a human user, but also a service account or any other type of\nidentity.\n\n`attributes` is the document that satisfies the user schema named by\n`schema`: its property names and types are defined entirely by that schema,\nand it is what the schema validates. The rest of the object — `id`,\n`schema`, `metadata` — is the server-owned envelope. Keeping the two apart\nmeans a schema may name a property `id` or `metadata` without colliding with\nthe envelope, and closed-world keywords (`additionalProperties: false`,\n`propertyNames`, `unevaluatedProperties`) behave as their author expects.\n",
+              ),
+            zod
+              .object({
+                id: zod.string().describe("The unique identifier of the team."),
+                name: zod.string().describe("The name of the team."),
+                status: zod
+                  .enum(["active", "deactivated"])
+                  .describe(
+                    "The lifecycle state of a team.\n\nactive: The team is available for use.\ndeactivated: The team is no longer active but is retained for historical and audit purposes.\n",
+                  ),
+                created_at: zod.iso
+                  .datetime({ offset: true })
+                  .describe("The time when the team was created."),
+                updated_at: zod.iso
+                  .datetime({ offset: true })
+                  .describe("The time when the team was last updated."),
+              })
+              .describe("Details of a team."),
+          ])
+          .describe(
+            "The principal bound by a grant: the User body when `principal_type` is\n`user`, or the Team body when `principal_type` is `team`. Same\nrepresentation as `GET \/users\/{id}` and `GET \/teams\/{id}` respectively.\nClients discriminate with the grant's existing `principal_type`.\n",
+          ),
+        zod.null(),
+      ])
+      .optional()
+      .describe(
+        'The principal named by `principal_id`, present only when the request\nasked for it with `expand: [\"principal\"]` (ADR 059). Absent means it\nwas not requested; `null` means the principal cannot be loaded\n(deleted or missing). GET and create never set this field.\n\nWhen present, the body is the same representation `GET \/users\/{id}`\nserves for `principal_type=user`, or `GET \/teams\/{id}` for\n`principal_type=team`. Discriminate with the grant\'s existing\n`principal_type`.\n\nRequires `user.read` and `team.read` in addition to `project.read`.\nBoth are checked on the whole request before the list.\n',
       ),
   })
   .describe("A collaboration grant binding a principal to a project relation.");
@@ -6276,12 +6836,12 @@ export const listEventsResponseDataItemOnesixOneProjectIdRegExp = new RegExp("^[
 export const listEventsResponseDataItemOnesevenOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const listEventsResponseDataItemOneeightOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const listEventsResponseDataItemOnenineOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
-export const listEventsResponseDataItemOnenineTwoPayloadStatusMin = 100;
-export const listEventsResponseDataItemOnenineTwoPayloadStatusMax = 599;
+export const listEventsResponseDataItemTwozeroOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const listEventsResponseDataItemTwozeroTwoPayloadStatusMin = 100;
+export const listEventsResponseDataItemTwozeroTwoPayloadStatusMax = 599;
 
-export const listEventsResponseDataItemOnenineTwoPayloadDurationMsMin = 0;
+export const listEventsResponseDataItemTwozeroTwoPayloadDurationMsMin = 0;
 
-export const listEventsResponseDataItemTwozeroOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const listEventsResponseDataItemTwooneOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const listEventsResponseDataItemTwotwoOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const listEventsResponseDataItemTwothreeOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
@@ -6290,6 +6850,7 @@ export const listEventsResponseDataItemTwofiveOneProjectIdRegExp = new RegExp("^
 export const listEventsResponseDataItemTwosixOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const listEventsResponseDataItemTwosevenOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const listEventsResponseDataItemTwoeightOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const listEventsResponseDataItemTwonineOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 
 export const ListEventsResponse = zod
   .object({
@@ -8139,6 +8700,115 @@ export const ListEventsResponse = zod
             .describe(
               "Shared wide-event envelope (ADR 048 \/ ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n",
             )
+            .and(
+              zod.object({
+                event_type: zod.literal("release.created"),
+                payload: zod
+                  .object({
+                    content_hash: zod.string().optional(),
+                    message: zod.string().optional(),
+                    git_sha: zod.string().optional(),
+                    git_dirty: zod.boolean().optional(),
+                    pointers: zod
+                      .array(
+                        zod.object({
+                          kind: zod.string().optional(),
