@zitadel/components 0.1.0-alpha.16 → 0.1.0-alpha.18

package/dist/{index-BwQLFs9R.d.mts → index-DIGjtG4z.d.mts}

@@ -296,6 +296,14 @@ declare class ZlCheckbox extends LitElement {
   accessor checked: boolean;
   accessor disabled: boolean;
   accessor required: boolean;
+  /**
+   * Inline validation message shown under the control (empty = none). Set by
+   * the orchestrator's template on a field error; display-only, mirroring
+   * `<zl-field>` / `<zl-select>` so the flow router routes every field type
+   * the same way. Submission gating lives in `<zitadel-login>`.
+   */
+  accessor error: string;
+  accessor invalid: boolean;
   accessor ariaLabelText: string | undefined;
   accessor testId: string | undefined;
   /**
@@ -314,6 +322,15 @@ declare class ZlCheckbox extends LitElement {
   formResetCallback(): void;
   formStateRestoreCallback(state: string | null): void;
   focus(options?: FocusOptions): void;
+  /**
+   * The string this control contributes to form submission — the uniform
+   * read/write contract `<zitadel-login>` uses to capture and restore field
+   * values without knowing each atom's internal shape. Like a native checkbox
+   * this is the value token only when checked, empty otherwise; assigning it
+   * back restores the checked state.
+   */
+  get formValue(): string;
+  set formValue(value: string);
   render(): _$lit.TemplateResult<1>;
   private handleChange;
   private syncFormState;
@@ -326,9 +343,8 @@ declare global {
   }
 } //# sourceMappingURL=zl-checkbox.d.ts.map
 //#endregion
-//#region ../api/dist/index-oloR8wb4.d.mts
-//#endregion
-//#region src/generated/model/activateFlowDefinitionParams.d.ts
+//#region ../api/dist/index-D6qIOslB.d.mts
+//#region src/generated/model/completeClaim200.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -336,44 +352,15 @@ declare global {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type ActivateFlowDefinitionParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-}; //#endregion
-//#region src/generated/model/authorizeDevice200.d.ts
 /**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
+ * The result of a completed project claim.
  */
-type AuthorizeDevice200 = {
-  /** The device code that the client will use to poll for authorization.
-   */
-  device_code?: string;
-  /** The number of seconds until the device code expires.
-   */
-  expires_in?: number;
-  /** The minimum amount of time in seconds that the client should wait
-  between polling requests.
-   */
-  interval?: number;
-  /** The user code that the user will enter to authorize the device.
-   */
-  user_code?: string;
-  /** The URI where the user will enter the user code to authorize the device.
-   */
-  verification_uri?: string;
-  /** The complete URI with the user code included, which the user can visit
-  to authorize the device.
-   */
-  verification_uri_complete?: string;
+type CompleteClaim200 = {
+  /** @pattern ^[a-zA-Z0-9_-]+$ */project_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  team_id: string; /** The time when the project was claimed. */
+  claimed_at: string;
 }; //#endregion
-//#region src/generated/model/authorizeDevice400Details.d.ts
+//#region src/generated/model/completeClaim400Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -385,7 +372,7 @@ type AuthorizeDevice200 = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/authorizeDeviceParams.d.ts
+//#region src/generated/model/completeClaimBody.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -393,22 +380,17 @@ type AuthorizeDevice200 = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type AuthorizeDeviceParams = {
-  /**
-  * The client ID of the application that is requesting authorization.
-  This is a required parameter and must match the client ID of a
-  registered application.
-    */
-  client_id: string;
+/**
+ * The request to complete a project claim.
+ */
+type CompleteClaimBody = {
   /**
-  * The scope parameter is used to specify the permissions that the client
-  is requesting. This is a space delimited list of scopes. For example,
-  you could use this to request access to the user's profile information or
-  to request permission to access certain APIs on behalf of the user.
-    */
-  scope?: string;
+   * Unique identifier for this challenge (dialect-minted prefixed opaque string).
+   * @pattern ^ch_[a-zA-Z0-9_-]+$
+   */
+  challenge_id: string;
 }; //#endregion
-//#region src/generated/model/authorizeGet400Details.d.ts
+//#region src/generated/model/completeClaimDefaultDetails.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -420,149 +402,6 @@ type AuthorizeDeviceParams = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/authorizeGetDefaultDetails.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Additional error-specific context.
- */
-type AuthorizeGetDefaultDetails = {
-  [key: string]: unknown;
-}; //#endregion
-//#region src/generated/model/authorizeGetDefault.d.ts
-/**
- * Standard error payload returned for failed API requests.
- */
-type AuthorizeGetDefault = {
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: AuthorizeGetDefaultDetails;
-}; //#endregion
-//#region src/generated/model/authorizeGetParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type AuthorizeGetParams = {
-  /**
-  * A space delimited list of Authentication Class References. This can be
-  used to specify certain authentication methods or level of assurance
-  that is required for the authentication. For example, you could use
-  this to require multi-factor authentication.
-    */
-  acr_values?: string;
-  /**
-  * The client ID of the application that is requesting authorization.
-  This is a required parameter and must match the client ID of a
-  registered application.
-    */
-  client_id: string;
-  /**
-  * The code challenge is a cryptographic string used in the PKCE (Proof
-  Key for Code Exchange) flow to enhance security.
-    */
-  code_challenge?: string;
-  /**
-  * The code challenge method is used in conjunction with the code challenge
-  in the PKCE flow. It specifies the method used to generate the code
-  challenge. Common values are "S256" for SHA-256 hashing and "plain"
-  for no hashing.
-    */
-  code_challenge_method?: string;
-  /**
-  * The display parameter is used to specify how the authorization server
-  should display the authentication and consent user interface. Common
-  values include "page" for a full-page display, "popup" for a popup
-  window, and "touch" for a mobile-optimized display.
-    */
-  display?: string;
-  /**
-  * The ID token hint is a previously issued ID token that can be used to
-  pre-fill the authentication form or to provide information about the
-  user to the authorization server. This can be useful for single sign-on
-  scenarios or for providing a smoother user experience.
-    */
-  id_token_hint?: string;
-  /**
-  * The login hint is a hint to the authorization server about the login
-  identifier of the user. This can be used to pre-fill the username or
-  email field in the authentication form, making it easier for the user
-  to log in.
-    */
-  login_hint?: string;
-  /**
-  * The max age parameter specifies the maximum amount of time in seconds
-  that has passed since the user last authenticated. If the user has not
-  authenticated within this time frame, they will be required to re-authenticate.
-    */
-  max_age?: number;
-  /**
-  * The nonce parameter is a random string that is used to associate a client
-  session with an ID token and to mitigate replay attacks. The authorization
-  server should include this value in the ID token that it issues, and the
-  client should verify that the value in the ID token matches the value it
-  sent in the authorization request.
-    */
-  nonce?: string;
-  /**
-  * The prompt parameter is used to specify whether the authorization server
-  should prompt the user for re-authentication and consent. Common values
-  include "none" for no prompts, "login" to prompt for re-authentication,
-  "consent" to prompt for user consent, and "select_account" to prompt
-  the user to select an account if they are logged in with multiple accounts.
-    */
-  prompt?: string;
-  /**
-  * The redirect URI is the URI to which the authorization server will redirect
-  the user after they have authorized or denied the request. This must match
-  one of the redirect URIs registered for the client application.
-    */
-  redirect_uri?: string;
-  /**
-  * The response mode parameter specifies how the authorization server should
-  return the authorization response. Common values include "query" to return
-  parameters in the query string, "fragment" to return parameters in the URL
-  fragment, and "form_post" to return parameters in an HTTP POST request.
-    */
-  response_mode?: string;
-  /**
-  * The response type parameter specifies the type of response that the client
-  is expecting from the authorization server. Common values include "code"
-  for the authorization code flow, "token" for the implicit flow, and "id_token"
-  for OpenID Connect authentication.
-    */
-  response_type: string;
-  /**
-  * The scope parameter is used to specify the permissions that the client is
-  requesting from the user. This is a space-delimited list of scope values,
-  and the authorization server will use this information to determine what
-  access to grant to the client application.
-    */
-  scope?: string;
-  /**
-  * The state parameter is a random string that is used to maintain state between
-  the authorization request and the callback. It is used to prevent cross-site
-  request forgery (CSRF) attacks by ensuring that the response received from the
-  authorization server corresponds to the request that was sent.
-    */
-  state?: string;
-  /**
-  * The ui_locales parameter is used to specify the preferred languages and scripts
-  for the user interface that the authorization server should display. This is a
-  space-delimited list of BCP47 language tag values, and it can be used to provide
-  a localized user experience for users from different regions and language
-  preferences.
-    */
-  ui_locales?: string;
-}; //#endregion
 //#region src/generated/model/createAuthAttempt201ChallengesItemMethod.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -642,8 +481,8 @@ The client verifies the proof by POST /auth_attempts/{attempt_id}/challenges/{ch
  */
 type CreateAuthAttempt201ChallengesItem = {
   /**
-   * Unique identifier for this challenge
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this challenge (dialect-minted prefixed opaque string).
+   * @pattern ^ch_[a-zA-Z0-9_-]+$
    */
   challenge_id: string; /** An authentication factor method. */
   method: CreateAuthAttempt201ChallengesItemMethod;
@@ -775,8 +614,8 @@ Clients drive the attempt by:
  */
 type CreateAuthAttempt201 = {
   /**
-   * Unique identifier for this authentication attempt
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this authentication attempt (dialect-minted prefixed opaque string).
+   * @pattern ^att_[a-zA-Z0-9_-]+$
    */
   attempt_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
@@ -847,6 +686,181 @@ type CreateAuthAttemptBody = {
  * OpenAPI spec version: 0.0.1
  */
 //#endregion
+//#region src/generated/model/createBranding201BrandingLayout.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Layout preset selector. The default.liquid master template uses this
+to branch into layout variants. Customers who eject the template
+can ignore this field entirely; it also serves as the degrade target
+when a custom template fails component-side validation.
+
+ */
+type CreateBranding201BrandingLayout = (typeof CreateBranding201BrandingLayout)[keyof typeof CreateBranding201BrandingLayout];
+declare const CreateBranding201BrandingLayout: {
+  readonly centered: "centered";
+  readonly split: "split";
+}; //#endregion
+//#region src/generated/model/createBranding201Branding.d.ts
+/**
+ * Branding configuration. Appears in two places with one shape:
+
+- On flow responses as a read-only projection: the server resolves the
+  latest branding revision for the project per step response (falling
+  back to built-in defaults when none is stored). Branding is configured
+  via the Branding API / `zitadel apply`, not the Flow API.
+- As the request body of `POST /branding`, which publishes the same
+  shape as a new immutable revision (see ADR 040).
+
+ */
+type CreateBranding201Branding = {
+  /** Layout preset selector. The default.liquid master template uses this
+  to branch into layout variants. Customers who eject the template
+  can ignore this field entirely; it also serves as the degrade target
+  when a custom template fails component-side validation.
+   */
+  layout?: CreateBranding201BrandingLayout;
+  /**
+     * The LiquidJS template string for rendering this step. The orchestrator
+  parses this template, injects the capability dictionaries as context,
+  and renders the output HTML into its Shadow DOM.
+        * @maxLength 131072
+     */
+  liquid_template?: string; /** Team logo URL. */
+  logo_url?: string;
+  /** Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in
+  v1: `POST /branding` rejects a non-empty value, because the login
+  component loads this stylesheet at document level (shadow-scoped
+  `@font-face` rules never register faces) and an arbitrary URL would
+  grant `branding.write` page-wide CSS control over the embedding
+  application. Safe tenant font delivery is an ADR 040 follow-up;
+  until then, load fonts from the embedding page.
+   */
+  font_url?: string; /** Hero/background image URL (used by split layout). */
+  hero_url?: string;
+}; //#endregion
+//#region src/generated/model/createBranding201.d.ts
+/**
+ * A stored branding revision. `branding` echoes the canonical stored
+configuration so clients (e.g. the CLI sync engine) can reconcile local
+files with the server's stored state.
+
+ */
+type CreateBranding201 = {
+  /** The unique identifier of this branding revision. */id: string; /** When this revision was published. */
+  created_at: string;
+  /** Branding configuration. Appears in two places with one shape:
+     - On flow responses as a read-only projection: the server resolves the
+    latest branding revision for the project per step response (falling
+    back to built-in defaults when none is stored). Branding is configured
+    via the Branding API / `zitadel apply`, not the Flow API.
+  - As the request body of `POST /branding`, which publishes the same
+    shape as a new immutable revision (see ADR 040).
+   */
+  branding: CreateBranding201Branding;
+}; //#endregion
+//#region src/generated/model/createBranding400Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/createBrandingBodyLayout.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Layout preset selector. The default.liquid master template uses this
+to branch into layout variants. Customers who eject the template
+can ignore this field entirely; it also serves as the degrade target
+when a custom template fails component-side validation.
+
+ */
+type CreateBrandingBodyLayout = (typeof CreateBrandingBodyLayout)[keyof typeof CreateBrandingBodyLayout];
+declare const CreateBrandingBodyLayout: {
+  readonly centered: "centered";
+  readonly split: "split";
+}; //#endregion
+//#region src/generated/model/createBrandingBody.d.ts
+/**
+ * Branding configuration. Appears in two places with one shape:
+
+- On flow responses as a read-only projection: the server resolves the
+  latest branding revision for the project per step response (falling
+  back to built-in defaults when none is stored). Branding is configured
+  via the Branding API / `zitadel apply`, not the Flow API.
+- As the request body of `POST /branding`, which publishes the same
+  shape as a new immutable revision (see ADR 040).
+
+ */
+type CreateBrandingBody = {
+  /** Layout preset selector. The default.liquid master template uses this
+  to branch into layout variants. Customers who eject the template
+  can ignore this field entirely; it also serves as the degrade target
+  when a custom template fails component-side validation.
+   */
+  layout?: CreateBrandingBodyLayout;
+  /**
+     * The LiquidJS template string for rendering this step. The orchestrator
+  parses this template, injects the capability dictionaries as context,
+  and renders the output HTML into its Shadow DOM.
+        * @maxLength 131072
+     */
+  liquid_template?: string; /** Team logo URL. */
+  logo_url?: string;
+  /** Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in
+  v1: `POST /branding` rejects a non-empty value, because the login
+  component loads this stylesheet at document level (shadow-scoped
+  `@font-face` rules never register faces) and an arbitrary URL would
+  grant `branding.write` page-wide CSS control over the embedding
+  application. Safe tenant font delivery is an ADR 040 follow-up;
+  until then, load fonts from the embedding page.
+   */
+  font_url?: string; /** Hero/background image URL (used by split layout). */
+  hero_url?: string;
+}; //#endregion
+//#region src/generated/model/createBrandingDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/createBrandingParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type CreateBrandingParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+}; //#endregion
 //#region src/generated/model/createFlow201BrandingLayout.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -858,7 +872,8 @@ type CreateAuthAttemptBody = {
 /**
  * Layout preset selector. The default.liquid master template uses this
 to branch into layout variants. Customers who eject the template
-can ignore this field entirely.
+can ignore this field entirely; it also serves as the degrade target
+when a custom template fails component-side validation.
 
  */
 type CreateFlow201BrandingLayout = (typeof CreateFlow201BrandingLayout)[keyof typeof CreateFlow201BrandingLayout];
@@ -868,23 +883,39 @@ declare const CreateFlow201BrandingLayout: {
 }; //#endregion
 //#region src/generated/model/createFlow201Branding.d.ts
 /**
- * Resolved branding configuration. Inherited from the app → team → project
-hierarchy at flow creation time (most specific wins). Read-only projection —
-branding is configured via the Team/App Branding API, not the Flow API.
+ * Branding configuration. Appears in two places with one shape:
+
+- On flow responses as a read-only projection: the server resolves the
+  latest branding revision for the project per step response (falling
+  back to built-in defaults when none is stored). Branding is configured
+  via the Branding API / `zitadel apply`, not the Flow API.
+- As the request body of `POST /branding`, which publishes the same
+  shape as a new immutable revision (see ADR 040).
 
  */
 type CreateFlow201Branding = {
   /** Layout preset selector. The default.liquid master template uses this
   to branch into layout variants. Customers who eject the template
-  can ignore this field entirely.
+  can ignore this field entirely; it also serves as the degrade target
+  when a custom template fails component-side validation.
    */
   layout?: CreateFlow201BrandingLayout;
-  /** The LiquidJS template string for rendering this step. The orchestrator
+  /**
+     * The LiquidJS template string for rendering this step. The orchestrator
   parses this template, injects the capability dictionaries as context,
   and renders the output HTML into its Shadow DOM.
-   */
+        * @maxLength 131072
+     */
   liquid_template?: string; /** Team logo URL. */
-  logo_url?: string; /** Custom font URL (e.g., Google Fonts CSS). */
+  logo_url?: string;
+  /** Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in
+  v1: `POST /branding` rejects a non-empty value, because the login
+  component loads this stylesheet at document level (shadow-scoped
+  `@font-face` rules never register faces) and an arbitrary URL would
+  grant `branding.write` page-wide CSS control over the embedding
+  application. Safe tenant font delivery is an ADR 040 follow-up;
+  until then, load fonts from the embedding page.
+   */
   font_url?: string; /** Hero/background image URL (used by split layout). */
   hero_url?: string;
 }; //#endregion
@@ -1261,9 +1292,11 @@ type CreateFlow201Step = {
   (e.g. `error.email_required`; the `format` rule is spelled
   `error.<field>_invalid`), multiple violations joined with `"; "`.
   Field names appear verbatim, so clients localise unknown keys via
-  the generic `error.field_<rule>` catalog entries. Other failures
-  carry a verbatim diagnostic token instead (e.g. `user_not_found`,
-  `auth_attempt.password_invalid`).
+  the generic `error.field_<rule>` catalog entries. Other engine
+  failures carry `error.*` catalog keys as well (e.g.
+  `error.invalid_credentials`, `error.passkey_invalid`); a
+  non-`error.` payload is an outcome token (e.g. `user_not_found`)
+  that clients keep verbatim.
    */
   error?: string | null;
   /** Present only on terminal steps. Tells the frontend what to do:
@@ -1312,9 +1345,13 @@ type CreateFlow201 = {
   and builds name-keyed indexes locally for lookup.
    */
   step: CreateFlow201Step;
-  /** Resolved branding configuration. Inherited from the app → team → project
-  hierarchy at flow creation time (most specific wins). Read-only projection —
-  branding is configured via the Team/App Branding API, not the Flow API.
+  /** Branding configuration. Appears in two places with one shape:
+     - On flow responses as a read-only projection: the server resolves the
+    latest branding revision for the project per step response (falling
+    back to built-in defaults when none is stored). Branding is configured
+    via the Branding API / `zitadel apply`, not the Flow API.
+  - As the request body of `POST /branding`, which publishes the same
+    shape as a new immutable revision (see ADR 040).