+                          handle: zod.string().optional(),
+                          revision_id: zod.string().optional(),
+                        }),
+                      )
+                      .optional(),
+                  })
+                  .describe(
+                    "Allowlisted fields for `release.created`. The release id is already the\nevent's `entity_id`; the pinned set is repeated here so the audit stream\nanswers what a release contained without reading the release itself.\n",
+                  ),
+              }),
+            )
+            .describe("Wide event with event_type=release.created.\n"),
+          zod
+            .object({
+              id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+              project_id: zod.string().regex(listEventsResponseDataItemTwozeroOneProjectIdRegExp),
+              team_id: zod
+                .union([zod.string(), zod.null()])
+                .optional()
+                .describe("Emit-time team scope, when the actor operated under a team."),
+              event_type: zod
+                .string()
+                .describe(
+                  "Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs\/design\/api\/events-catalog.md.\n",
+                ),
+              category: zod
+                .enum(["request", "auth", "session", "admin", "entity", "signal"])
+                .describe("Wide-event category."),
+              occurred_at: zod.iso
+                .datetime({ offset: true })
+                .describe("When the action happened (server\/storage clock, dialect-owned)."),
+              created_at: zod.iso
+                .datetime({ offset: true })
+                .describe("When the row was inserted (server\/storage clock, dialect-owned)."),
+              actor_id: zod
+                .union([zod.string(), zod.null()])
+                .optional()
+                .describe("Who triggered the event."),
+              actor_type: zod
+                .union([zod.enum(["human", "service", "system", "agent"]), zod.null()])
+                .optional()
+                .describe("Actor kind."),
+              entity_type: zod
+                .union([zod.string(), zod.null()])
+                .optional()
+                .describe("Resource type affected."),
+              entity_id: zod
+                .union([zod.string(), zod.null()])
+                .optional()
+                .describe("Resource id affected."),
+              client_id: zod.string().describe("Application or agent that produced the event."),
+              token_id: zod
+                .string()
+                .optional()
+                .describe("Token id present at emit time, when any."),
+              delegation_type: zod
+                .enum(["direct", "delegated", "pat_shared", "exchanged"])
+                .optional()
+                .describe("Delegation kind (omit when unset)."),
+              delegation_id: zod.string().optional(),
+              grantor: zod.string().optional(),
+              fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+              request_id: zod
+                .union([zod.string(), zod.null()])
+                .optional()
+                .describe("HTTP request correlation id."),
+              session_id: zod
+                .union([zod.string(), zod.null()])
+                .optional()
+                .describe("Session correlation id."),
+              flow_id: zod
+                .union([zod.string(), zod.null()])
+                .optional()
+                .describe("Login flow correlation id."),
+              metadata: zod
+                .object({
+                  client: zod
+                    .object({
+                      ip: zod
+                        .string()
+                        .optional()
+                        .describe("Client IP from the first X-Forwarded-For hop or RemoteAddr."),
+                      user_agent: zod.string().optional().describe("Observed User-Agent header."),
+                      origin: zod.string().optional().describe("Origin header when present."),
+                    })
+                    .optional()
+                    .describe("Observed HTTP requestor context on Path A request.api only."),
+                })
+                .optional()
+                .describe(
+                  "Emit-time metadata, already redacted at write. Path A request.api may\nset client (ip, user_agent, origin) for SIEM join on request_id. Not a\nlive risk-evaluator input.\n",
+                ),
+            })
+            .describe(
+              "Shared wide-event envelope (ADR 048 \/ ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n",
+            )
             .and(
               zod.object({
                 event_type: zod.literal("request.api"),
@@ -8151,11 +8821,11 @@ export const ListEventsResponse = zod
                     route_template: zod.string(),
                     status: zod
                       .number()
-                      .min(listEventsResponseDataItemOnenineTwoPayloadStatusMin)
-                      .max(listEventsResponseDataItemOnenineTwoPayloadStatusMax),
+                      .min(listEventsResponseDataItemTwozeroTwoPayloadStatusMin)