    */
   branding?: CreateFlow201Branding; /** Present when `step.complete` is `redirect`. */
   redirect_uri?: string;
@@ -1406,7 +1443,7 @@ type CreateFlowBody = {
   redirect_uri?: string;
   hint?: CreateFlowBodyHint;
 }; //#endregion
-//#region src/generated/model/createFlowDefaultDetails.d.ts
+//#region src/generated/model/createFlowDefault.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1414,9 +1451,6 @@ type CreateFlowBody = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
 //#endregion
 //#region src/generated/model/createFlowDefinition201FlowDefinitionAudience.d.ts
 /**
@@ -2198,7 +2232,7 @@ type CreateFlowDefinitionBody = {
    */
   flow_definition: CreateFlowDefinitionBodyFlowDefinition;
 }; //#endregion
-//#region src/generated/model/createFlowDefinitionDefaultDetails.d.ts
+//#region src/generated/model/createFlowDefinitionDefault.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2206,9 +2240,6 @@ type CreateFlowDefinitionBody = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
 //#endregion
 //#region src/generated/model/createHandoff200.d.ts
 /**
@@ -2260,14 +2291,14 @@ type CreateProject201 = {
   name: string;
   /** Secret which can be used for authentication when modifying the project.
    */
-  projectSecret: string;
+  project_secret: string;
   /** Secret which can be used for previewing and testing the project.
    */
-  previewSecret: string;
+  preview_secret: string;
   /** Origins which are allowed for previewing and testing the project.
    */
-  previewOrigins: string[]; /** The time when the project was created. */
-  createdAt: string;
+  preview_origins: string[]; /** The time when the project was created. */
+  created_at: string;
 }; //#endregion
 //#region src/generated/model/createProject429Details.d.ts
 /**
@@ -2293,14 +2324,14 @@ type CreateProjectBody = {
   /** The name of the project. */name: string;
   /** Origins which are allowed for previewing and testing the project.
    */
-  previewOrigins?: string[];
+  preview_origins?: string[];
   /** Whether the server should provision fallback default user schema and flow
   resources for the project. CLI-managed projects set this to false and
   upload their local .zitadel config files through the schema and flow APIs.
    */
-  seedDefaults?: boolean;
+  seed_defaults?: boolean;
 }; //#endregion
-//#region src/generated/model/createProjectDefaultDetails.d.ts
+//#region src/generated/model/createProjectDefault.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2308,9 +2339,6 @@ type CreateProjectBody = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
 //#endregion
 //#region src/generated/model/createSchema201.d.ts
 /**
@@ -2402,8 +2430,13 @@ type CreateSchemaBody = {
       "x-unique"?: "unspecified" | "project" | "team" | null; /** The claim name for this property, if applicable */
       "x-claim"?: string | null; /** Whether this property is editable by the user or not */
       "x-editable"?: boolean; /** Whether this property contains sensitive information or not */
-      "x-sensitive"?: boolean; /** Whether this property is used for multi-factor authentication or not */
-      "x-mfa"?: boolean; /** A map of additional properties for the user definition, where the key is the property name and the value is the property schema */
+      "x-sensitive"?: boolean;
+      /** Whether this property is used for multi-factor authentication or not
+       */
+      "x-mfa"?: boolean;
+      /** A map of additional properties for the user definition, where the key is
+      the property name and the value is the property schema.
+      */
       properties?: {
         [key: string]: unknown;
       };
@@ -2533,7 +2566,6 @@ type CreateSession201SessionMetadata = {
 - `building`: has a user factor but is still gathering authentication factors
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
-- `revoked`: explicitly revoked via DELETE
 
  */
 type CreateSession201SessionState = (typeof CreateSession201SessionState)[keyof typeof CreateSession201SessionState];
@@ -2541,7 +2573,6 @@ declare const CreateSession201SessionState: {
   readonly building: "building";
   readonly active: "active";
   readonly expired: "expired";
-  readonly revoked: "revoked";
 }; //#endregion
 //#region src/generated/model/createSession201SessionUserAgent.d.ts
 /**
@@ -2571,8 +2602,8 @@ in through `auth_attempts`.
  */
 type CreateSession201Session = {
   /**
-   * Unique identifier for this session.
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this session (dialect-minted prefixed opaque string).
+   * @pattern ^sess_[a-zA-Z0-9_-]+$
    */
   session_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
@@ -2580,7 +2611,6 @@ type CreateSession201Session = {
   - `building`: has a user factor but is still gathering authentication factors
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
-  - `revoked`: explicitly revoked via DELETE
    */
   state: CreateSession201SessionState;
   /** The authenticated user. Null for anonymous sessions and until the `user`
@@ -2687,7 +2717,7 @@ type CreateSessionBody = {
    */
   user_agent?: CreateSessionBodyUserAgent;
 }; //#endregion
-//#region src/generated/model/createSessionDefaultDetails.d.ts
+//#region src/generated/model/createSessionDefault.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2695,11 +2725,8 @@ type CreateSessionBody = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
 //#endregion
-//#region src/generated/model/createTeam201.d.ts
+//#region src/generated/model/createTeam201Status.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2707,9 +2734,32 @@ type CreateSessionBody = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+/**
+ * The lifecycle state of a team.
+
+active: The team is available for use.
+deactivated: The team is no longer active but is retained for historical and audit purposes.
+
+ */
+type CreateTeam201Status = (typeof CreateTeam201Status)[keyof typeof CreateTeam201Status];
+declare const CreateTeam201Status: {
+  readonly active: "active";
+  readonly deactivated: "deactivated";
+}; //#endregion
+//#region src/generated/model/createTeam201.d.ts
+/**
+ * Details of a team.
+ */
 type CreateTeam201 = {
-  /** The unique identifier of the team. */id: string; /** The time when the team was created. */
-  createdAt: string;
+  /** The unique identifier of the team. */id: string; /** The name of the team. */
+  name: string;
+  /** The lifecycle state of a team.
+     active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
+   */
+  status: CreateTeam201Status; /** The time when the team was created. */
+  created_at: string; /** The time when the team was last updated. */
+  updated_at: string;
 }; //#endregion
 //#region src/generated/model/createTeam400Details.d.ts
 /**
@@ -2732,7 +2782,12 @@ type CreateTeam201 = {
  * OpenAPI spec version: 0.0.1
  */
 type CreateTeamBody = {
-  [key: string]: unknown;
+  /**
+   * The name of the team. Must be unique within the project.
+   * @minLength 1
+   * @maxLength 200
+   */
+  name: string;
 }; //#endregion
 //#region src/generated/model/createTeamDefaultDetails.d.ts
 /**
@@ -2790,7 +2845,7 @@ type CreateUser201 = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/createUserBody.d.ts
+//#region src/generated/model/createUserBodyMetadataStatus.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2798,17 +2853,46 @@ type CreateUser201 = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+/**
+ * The status of the user.
+ */
+type CreateUserBodyMetadataStatus = (typeof CreateUserBodyMetadataStatus)[keyof typeof CreateUserBodyMetadataStatus];
+declare const CreateUserBodyMetadataStatus: {
+  readonly active: "active";
+  readonly suspended: "suspended";
+  readonly deactivated: "deactivated";
+  readonly pending_purge: "pending_purge";
+}; //#endregion
+//#region src/generated/model/createUserBodyMetadata.d.ts
+type CreateUserBodyMetadata = {
+  /** The time when the user was created. */created_at: string; /** The time when the user was last updated. */
+  updated_at: string; /** The status of the user. */
+  status: CreateUserBodyMetadataStatus;
+  /** The team that owns this user's identity lifecycle, or `null` when the
+  user is self-owned. This is a single team and a different concept from
+  the user's team roster: it decides who may deprovision the user, not
+  which teams the user collaborates in. The roster is its own paginated
+  resource — `GET /users/{user_id}/teams`.
+   */
+  lifecycle_owner_team_id?: string | null;
+}; //#endregion
+//#region src/generated/model/createUserBody.d.ts
 /**
  * A user represents an individual identity in the system. It can be used to
 represent a human user, but also a service account or any other type of
 identity. The content of a user is determined by the configured schema for
 users, this is only a base schema.
 
+The server assigns the resource primary key (`id`) on create. Clients must
+not send `id` in the create body; it is returned in the create response.
+
  */
 type CreateUserBody = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id?: string;
+  metadata?: CreateUserBodyMetadata;
   [key: string]: unknown;
 }; //#endregion
-//#region src/generated/model/createUserDefaultDetails.d.ts
+//#region src/generated/model/createUserDefault.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2816,9 +2900,6 @@ type CreateUserBody = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
 //#endregion
 //#region src/generated/model/createUserParams.d.ts
 /**
@@ -2840,7 +2921,7 @@ type CreateUserParams = {
    */
   team_id?: string;
 }; //#endregion
-//#region src/generated/model/deactivateFlowDefinition400Details.d.ts
+//#region src/generated/model/deleteFlowDefinition409Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2852,7 +2933,7 @@ type CreateUserParams = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/deactivateFlowDefinitionParams.d.ts
+//#region src/generated/model/deleteFlowDefinitionParams.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2860,14 +2941,14 @@ type CreateUserParams = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type DeactivateFlowDefinitionParams = {
+type DeleteFlowDefinitionParams = {
   /**
-   * The unique identifier of the project
+   * The project id to filter by.
    * @pattern ^[a-zA-Z0-9_-]+$
    */
   project_id: string;
 }; //#endregion
-//#region src/generated/model/deleteFlowDefinition409Details.d.ts
+//#region src/generated/model/deleteTeam400Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2879,7 +2960,7 @@ type DeactivateFlowDefinitionParams = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/deleteFlowDefinitionParams.d.ts
+//#region src/generated/model/deleteTeamParams.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2887,14 +2968,14 @@ type DeactivateFlowDefinitionParams = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type DeleteFlowDefinitionParams = {
+type DeleteTeamParams = {
   /**
-   * The project id to filter by.
+   * The unique identifier of the project
    * @pattern ^[a-zA-Z0-9_-]+$
    */
   project_id: string;
 }; //#endregion
-//#region src/generated/model/endSession400Details.d.ts
+//#region src/generated/model/deleteUserByID401Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2906,7 +2987,7 @@ type DeleteFlowDefinitionParams = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/endSessionParams.d.ts
+//#region src/generated/model/deleteUserByIDParams.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2914,48 +2995,12 @@ type DeleteFlowDefinitionParams = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type EndSessionParams = {
-  /**
-  * The client ID is the identifier for the client application that is making
-  the request. This is used by the authorization server to identify the
-  client and to determine whether it is authorized to perform the requested
-  action.
-    */
-  client_id?: string;
-  /**
-  * The ID token hint is a previously issued ID token that can be used to
-  pre-fill the authentication form or to provide information about the
-  user to the authorization server. This can be useful for single sign-on
-  scenarios or for providing a smoother user experience.
-    */
-  id_token_hint?: string;
+type DeleteUserByIDParams = {
   /**
-  * The logout hint is a hint to the authorization server about the login
-  identifier of the user. This can be used to pre-fill the username or email
-  field in the logout form, making it easier for the user to log out.
-    */
-  logout_hint?: string;
-  /**
-  * The post logout redirect URI is the URI to which the user will be
-  redirected after they have logged out. This must be a registered URI
-  for the client application and is used to ensure that the user is
-  redirected to a safe location after logging out.
-    */
-  post_logout_redirect_uri?: string;
-  /**
-  * The state parameter is an opaque value that is used by the client to
-  maintain state between the request and the callback. It is typically used
-  to prevent cross-site request forgery (CSRF) attacks by including a unique
-  value in the request that the client can verify when it receives the callback.
-    */
-  state?: string;
-  /**
-  * The ui_locales parameter is a space-separated list of BCP47 language tags
-  that are used to indicate the preferred languages and scripts for the user
-  interface. This can be used by the authorization server to display the logout
-  page in the user's preferred language.
-    */
-  ui_locales?: string;
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
 }; //#endregion
 //#region src/generated/model/exchangeHandoff200SessionFactorsItemMethod.d.ts
 /**
@@ -3043,7 +3088,6 @@ type ExchangeHandoff200SessionMetadata = {
 - `building`: has a user factor but is still gathering authentication factors
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
-- `revoked`: explicitly revoked via DELETE
 
  */
 type ExchangeHandoff200SessionState = (typeof ExchangeHandoff200SessionState)[keyof typeof ExchangeHandoff200SessionState];
@@ -3051,7 +3095,6 @@ declare const ExchangeHandoff200SessionState: {
   readonly building: "building";
   readonly active: "active";
   readonly expired: "expired";
-  readonly revoked: "revoked";
 }; //#endregion
 //#region src/generated/model/exchangeHandoff200SessionUserAgent.d.ts
 /**
@@ -3081,8 +3124,8 @@ in through `auth_attempts`.
  */
 type ExchangeHandoff200Session = {
   /**
-   * Unique identifier for this session.
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this session (dialect-minted prefixed opaque string).
+   * @pattern ^sess_[a-zA-Z0-9_-]+$
    */
   session_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
@@ -3090,7 +3133,6 @@ type ExchangeHandoff200Session = {
   - `building`: has a user factor but is still gathering authentication factors
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
-  - `revoked`: explicitly revoked via DELETE
    */
   state: ExchangeHandoff200SessionState;
   /** The authenticated user. Null for anonymous sessions and until the `user`
@@ -3187,7 +3229,7 @@ type ExchangeHandoffBody = {
    */
   ttl?: string;
 }; //#endregion
-//#region src/generated/model/exchangeHandoffDefaultDetails.d.ts
+//#region src/generated/model/exchangeHandoffDefault.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3195,9 +3237,6 @@ type ExchangeHandoffBody = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
 //#endregion
 //#region src/generated/model/exchangeHandoffParams.d.ts
 /**
@@ -3293,8 +3332,8 @@ The client verifies the proof by POST /auth_attempts/{attempt_id}/challenges/{ch
  */
 type GetAuthAttempt200ChallengesItem = {
   /**
-   * Unique identifier for this challenge
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this challenge (dialect-minted prefixed opaque string).
+   * @pattern ^ch_[a-zA-Z0-9_-]+$
    */
   challenge_id: string; /** An authentication factor method. */
   method: GetAuthAttempt200ChallengesItemMethod;
@@ -3426,8 +3465,8 @@ Clients drive the attempt by:
  */
 type GetAuthAttempt200 = {
   /**
-   * Unique identifier for this authentication attempt
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this authentication attempt (dialect-minted prefixed opaque string).
+   * @pattern ^att_[a-zA-Z0-9_-]+$
    */
   attempt_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
@@ -3475,6 +3514,162 @@ type GetAuthAttempt200 = {
  * OpenAPI spec version: 0.0.1
  */
 //#endregion
+//#region src/generated/model/getBrandingById200BrandingLayout.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Layout preset selector. The default.liquid master template uses this
+to branch into layout variants. Customers who eject the template
+can ignore this field entirely; it also serves as the degrade target
+when a custom template fails component-side validation.
+
+ */
+type GetBrandingById200BrandingLayout = (typeof GetBrandingById200BrandingLayout)[keyof typeof GetBrandingById200BrandingLayout];
+declare const GetBrandingById200BrandingLayout: {
+  readonly centered: "centered";
+  readonly split: "split";
+}; //#endregion
+//#region src/generated/model/getBrandingById200Branding.d.ts
+/**
+ * Branding configuration. Appears in two places with one shape:
+
+- On flow responses as a read-only projection: the server resolves the
+  latest branding revision for the project per step response (falling
+  back to built-in defaults when none is stored). Branding is configured
+  via the Branding API / `zitadel apply`, not the Flow API.
+- As the request body of `POST /branding`, which publishes the same
+  shape as a new immutable revision (see ADR 040).
+
+ */
+type GetBrandingById200Branding = {
+  /** Layout preset selector. The default.liquid master template uses this
+  to branch into layout variants. Customers who eject the template
+  can ignore this field entirely; it also serves as the degrade target
+  when a custom template fails component-side validation.
+   */
+  layout?: GetBrandingById200BrandingLayout;
+  /**
+     * The LiquidJS template string for rendering this step. The orchestrator
+  parses this template, injects the capability dictionaries as context,
+  and renders the output HTML into its Shadow DOM.
+        * @maxLength 131072
+     */
+  liquid_template?: string; /** Team logo URL. */
+  logo_url?: string;
+  /** Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in
+  v1: `POST /branding` rejects a non-empty value, because the login
+  component loads this stylesheet at document level (shadow-scoped
+  `@font-face` rules never register faces) and an arbitrary URL would
+  grant `branding.write` page-wide CSS control over the embedding
+  application. Safe tenant font delivery is an ADR 040 follow-up;
+  until then, load fonts from the embedding page.
+   */
+  font_url?: string; /** Hero/background image URL (used by split layout). */
+  hero_url?: string;
+}; //#endregion
+//#region src/generated/model/getBrandingById200.d.ts
+/**
+ * A stored branding revision. `branding` echoes the canonical stored
+configuration so clients (e.g. the CLI sync engine) can reconcile local
+files with the server's stored state.
+
+ */
+type GetBrandingById200 = {
+  /** The unique identifier of this branding revision. */id: string; /** When this revision was published. */
+  created_at: string;
+  /** Branding configuration. Appears in two places with one shape:
+     - On flow responses as a read-only projection: the server resolves the
+    latest branding revision for the project per step response (falling
+    back to built-in defaults when none is stored). Branding is configured
+    via the Branding API / `zitadel apply`, not the Flow API.
+  - As the request body of `POST /branding`, which publishes the same
+    shape as a new immutable revision (see ADR 040).
+   */
+  branding: GetBrandingById200Branding;
+}; //#endregion
+//#region src/generated/model/getBrandingById404Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/getBrandingByIdParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type GetBrandingByIdParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+}; //#endregion
+//#region src/generated/model/getClaimStatus200.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The state of a claim challenge. While pending it carries only `status`; once
+completed it also carries the owning team, the claim timestamp, and the
+dashboard URL. Modelled as discriminated variants so a `pending` response can
+never carry stale completion fields and a `completed` response always carries
+them.
+
+ */
+type GetClaimStatus200 = {
+  /** The claim has not completed yet. */status: "pending";
+} | {
+  /** The claim has completed. */status: "completed"; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  team_id: string; /** The time when the project was claimed. */
+  claimed_at: string; /** The dashboard URL for the owning team. */
+  dashboard_url: string;
+}; //#endregion
+//#region src/generated/model/getClaimStatus401Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/getClaimStatusParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type GetClaimStatusParams = {
+  /**
+   * Unique identifier for this challenge (dialect-minted prefixed opaque string).
+   * @pattern ^ch_[a-zA-Z0-9_-]+$
+   */
+  challenge_id: string;
+}; //#endregion
 //#region src/generated/model/getFlowDefinition200FlowDefinitionAudience.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -3855,7 +4050,7 @@ type GetFlowDefinition200 = {
   created_at: string;
   updated_at: string;
 }; //#endregion
-//#region src/generated/model/getFlowDefinitionDefaultDetails.d.ts
+//#region src/generated/model/getFlowDefinitionDefault.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3863,9 +4058,6 @@ type GetFlowDefinition200 = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
 //#endregion
 //#region src/generated/model/getFlowDefinitionParams.d.ts
 /**
@@ -3893,7 +4085,8 @@ type GetFlowDefinitionParams = {
 /**
  * Layout preset selector. The default.liquid master template uses this
 to branch into layout variants. Customers who eject the template
-can ignore this field entirely.