+                      .max(listEventsResponseDataItemTwozeroTwoPayloadStatusMax),
                     duration_ms: zod
                       .number()
-                      .min(listEventsResponseDataItemOnenineTwoPayloadDurationMsMin),
+                      .min(listEventsResponseDataItemTwozeroTwoPayloadDurationMsMin),
                   })
                   .describe("Payload for `request.api` events."),
               }),
@@ -8164,7 +8834,7 @@ export const ListEventsResponse = zod
           zod
             .object({
               id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-              project_id: zod.string().regex(listEventsResponseDataItemTwozeroOneProjectIdRegExp),
+              project_id: zod.string().regex(listEventsResponseDataItemTwooneOneProjectIdRegExp),
               team_id: zod
                 .union([zod.string(), zod.null()])
                 .optional()
@@ -8272,7 +8942,7 @@ export const ListEventsResponse = zod
           zod
             .object({
               id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-              project_id: zod.string().regex(listEventsResponseDataItemTwooneOneProjectIdRegExp),
+              project_id: zod.string().regex(listEventsResponseDataItemTwotwoOneProjectIdRegExp),
               team_id: zod
                 .union([zod.string(), zod.null()])
                 .optional()
@@ -8367,7 +9037,7 @@ export const ListEventsResponse = zod
           zod
             .object({
               id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-              project_id: zod.string().regex(listEventsResponseDataItemTwotwoOneProjectIdRegExp),
+              project_id: zod.string().regex(listEventsResponseDataItemTwothreeOneProjectIdRegExp),
               team_id: zod
                 .union([zod.string(), zod.null()])
                 .optional()
@@ -8462,7 +9132,7 @@ export const ListEventsResponse = zod
           zod
             .object({
               id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-              project_id: zod.string().regex(listEventsResponseDataItemTwothreeOneProjectIdRegExp),
+              project_id: zod.string().regex(listEventsResponseDataItemTwofourOneProjectIdRegExp),
               team_id: zod
                 .union([zod.string(), zod.null()])
                 .optional()
@@ -8559,7 +9229,7 @@ export const ListEventsResponse = zod
           zod
             .object({
               id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-              project_id: zod.string().regex(listEventsResponseDataItemTwofourOneProjectIdRegExp),
+              project_id: zod.string().regex(listEventsResponseDataItemTwofiveOneProjectIdRegExp),
               team_id: zod
                 .union([zod.string(), zod.null()])
                 .optional()
@@ -8654,7 +9324,7 @@ export const ListEventsResponse = zod
           zod
             .object({
               id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-              project_id: zod.string().regex(listEventsResponseDataItemTwofiveOneProjectIdRegExp),
+              project_id: zod.string().regex(listEventsResponseDataItemTwosixOneProjectIdRegExp),
               team_id: zod
                 .union([zod.string(), zod.null()])
                 .optional()
@@ -8751,7 +9421,7 @@ export const ListEventsResponse = zod
           zod
             .object({
               id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-              project_id: zod.string().regex(listEventsResponseDataItemTwosixOneProjectIdRegExp),
+              project_id: zod.string().regex(listEventsResponseDataItemTwosevenOneProjectIdRegExp),
               team_id: zod
                 .union([zod.string(), zod.null()])
                 .optional()
@@ -8846,7 +9516,7 @@ export const ListEventsResponse = zod
           zod
             .object({
               id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-              project_id: zod.string().regex(listEventsResponseDataItemTwosevenOneProjectIdRegExp),
+              project_id: zod.string().regex(listEventsResponseDataItemTwoeightOneProjectIdRegExp),
               team_id: zod
                 .union([zod.string(), zod.null()])
                 .optional()
@@ -8945,7 +9615,7 @@ export const ListEventsResponse = zod
           zod
             .object({
               id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-              project_id: zod.string().regex(listEventsResponseDataItemTwoeightOneProjectIdRegExp),
+              project_id: zod.string().regex(listEventsResponseDataItemTwonineOneProjectIdRegExp),
               team_id: zod
                 .union([zod.string(), zod.null()])
                 .optional()
@@ -9092,12 +9762,12 @@ export const getEventResponseOnesixOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_
 export const getEventResponseOnesevenOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const getEventResponseOneeightOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const getEventResponseOnenineOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
-export const getEventResponseOnenineTwoPayloadStatusMin = 100;
-export const getEventResponseOnenineTwoPayloadStatusMax = 599;