+can ignore this field entirely; it also serves as the degrade target
+when a custom template fails component-side validation.
 
  */
 type GetFlowStep200BrandingLayout = (typeof GetFlowStep200BrandingLayout)[keyof typeof GetFlowStep200BrandingLayout];
@@ -3903,23 +4096,39 @@ declare const GetFlowStep200BrandingLayout: {
 }; //#endregion
 //#region src/generated/model/getFlowStep200Branding.d.ts
 /**
- * Resolved branding configuration. Inherited from the app → team → project
-hierarchy at flow creation time (most specific wins). Read-only projection —
-branding is configured via the Team/App Branding API, not the Flow API.
+ * Branding configuration. Appears in two places with one shape:
+
+- On flow responses as a read-only projection: the server resolves the
+  latest branding revision for the project per step response (falling
+  back to built-in defaults when none is stored). Branding is configured
+  via the Branding API / `zitadel apply`, not the Flow API.
+- As the request body of `POST /branding`, which publishes the same
+  shape as a new immutable revision (see ADR 040).
 
  */
 type GetFlowStep200Branding = {
   /** Layout preset selector. The default.liquid master template uses this
   to branch into layout variants. Customers who eject the template
-  can ignore this field entirely.
+  can ignore this field entirely; it also serves as the degrade target
+  when a custom template fails component-side validation.
    */
   layout?: GetFlowStep200BrandingLayout;
-  /** The LiquidJS template string for rendering this step. The orchestrator
+  /**
+     * The LiquidJS template string for rendering this step. The orchestrator
   parses this template, injects the capability dictionaries as context,
   and renders the output HTML into its Shadow DOM.
-   */
+        * @maxLength 131072
+     */
   liquid_template?: string; /** Team logo URL. */
-  logo_url?: string; /** Custom font URL (e.g., Google Fonts CSS). */
+  logo_url?: string;
+  /** Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in
+  v1: `POST /branding` rejects a non-empty value, because the login
+  component loads this stylesheet at document level (shadow-scoped
+  `@font-face` rules never register faces) and an arbitrary URL would
+  grant `branding.write` page-wide CSS control over the embedding
+  application. Safe tenant font delivery is an ADR 040 follow-up;
+  until then, load fonts from the embedding page.
+   */
   font_url?: string; /** Hero/background image URL (used by split layout). */
   hero_url?: string;
 }; //#endregion
@@ -4296,9 +4505,11 @@ type GetFlowStep200Step = {
   (e.g. `error.email_required`; the `format` rule is spelled
   `error.<field>_invalid`), multiple violations joined with `"; "`.
   Field names appear verbatim, so clients localise unknown keys via
-  the generic `error.field_<rule>` catalog entries. Other failures
-  carry a verbatim diagnostic token instead (e.g. `user_not_found`,
-  `auth_attempt.password_invalid`).
+  the generic `error.field_<rule>` catalog entries. Other engine
+  failures carry `error.*` catalog keys as well (e.g.
+  `error.invalid_credentials`, `error.passkey_invalid`); a
+  non-`error.` payload is an outcome token (e.g. `user_not_found`)
+  that clients keep verbatim.
    */
   error?: string | null;
   /** Present only on terminal steps. Tells the frontend what to do:
@@ -4347,9 +4558,13 @@ type GetFlowStep200 = {
   and builds name-keyed indexes locally for lookup.
    */
   step: GetFlowStep200Step;
-  /** Resolved branding configuration. Inherited from the app → team → project
-  hierarchy at flow creation time (most specific wins). Read-only projection —
-  branding is configured via the Team/App Branding API, not the Flow API.
+  /** Branding configuration. Appears in two places with one shape:
+     - On flow responses as a read-only projection: the server resolves the
+    latest branding revision for the project per step response (falling
+    back to built-in defaults when none is stored). Branding is configured
+    via the Branding API / `zitadel apply`, not the Flow API.
+  - As the request body of `POST /branding`, which publishes the same
+    shape as a new immutable revision (see ADR 040).
    */
   branding?: GetFlowStep200Branding; /** Present when `step.complete` is `redirect`. */
   redirect_uri?: string;
@@ -4398,53 +4613,7 @@ type GetHealthDefault = {
   message: string; /** Additional error-specific context. */
   details?: GetHealthDefaultDetails;
 }; //#endregion
-//#region src/generated/model/getKeys4xxDetails.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Additional error-specific context.
- */
-//#endregion
-//#region src/generated/model/getKeys200KeysItem.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type GetKeys200KeysItem = {
-  use?: string;
-  kty?: string;
-  kid?: string;
-  crv?: string;
-  alg?: string;
-  k?: string;
-  x?: string;
-  y?: string;
-  n?: string;
-  e?: string;
-  d?: string;
-  p?: string;
-  q?: string;
-  dp?: string;
-  dq?: string;
-  qi?: string;
-  x5c?: string[];
-  x5u?: string;
-  x5t?: string;
-  x5tS256?: string;
-}; //#endregion
-//#region src/generated/model/getKeys200.d.ts
-type GetKeys200 = {
-  keys?: GetKeys200KeysItem[];
-}; //#endregion
-//#region src/generated/model/getKeysDefaultDetails.d.ts
+//#region src/generated/model/getLive4xxDetails.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -4565,7 +4734,6 @@ type GetMySession200Metadata = {
 - `building`: has a user factor but is still gathering authentication factors
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
-- `revoked`: explicitly revoked via DELETE
 
  */
 type GetMySession200State = (typeof GetMySession200State)[keyof typeof GetMySession200State];
@@ -4573,7 +4741,6 @@ declare const GetMySession200State: {
   readonly building: "building";
   readonly active: "active";
   readonly expired: "expired";
-  readonly revoked: "revoked";
 }; //#endregion
 //#region src/generated/model/getMySession200UserAgent.d.ts
 /**
@@ -4603,8 +4770,8 @@ in through `auth_attempts`.
  */
 type GetMySession200 = {
   /**
-   * Unique identifier for this session.
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this session (dialect-minted prefixed opaque string).
+   * @pattern ^sess_[a-zA-Z0-9_-]+$
    */
   session_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
@@ -4612,7 +4779,6 @@ type GetMySession200 = {
   - `building`: has a user factor but is still gathering authentication factors
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
-  - `revoked`: explicitly revoked via DELETE
    */
   state: GetMySession200State;
   /** The authenticated user. Null for anonymous sessions and until the `user`
@@ -4656,30 +4822,7 @@ type GetMySession200 = {
    */
   expires_at: string;
 }; //#endregion
-//#region src/generated/model/getMySession401Details.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Additional error-specific context.
- */
-//#endregion
-//#region src/generated/model/getMyUser200.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type GetMyUser200 = {
-  [key: string]: unknown;
-}; //#endregion
-//#region src/generated/model/getMyUser401Details.d.ts
+//#region src/generated/model/getMySession401.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -4688,39 +4831,13 @@ type GetMyUser200 = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
+ * The request lacks valid authentication credentials.
+
+Error code: auth.unauthorized
+
  */
 //#endregion
-//#region src/generated/model/getOpenIDConfiguration200ClaimTypesSupportedItem.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type GetOpenIDConfiguration200ClaimTypesSupportedItem = (typeof GetOpenIDConfiguration200ClaimTypesSupportedItem)[keyof typeof GetOpenIDConfiguration200ClaimTypesSupportedItem];
-declare const GetOpenIDConfiguration200ClaimTypesSupportedItem: {
-  readonly normal: "normal";
-  readonly aggregated: "aggregated";
-  readonly distributed: "distributed";
-}; //#endregion
-//#region src/generated/model/getOpenIDConfiguration200DisplayValuesSupportedItem.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type GetOpenIDConfiguration200DisplayValuesSupportedItem = (typeof GetOpenIDConfiguration200DisplayValuesSupportedItem)[keyof typeof GetOpenIDConfiguration200DisplayValuesSupportedItem];
-declare const GetOpenIDConfiguration200DisplayValuesSupportedItem: {
-  readonly page: "page";
-  readonly popup: "popup";
-  readonly touch: "touch";
-  readonly wap: "wap";
-}; //#endregion
-//#region src/generated/model/getOpenIDConfiguration200SubjectTypesSupportedItem.d.ts
+//#region src/generated/model/getMyUser200MetadataStatus.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -4728,68 +4845,46 @@ declare const GetOpenIDConfiguration200DisplayValuesSupportedItem: {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type GetOpenIDConfiguration200SubjectTypesSupportedItem = (typeof GetOpenIDConfiguration200SubjectTypesSupportedItem)[keyof typeof GetOpenIDConfiguration200SubjectTypesSupportedItem];
-declare const GetOpenIDConfiguration200SubjectTypesSupportedItem: {
-  readonly public: "public";
-  readonly pairwise: "pairwise";
-}; //#endregion
-//#region src/generated/model/getOpenIDConfiguration200TokenEndpointAuthMethodsSupportedItem.d.ts
 /**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
+ * The status of the user.
  */
-type GetOpenIDConfiguration200TokenEndpointAuthMethodsSupportedItem = (typeof GetOpenIDConfiguration200TokenEndpointAuthMethodsSupportedItem)[keyof typeof GetOpenIDConfiguration200TokenEndpointAuthMethodsSupportedItem];
-declare const GetOpenIDConfiguration200TokenEndpointAuthMethodsSupportedItem: {
-  readonly client_secret_post: "client_secret_post";
-  readonly client_secret_basic: "client_secret_basic";
-  readonly client_secret_jwt: "client_secret_jwt";
-  readonly private_key_jwt: "private_key_jwt";
+type GetMyUser200MetadataStatus = (typeof GetMyUser200MetadataStatus)[keyof typeof GetMyUser200MetadataStatus];
+declare const GetMyUser200MetadataStatus: {
+  readonly active: "active";
+  readonly suspended: "suspended";
+  readonly deactivated: "deactivated";
+  readonly pending_purge: "pending_purge";
+}; //#endregion
+//#region src/generated/model/getMyUser200Metadata.d.ts
+type GetMyUser200Metadata = {
+  /** The time when the user was created. */created_at: string; /** The time when the user was last updated. */
+  updated_at: string; /** The status of the user. */
+  status: GetMyUser200MetadataStatus;
+  /** The team that owns this user's identity lifecycle, or `null` when the
+  user is self-owned. This is a single team and a different concept from
+  the user's team roster: it decides who may deprovision the user, not
+  which teams the user collaborates in. The roster is its own paginated
+  resource — `GET /users/{user_id}/teams`.
+   */
+  lifecycle_owner_team_id?: string | null;
 }; //#endregion
-//#region src/generated/model/getOpenIDConfiguration200.d.ts
+//#region src/generated/model/getMyUser200.d.ts
 /**
- * OpenID Connect configuration according to the OpenID Connect Discovery 1.0 specification.
+ * A user represents an individual identity in the system. It can be used to
+represent a human user, but also a service account or any other type of
+identity. The content of a user is determined by the configured schema for
+users, this is only a base schema.
+
+The server assigns the resource primary key (`id`) on create. Clients must
+not send `id` in the create body; it is returned in the create response.
+
  */
-type GetOpenIDConfiguration200 = {
-  /** REQUIRED. URL using the https scheme with no query or fragment components that the OP asserts as its Issuer Identifier. */issuer: string; /** REQUIRED. URL of the OP's OAuth 2.0 Authorization Endpoint. */
-  authorization_endpoint: string; /** URL of the OP's OAuth 2.0 Token Endpoint. REQUIRED unless only the Implicit Flow is used. */
-  token_endpoint?: string; /** RECOMMENDED. URL of the OP's UserInfo Endpoint. */
-  userinfo_endpoint?: string; /** REQUIRED. URL of the OP's JWK Set document containing the signing key(s) the RP uses to validate signatures from the OP. */
-  jwks_uri: string; /** RECOMMENDED. URL of the OP's Dynamic Client Registration Endpoint. */
-  registration_endpoint?: string; /** RECOMMENDED. JSON array containing a list of the OAuth 2.0 scope values that this server supports. The server MUST support the openid scope value. */
-  scopes_supported?: string[]; /** REQUIRED. JSON array containing a list of the OAuth 2.0 response_type values that this OP supports. */
-  response_types_supported: string[]; /** OPTIONAL. JSON array containing a list of the OAuth 2.0 response_mode values that this OP supports. Default is ["query", "fragment"]. */
-  response_modes_supported?: string[]; /** OPTIONAL. JSON array containing a list of the OAuth 2.0 Grant Type values that this OP supports. Default is ["authorization_code", "implicit"]. */
-  grant_types_supported?: string[]; /** OPTIONAL. JSON array containing a list of the Authentication Context Class References that this OP supports. */
-  acr_values_supported?: string[]; /** REQUIRED. JSON array containing a list of the Subject Identifier types that this OP supports. Valid types include pairwise and public. */
-  subject_types_supported: GetOpenIDConfiguration200SubjectTypesSupportedItem[]; /** REQUIRED. JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for the ID Token. The algorithm RS256 MUST be included. */
-  id_token_signing_alg_values_supported: string[]; /** OPTIONAL. JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token. */
-  id_token_encryption_alg_values_supported?: string[]; /** OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token. */
-  id_token_encryption_enc_values_supported?: string[]; /** OPTIONAL. JSON array containing a list of the JWS signing algorithms (alg values) supported by the UserInfo Endpoint. */
-  userinfo_signing_alg_values_supported?: string[]; /** OPTIONAL. JSON array containing a list of the JWE encryption algorithms (alg values) supported by the UserInfo Endpoint. */
-  userinfo_encryption_alg_values_supported?: string[]; /** OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the UserInfo Endpoint. */
-  userinfo_encryption_enc_values_supported?: string[]; /** OPTIONAL. JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects. Servers SHOULD support none and RS256. */
-  request_object_signing_alg_values_supported?: string[]; /** OPTIONAL. JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects. */
-  request_object_encryption_alg_values_supported?: string[]; /** OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects. */
-  request_object_encryption_enc_values_supported?: string[]; /** OPTIONAL. JSON array containing a list of Client Authentication methods supported by the Token Endpoint. Default is client_secret_basic. */
-  token_endpoint_auth_methods_supported?: GetOpenIDConfiguration200TokenEndpointAuthMethodsSupportedItem[]; /** OPTIONAL. JSON array containing a list of the JWS signing algorithms supported by the Token Endpoint for private_key_jwt and client_secret_jwt authentication. The value none MUST NOT be used. */
-  token_endpoint_auth_signing_alg_values_supported?: string[]; /** OPTIONAL. JSON array containing a list of the display parameter values that the OpenID Provider supports. */
-  display_values_supported?: GetOpenIDConfiguration200DisplayValuesSupportedItem[]; /** OPTIONAL. JSON array containing a list of the Claim Types that the OpenID Provider supports. Default is normal. */
-  claim_types_supported?: GetOpenIDConfiguration200ClaimTypesSupportedItem[]; /** RECOMMENDED. JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. */
-  claims_supported?: string[]; /** OPTIONAL. URL of a page containing human-readable information for developers using the OpenID Provider. */
-  service_documentation?: string; /** OPTIONAL. Languages and scripts supported for values in Claims being returned, as BCP47 language tag values. */
-  claims_locales_supported?: string[]; /** OPTIONAL. Languages and scripts supported for the user interface, as BCP47 language tag values. */
-  ui_locales_supported?: string[]; /** OPTIONAL. Boolean value specifying whether the OP supports use of the claims parameter. Default is false. */
-  claims_parameter_supported?: boolean; /** OPTIONAL. Boolean value specifying whether the OP supports use of the request parameter. Default is false. */
-  request_parameter_supported?: boolean; /** OPTIONAL. Boolean value specifying whether the OP supports use of the request_uri parameter. Default is true. */
-  request_uri_parameter_supported?: boolean; /** OPTIONAL. Boolean value specifying whether the OP requires any request_uri values used to be pre-registered. Default is false. */
-  require_request_uri_registration?: boolean; /** OPTIONAL. URL the OP provides to the person registering the Client about the OP's requirements on how the Relying Party can use the data provided. */
-  op_policy_uri?: string; /** OPTIONAL. URL the OP provides to the person registering the Client about the OpenID Provider's terms of service. */
-  op_tos_uri?: string;
+type GetMyUser200 = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id?: string;
+  metadata?: GetMyUser200Metadata;
+  [key: string]: unknown;
 }; //#endregion
-//#region src/generated/model/getOpenIDConfigurationDefaultDetails.d.ts
+//#region src/generated/model/getMyUser401Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -4817,9 +4912,9 @@ type GetProject200 = {
   name: string;
   /** Origins which are allowed for previewing and testing the project.
    */
-  previewOrigins?: string[]; /** The time when the project was created. */
-  createdAt: string; /** The time when the project was last updated. */
-  updatedAt: string;
+  preview_origins?: string[]; /** The time when the project was created. */
+  created_at: string; /** The time when the project was last updated. */
+  updated_at: string;
 }; //#endregion
 //#region src/generated/model/getProject401Details.d.ts
 /**
@@ -4923,8 +5018,13 @@ type GetSchemaById200 = {
       "x-unique"?: "unspecified" | "project" | "team" | null; /** The claim name for this property, if applicable */
       "x-claim"?: string | null; /** Whether this property is editable by the user or not */
       "x-editable"?: boolean; /** Whether this property contains sensitive information or not */
-      "x-sensitive"?: boolean; /** Whether this property is used for multi-factor authentication or not */
-      "x-mfa"?: boolean; /** A map of additional properties for the user definition, where the key is the property name and the value is the property schema */
+      "x-sensitive"?: boolean;
+      /** Whether this property is used for multi-factor authentication or not
+       */
+      "x-mfa"?: boolean;
+      /** A map of additional properties for the user definition, where the key is
+      the property name and the value is the property schema.
+      */
       properties?: {
         [key: string]: unknown;
       };
@@ -5051,7 +5151,6 @@ type GetSession200Metadata = {
 - `building`: has a user factor but is still gathering authentication factors
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
-- `revoked`: explicitly revoked via DELETE
 
  */
 type GetSession200State = (typeof GetSession200State)[keyof typeof GetSession200State];
@@ -5059,7 +5158,6 @@ declare const GetSession200State: {
   readonly building: "building";
   readonly active: "active";
   readonly expired: "expired";
-  readonly revoked: "revoked";
 }; //#endregion
 //#region src/generated/model/getSession200UserAgent.d.ts
 /**
@@ -5089,8 +5187,8 @@ in through `auth_attempts`.
  */
 type GetSession200 = {
   /**
-   * Unique identifier for this session.
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this session (dialect-minted prefixed opaque string).
+   * @pattern ^sess_[a-zA-Z0-9_-]+$
    */
   session_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
@@ -5098,7 +5196,6 @@ type GetSession200 = {
   - `building`: has a user factor but is still gathering authentication factors
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
-  - `revoked`: explicitly revoked via DELETE
    */
   state: GetSession200State;
   /** The authenticated user. Null for anonymous sessions and until the `user`
@@ -5169,7 +5266,7 @@ type GetSessionParams = {
    */
   project_id: string;
 }; //#endregion
-//#region src/generated/model/getTeam200.d.ts
+//#region src/generated/model/getTeam200Status.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5178,12 +5275,31 @@ type GetSessionParams = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * The current state of a team.