+export const getEventResponseTwozeroOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getEventResponseTwozeroTwoPayloadStatusMin = 100;
+export const getEventResponseTwozeroTwoPayloadStatusMax = 599;
 
-export const getEventResponseOnenineTwoPayloadDurationMsMin = 0;
+export const getEventResponseTwozeroTwoPayloadDurationMsMin = 0;
 
-export const getEventResponseTwozeroOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const getEventResponseTwooneOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const getEventResponseTwotwoOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const getEventResponseTwothreeOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
@@ -9106,6 +9776,7 @@ export const getEventResponseTwofiveOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9
 export const getEventResponseTwosixOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const getEventResponseTwosevenOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const getEventResponseTwoeightOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getEventResponseTwonineOneProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 
 export const GetEventResponse = zod
   .union([
@@ -10893,6 +11564,112 @@ export const GetEventResponse = zod
       .describe(
         "Shared wide-event envelope (ADR 048 \/ ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n",
       )
+      .and(
+        zod.object({
+          event_type: zod.literal("release.created"),
+          payload: zod
+            .object({
+              content_hash: zod.string().optional(),
+              message: zod.string().optional(),
+              git_sha: zod.string().optional(),
+              git_dirty: zod.boolean().optional(),
+              pointers: zod
+                .array(
+                  zod.object({
+                    kind: zod.string().optional(),
+                    handle: zod.string().optional(),
+                    revision_id: zod.string().optional(),
+                  }),
+                )
+                .optional(),
+            })
+            .describe(
+              "Allowlisted fields for `release.created`. The release id is already the\nevent's `entity_id`; the pinned set is repeated here so the audit stream\nanswers what a release contained without reading the release itself.\n",
+            ),
+        }),
+      )
+      .describe("Wide event with event_type=release.created.\n"),
+    zod
+      .object({
+        id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
+        project_id: zod.string().regex(getEventResponseTwozeroOneProjectIdRegExp),
+        team_id: zod
+          .union([zod.string(), zod.null()])
+          .optional()
+          .describe("Emit-time team scope, when the actor operated under a team."),
+        event_type: zod
+          .string()
+          .describe(
+            "Semantic event name (dot-separated). Discriminator for the Event union —\nsee docs\/design\/api\/events-catalog.md.\n",
+          ),
+        category: zod
+          .enum(["request", "auth", "session", "admin", "entity", "signal"])
+          .describe("Wide-event category."),
+        occurred_at: zod.iso
+          .datetime({ offset: true })
+          .describe("When the action happened (server\/storage clock, dialect-owned)."),
+        created_at: zod.iso
+          .datetime({ offset: true })
+          .describe("When the row was inserted (server\/storage clock, dialect-owned)."),
+        actor_id: zod
+          .union([zod.string(), zod.null()])
+          .optional()
+          .describe("Who triggered the event."),
+        actor_type: zod
+          .union([zod.enum(["human", "service", "system", "agent"]), zod.null()])
+          .optional()
+          .describe("Actor kind."),
+        entity_type: zod
+          .union([zod.string(), zod.null()])
+          .optional()
+          .describe("Resource type affected."),
+        entity_id: zod
+          .union([zod.string(), zod.null()])
+          .optional()
+          .describe("Resource id affected."),
+        client_id: zod.string().describe("Application or agent that produced the event."),
+        token_id: zod.string().optional().describe("Token id present at emit time, when any."),
+        delegation_type: zod
+          .enum(["direct", "delegated", "pat_shared", "exchanged"])
+          .optional()
+          .describe("Delegation kind (omit when unset)."),
+        delegation_id: zod.string().optional(),
+        grantor: zod.string().optional(),
+        fingerprint: zod.string().optional().describe("Device fingerprint correlation id."),
+        request_id: zod
+          .union([zod.string(), zod.null()])
+          .optional()
+          .describe("HTTP request correlation id."),
+        session_id: zod
+          .union([zod.string(), zod.null()])
+          .optional()
+          .describe("Session correlation id."),
+        flow_id: zod
+          .union([zod.string(), zod.null()])
+          .optional()
+          .describe("Login flow correlation id."),
+        metadata: zod
+          .object({
+            client: zod
+              .object({
+                ip: zod
+                  .string()
+                  .optional()
+                  .describe("Client IP from the first X-Forwarded-For hop or RemoteAddr."),