+ * The lifecycle state of a team.
+
+active: The team is available for use.
+deactivated: The team is no longer active but is retained for historical and audit purposes.
+
+ */
+type GetTeam200Status = (typeof GetTeam200Status)[keyof typeof GetTeam200Status];
+declare const GetTeam200Status: {
+  readonly active: "active";
+  readonly deactivated: "deactivated";
+}; //#endregion
+//#region src/generated/model/getTeam200.d.ts
+/**
+ * Details of a team.
  */
 type GetTeam200 = {
-  /** The unique identifier of the team. */id: string; /** The time when the team was created. */
-  createdAt: string; /** The time when the team was last updated. */
-  updatedAt: string;
+  /** The unique identifier of the team. */id: string; /** The name of the team. */
+  name: string;
+  /** The lifecycle state of a team.
+     active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
+   */
+  status: GetTeam200Status; /** The time when the team was created. */
+  created_at: string; /** The time when the team was last updated. */
+  updated_at: string;
 }; //#endregion
 //#region src/generated/model/getTeam401Details.d.ts
 /**
@@ -5212,7 +5328,7 @@ type GetTeamParams = {
    */
   project_id: string;
 }; //#endregion
-//#region src/generated/model/getToken4xxDetails.d.ts
+//#region src/generated/model/getUserByID200MetadataStatus.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5221,10 +5337,45 @@ type GetTeamParams = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
+ * The status of the user.
  */
-//#endregion
-//#region src/generated/model/getToken200.d.ts
+type GetUserByID200MetadataStatus = (typeof GetUserByID200MetadataStatus)[keyof typeof GetUserByID200MetadataStatus];
+declare const GetUserByID200MetadataStatus: {
+  readonly active: "active";
+  readonly suspended: "suspended";
+  readonly deactivated: "deactivated";
+  readonly pending_purge: "pending_purge";
+}; //#endregion
+//#region src/generated/model/getUserByID200Metadata.d.ts
+type GetUserByID200Metadata = {
+  /** The time when the user was created. */created_at: string; /** The time when the user was last updated. */
+  updated_at: string; /** The status of the user. */
+  status: GetUserByID200MetadataStatus;
+  /** The team that owns this user's identity lifecycle, or `null` when the
+  user is self-owned. This is a single team and a different concept from
+  the user's team roster: it decides who may deprovision the user, not
+  which teams the user collaborates in. The roster is its own paginated
+  resource — `GET /users/{user_id}/teams`.
+   */
+  lifecycle_owner_team_id?: string | null;
+}; //#endregion
+//#region src/generated/model/getUserByID200.d.ts
+/**
+ * A user represents an individual identity in the system. It can be used to
+represent a human user, but also a service account or any other type of
+identity. The content of a user is determined by the configured schema for
+users, this is only a base schema.
+
+The server assigns the resource primary key (`id`) on create. Clients must
+not send `id` in the create body; it is returned in the create response.
+
+ */
+type GetUserByID200 = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id?: string;
+  metadata?: GetUserByID200Metadata;
+  [key: string]: unknown;
+}; //#endregion
+//#region src/generated/model/getUserByID401Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5232,13 +5383,11 @@ type GetTeamParams = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type GetToken200 = {
-  /** The access token issued by the authorization server. */access_token?: string; /** The type of the token issued (e.g., Bearer). */
-  token_type?: string; /** The lifetime in seconds of the access token. */
-  expires_in?: number; /** The refresh token which can be used to obtain new access tokens. */
-  refresh_token?: string;
-}; //#endregion
-//#region src/generated/model/getTokenBodyGrantType.d.ts
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/getUserByIDParams.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5246,48 +5395,19 @@ type GetToken200 = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * The type of grant being requested.
- */
-type GetTokenBodyGrantType = (typeof GetTokenBodyGrantType)[keyof typeof GetTokenBodyGrantType];
-declare const GetTokenBodyGrantType: {
-  readonly authorization_code: "authorization_code";
-  readonly client_credentials: "client_credentials";
-  readonly password: "password";
-  readonly refresh_token: "refresh_token";
-}; //#endregion
-//#region src/generated/model/getTokenBody.d.ts
-type GetTokenBody = {
-  /** The authorization code received from the authorization server. Required
-  for the authorization_code grant type.
-   */
-  code?: string;
-  /** The client assertion, typically a JWT, used for client authentication.
-   */
-  client_assertion?: string;
-  /** The type of client assertion being used. Required when the client is
-  authenticating using a JWT assertion.
-   */
-  client_assertion_type?: string;
-  /** The client identifier issued to the client during the registration
-  process. Required for all grant types.
-   */
-  client_id?: string;
-  /** The client secret issued to the client during the registration process.
-  Required for all grant types except when using public clients.
-   */
-  client_secret?: string;
-  /** The code verifier used in PKCE (Proof Key for Code Exchange) flows. Required
-  for the authorization_code grant type when PKCE is used.
+type GetUserByIDParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
    */
-  code_verifier?: string; /** The type of grant being requested. */
-  grant_type?: GetTokenBodyGrantType;
-  /** The redirect URI used in the authorization request. Required for the
-  authorization_code grant type.
+  project_id: string;
+  /**
+   * The unique identifier of the team
+   * @pattern ^[a-zA-Z0-9_-]+$
    */
-  redirect_uri?: string;
+  team_id?: string;
 }; //#endregion
-//#region src/generated/model/getTokenDefaultDetails.d.ts
+//#region src/generated/model/initClaim201.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5296,140 +5416,21 @@ type GetTokenBody = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
+ * The claim challenge minted for a project.
  */
-//#endregion
-//#region src/generated/model/getUserByID200.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type GetUserByID200 = {
-  [key: string]: unknown;
-}; //#endregion
-//#region src/generated/model/getUserByID401Details.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Additional error-specific context.
- */
-//#endregion
-//#region src/generated/model/getUserByIDParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type GetUserByIDParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
+type InitClaim201 = {
+  /** The browser URL a developer opens to complete the claim. It embeds the
+  `challenge_id` so the browser leg does not need the project secret.
    */
-  project_id: string;
+  claim_url: string;
   /**
-   * The unique identifier of the team
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this challenge (dialect-minted prefixed opaque string).
+   * @pattern ^ch_[a-zA-Z0-9_-]+$
    */
-  team_id?: string;
-}; //#endregion
-//#region src/generated/model/getUserInfo4xxDetails.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Additional error-specific context.
- */
-//#endregion
-//#region src/generated/model/getUserInfo200.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type GetUserInfo200 = {
-  /** The unique identifier for the user. */sub?: string; /** The full name of the user. */
-  name?: string; /** The email address of the user. */
-  email?: string; /** The preferred username of the user. */
-  preferred_username?: string; /** The URL of the user's profile picture. */
-  picture?: string; /** The given name of the user. */
-  given_name?: string; /** The family name of the user. */
-  family_name?: string;
-}; //#endregion
-//#region src/generated/model/getUserInfoDefaultDetails.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Additional error-specific context.
- */
-//#endregion
-//#region src/generated/model/introspect200.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type Introspect200 = {
-  /** Indicates whether the token is active */active?: boolean; /** The audience of the token (if applicable) */
-  aud?: string; /** The client ID associated with the token */
-  client_id?: string; /** The expiration time of the token (in seconds since epoch) */
-  exp?: number; /** The time the token was issued (in seconds since epoch) */
-  iat?: number; /** The issuer of the token (if applicable) */
-  iss?: string; /** The unique identifier for the token (if applicable) */
-  jti?: string; /** The time before which the token is not valid (in seconds since epoch) */
-  nbf?: number; /** The scopes associated with the token */
-  scope?: string; /** The subject of the token (if applicable) */
-  sub?: string; /** The type of the token (access_token or refresh_token) */
-  token_type?: string; /** The username associated with the token (if applicable) */
-  username?: string;
-}; //#endregion
-//#region src/generated/model/introspect400Details.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Additional error-specific context.
- */
-//#endregion
-//#region src/generated/model/introspectBody.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type IntrospectBody = {
-  /** The token to introspect */token: string; /** A hint about the type of the token (access_token or refresh_token) */
-  token_type_hint?: string;
+  challenge_id: string; /** The time when the claim challenge expires. */
+  expires_at: string;
 }; //#endregion
-//#region src/generated/model/introspectDefaultDetails.d.ts
+//#region src/generated/model/initClaim401Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5520,8 +5521,8 @@ The client verifies the proof by POST /auth_attempts/{attempt_id}/challenges/{ch
  */
 type IssueChallenge201 = {
   /**
-   * Unique identifier for this challenge
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this challenge (dialect-minted prefixed opaque string).
+   * @pattern ^ch_[a-zA-Z0-9_-]+$
    */
   challenge_id: string; /** An authentication factor method. */
   method: IssueChallenge201Method;
@@ -5604,6 +5605,45 @@ type IssueChallengeBody = {
  * OpenAPI spec version: 0.0.1
  */
 //#endregion
+//#region src/generated/model/listBranding200Item.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type ListBranding200Item = {
+  /** The unique identifier of this branding revision. */id: string; /** When this revision was published. */
+  created_at: string;
+}; //#endregion
+//#region src/generated/model/listBrandingDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/listBrandingParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type ListBrandingParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+}; //#endregion
 //#region src/generated/model/listFlowDefinitions200FlowDefinitionsItemStatus.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -5725,7 +5765,7 @@ type ListFlowDefinitionsParams = {
  */
 type ListSchemas200Item = {
   /** The unique identifier for this schema. */id: string;
-  createdAt: string;
+  created_at: string;
 }; //#endregion
 //#region src/generated/model/listSchemasDefaultDetails.d.ts
 /**
@@ -5771,7 +5811,7 @@ type ListSchemasParams = {
    */
   object_type?: string;
 }; //#endregion
-//#region src/generated/model/listSessions200SessionsItemFactorsItemMethod.d.ts
+//#region src/generated/model/listUserPasskeys200PasskeysItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5779,16 +5819,23 @@ type ListSchemasParams = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+type ListUserPasskeys200PasskeysItem = {
+  /** The unique identifier of the passkey. */id: string; /** The name of the passkey. */
+  name: string; /** The timestamp when the passkey was created. */
+  created_at: string;
+}; //#endregion
+//#region src/generated/model/listUserPasskeys200.d.ts
 /**
- * An authentication factor method.