+                user_agent: zod.string().optional().describe("Observed User-Agent header."),
+                origin: zod.string().optional().describe("Origin header when present."),
+              })
+              .optional()
+              .describe("Observed HTTP requestor context on Path A request.api only."),
+          })
+          .optional()
+          .describe(
+            "Emit-time metadata, already redacted at write. Path A request.api may\nset client (ip, user_agent, origin) for SIEM join on request_id. Not a\nlive risk-evaluator input.\n",
+          ),
+      })
+      .describe(
+        "Shared wide-event envelope (ADR 048 \/ ADR 049). Concrete events are\n`allOf` this schema plus a `const` `event_type` and a typed `payload`.\n",
+      )
       .and(
         zod.object({
           event_type: zod.literal("request.api"),
@@ -10905,9 +11682,9 @@ export const GetEventResponse = zod
               route_template: zod.string(),
               status: zod
                 .number()
-                .min(getEventResponseOnenineTwoPayloadStatusMin)
-                .max(getEventResponseOnenineTwoPayloadStatusMax),
-              duration_ms: zod.number().min(getEventResponseOnenineTwoPayloadDurationMsMin),
+                .min(getEventResponseTwozeroTwoPayloadStatusMin)
+                .max(getEventResponseTwozeroTwoPayloadStatusMax),
+              duration_ms: zod.number().min(getEventResponseTwozeroTwoPayloadDurationMsMin),
             })
             .describe("Payload for `request.api` events."),
         }),
@@ -10916,7 +11693,7 @@ export const GetEventResponse = zod
     zod
       .object({
         id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-        project_id: zod.string().regex(getEventResponseTwozeroOneProjectIdRegExp),
+        project_id: zod.string().regex(getEventResponseTwooneOneProjectIdRegExp),
         team_id: zod
           .union([zod.string(), zod.null()])
           .optional()
@@ -11021,7 +11798,7 @@ export const GetEventResponse = zod
     zod
       .object({
         id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-        project_id: zod.string().regex(getEventResponseTwooneOneProjectIdRegExp),
+        project_id: zod.string().regex(getEventResponseTwotwoOneProjectIdRegExp),
         team_id: zod
           .union([zod.string(), zod.null()])
           .optional()
@@ -11113,7 +11890,7 @@ export const GetEventResponse = zod
     zod
       .object({
         id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-        project_id: zod.string().regex(getEventResponseTwotwoOneProjectIdRegExp),
+        project_id: zod.string().regex(getEventResponseTwothreeOneProjectIdRegExp),
         team_id: zod
           .union([zod.string(), zod.null()])
           .optional()
@@ -11205,7 +11982,7 @@ export const GetEventResponse = zod
     zod
       .object({
         id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-        project_id: zod.string().regex(getEventResponseTwothreeOneProjectIdRegExp),
+        project_id: zod.string().regex(getEventResponseTwofourOneProjectIdRegExp),
         team_id: zod
           .union([zod.string(), zod.null()])
           .optional()
@@ -11299,7 +12076,7 @@ export const GetEventResponse = zod
     zod
       .object({
         id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-        project_id: zod.string().regex(getEventResponseTwofourOneProjectIdRegExp),
+        project_id: zod.string().regex(getEventResponseTwofiveOneProjectIdRegExp),
         team_id: zod
           .union([zod.string(), zod.null()])
           .optional()
@@ -11391,7 +12168,7 @@ export const GetEventResponse = zod
     zod
       .object({
         id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-        project_id: zod.string().regex(getEventResponseTwofiveOneProjectIdRegExp),
+        project_id: zod.string().regex(getEventResponseTwosixOneProjectIdRegExp),
         team_id: zod
           .union([zod.string(), zod.null()])
           .optional()
@@ -11485,7 +12262,7 @@ export const GetEventResponse = zod
     zod
       .object({
         id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-        project_id: zod.string().regex(getEventResponseTwosixOneProjectIdRegExp),
+        project_id: zod.string().regex(getEventResponseTwosevenOneProjectIdRegExp),
         team_id: zod
           .union([zod.string(), zod.null()])
           .optional()
@@ -11577,7 +12354,7 @@ export const GetEventResponse = zod
     zod
       .object({
         id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-        project_id: zod.string().regex(getEventResponseTwosevenOneProjectIdRegExp),
+        project_id: zod.string().regex(getEventResponseTwoeightOneProjectIdRegExp),
         team_id: zod
           .union([zod.string(), zod.null()])
           .optional()
@@ -11673,7 +12450,7 @@ export const GetEventResponse = zod
     zod
       .object({
         id: zod.string().describe("Managed event id (`evt_<opaque>`)."),
-        project_id: zod.string().regex(getEventResponseTwoeightOneProjectIdRegExp),
+        project_id: zod.string().regex(getEventResponseTwonineOneProjectIdRegExp),
         team_id: zod
           .union([zod.string(), zod.null()])
           .optional()