+ * Response containing the user's passkeys.
  */
-type ListSessions200SessionsItemFactorsItemMethod = (typeof ListSessions200SessionsItemFactorsItemMethod)[keyof typeof ListSessions200SessionsItemFactorsItemMethod];
-declare const ListSessions200SessionsItemFactorsItemMethod: {
-  readonly identifier: "identifier";
-  readonly password: "password";
-  readonly passkey: "passkey";
+type ListUserPasskeys200 = {
+  passkeys: ListUserPasskeys200PasskeysItem[];
+  /** Token to pass as `page_token` in the next request to fetch the following page.
+  Absent when there are no more results.
+   */
+  next_page_token?: string | null;
 }; //#endregion
-//#region src/generated/model/listSessions200SessionsItemFactorsItemPayload.d.ts
+//#region src/generated/model/listUserPasskeys400Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5797,40 +5844,38 @@ declare const ListSessions200SessionsItemFactorsItemMethod: {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Method-specific factor metadata. Structure depends on the `method` field.
-- `identifier`: includes user_id
-- `password`: no additional data
-- `passkey`: includes credential details and verification flags
-
+ * Additional error-specific context.
  */
-type ListSessions200SessionsItemFactorsItemPayload = {
-  /** @pattern ^user_[a-zA-Z0-9_-]+$ */user_id: string;
-} | {
-  [key: string]: unknown;
-} | {
-  /** The credential ID that was used */credential_id: string; /** Whether user verification was performed (PIN/biometric) */
-  user_verified: boolean; /** Whether the credential is backup eligible (can be synced) */
-  backup_eligible?: boolean; /** Whether the credential is currently backed up */
-  backup_state?: boolean; /** Authenticator attachment modality */
-  authenticator_attachment?: "platform" | "cross-platform";
-}; //#endregion
-//#region src/generated/model/listSessions200SessionsItemFactorsItem.d.ts
+//#endregion
+//#region src/generated/model/listUserPasskeysParams.d.ts
 /**
- * A successfully verified authentication factor with verification metadata.
-Method-specific details are included in the `payload` field.
-
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
  */
-type ListSessions200SessionsItemFactorsItem = {
-  /** An authentication factor method. */method: ListSessions200SessionsItemFactorsItemMethod; /** When this factor was successfully verified */
-  verified_at: string;
-  /** Method-specific factor metadata. Structure depends on the `method` field.
-  - `identifier`: includes user_id
-  - `password`: no additional data
-  - `passkey`: includes credential details and verification flags
+type ListUserPasskeysParams = {
+  /**
+   * Maximum number of items to return.
+   * @minimum 1
+   * @maximum 100
+   */
+  limit?: number;
+  /**
+  * Token for fetching the next page of results.
+  Obtain this value from `next_page_token` in the previous response.
+  Omit to start from the beginning.
+  Its format is opaque and may change between releases.
+    */
+  page_token?: string;
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
    */
-  payload?: ListSessions200SessionsItemFactorsItemPayload;
+  project_id: string;
 }; //#endregion
-//#region src/generated/model/listSessions200SessionsItemMetadata.d.ts
+//#region src/generated/model/listUsers200UsersItemMetadataStatus.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5839,12 +5884,56 @@ type ListSessions200SessionsItemFactorsItem = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Arbitrary key/value metadata attached to the session.
+ * The status of the user.
+ */
+type ListUsers200UsersItemMetadataStatus = (typeof ListUsers200UsersItemMetadataStatus)[keyof typeof ListUsers200UsersItemMetadataStatus];
+declare const ListUsers200UsersItemMetadataStatus: {
+  readonly active: "active";
+  readonly suspended: "suspended";
+  readonly deactivated: "deactivated";
+  readonly pending_purge: "pending_purge";
+}; //#endregion
+//#region src/generated/model/listUsers200UsersItemMetadata.d.ts
+type ListUsers200UsersItemMetadata = {
+  /** The time when the user was created. */created_at: string; /** The time when the user was last updated. */
+  updated_at: string; /** The status of the user. */
+  status: ListUsers200UsersItemMetadataStatus;
+  /** The team that owns this user's identity lifecycle, or `null` when the
+  user is self-owned. This is a single team and a different concept from
+  the user's team roster: it decides who may deprovision the user, not
+  which teams the user collaborates in. The roster is its own paginated
+  resource — `GET /users/{user_id}/teams`.
+   */
+  lifecycle_owner_team_id?: string | null;
+}; //#endregion
+//#region src/generated/model/listUsers200UsersItem.d.ts
+/**
+ * A user represents an individual identity in the system. It can be used to
+represent a human user, but also a service account or any other type of
+identity. The content of a user is determined by the configured schema for
+users, this is only a base schema.
+
+The server assigns the resource primary key (`id`) on create. Clients must
+not send `id` in the create body; it is returned in the create response.
+
  */
-type ListSessions200SessionsItemMetadata = {
+type ListUsers200UsersItem = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id?: string;
+  metadata?: ListUsers200UsersItemMetadata;
   [key: string]: unknown;
-} | null; //#endregion
-//#region src/generated/model/listSessions200SessionsItemState.d.ts
+}; //#endregion
+//#region src/generated/model/listUsers200.d.ts
+/**
+ * Paginated list of users.
+ */
+type ListUsers200 = {
+  users: ListUsers200UsersItem[];
+  /** Token to pass as `page_token` in the next request to fetch the following page.
+  Absent when there are no more results.
+   */
+  next_page_token?: string | null;
+}; //#endregion
+//#region src/generated/model/listUsers400Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5853,21 +5942,10 @@ type ListSessions200SessionsItemMetadata = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Current lifecycle state of the session:
-- `building`: has a user factor but is still gathering authentication factors
-- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
-- `expired`: TTL elapsed
-- `revoked`: explicitly revoked via DELETE
-
+ * Additional error-specific context.
  */
-type ListSessions200SessionsItemState = (typeof ListSessions200SessionsItemState)[keyof typeof ListSessions200SessionsItemState];
-declare const ListSessions200SessionsItemState: {
-  readonly building: "building";
-  readonly active: "active";
-  readonly expired: "expired";
-  readonly revoked: "revoked";
-}; //#endregion
-//#region src/generated/model/listSessions200SessionsItemUserAgent.d.ts
+//#endregion
+//#region src/generated/model/listUsersParams.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5875,38 +5953,447 @@ declare const ListSessions200SessionsItemState: {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+type ListUsersParams = {
+  /**
+   * Maximum number of items to return.
+   * @minimum 1
+   * @maximum 100
+   */
+  limit?: number;
+  /**
+  * Token for fetching the next page of results.
+  Obtain this value from `next_page_token` in the previous response.
+  Omit to start from the beginning.
+  Its format is opaque and may change between releases.
+    */
+  page_token?: string;
+}; //#endregion
+//#region src/generated/model/listUserTeams200TeamsItemMembershipStatus.d.ts
 /**
- * User agent information captured at session creation.
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
  */
-type ListSessions200SessionsItemUserAgent = {
-  /** Client-supplied device fingerprint. */fingerprint?: string; /** IP address of the client at session creation. */
-  ip?: string;
-  [key: string]: unknown;
-} | null; //#endregion
-//#region src/generated/model/listSessions200SessionsItem.d.ts
 /**
- * The current state of a session.
-
-A session is the durable post-auth primitive. It accumulates verified authentication
-factors and exposes `assurance_levels[]` — the set of assurance profiles its current
-factors satisfy. Sessions are read-only from the client's perspective: factors flow
-in through `auth_attempts`.
+ * The user's participation state on this team. Memberships the user was
+removed from are not returned.
 
  */
-type ListSessions200SessionsItem = {
+type ListUserTeams200TeamsItemMembershipStatus = (typeof ListUserTeams200TeamsItemMembershipStatus)[keyof typeof ListUserTeams200TeamsItemMembershipStatus];
+declare const ListUserTeams200TeamsItemMembershipStatus: {
+  readonly pending: "pending";
+  readonly active: "active";
+  readonly inactive: "inactive";
+}; //#endregion
+//#region src/generated/model/listUserTeams200TeamsItem.d.ts
+/**
+ * One entry of a user's team roster: a team the user belongs to, with the
+membership's participation state. The team's `name` travels with the entry, so
+a page renders without a follow-up `POST /teams/query` per row.
+
+Roster membership is not lifecycle ownership. A user can belong to many teams
+while still owning their own lifecycle — that single owning team is reported
+as `metadata.lifecycle_owner_team_id` on the user itself.
+
+ */
+type ListUserTeams200TeamsItem = {
+  /** The unique identifier of the team. */id: string; /** The name of the team. */
+  name: string;
+  /** The user's participation state on this team. Memberships the user was
+  removed from are not returned.
+   */
+  membership_status: ListUserTeams200TeamsItemMembershipStatus; /** The time when the user joined this team. */
+  created_at: string; /** The time when this membership was last changed. */
+  updated_at: string;
+}; //#endregion
+//#region src/generated/model/listUserTeams200.d.ts
+/**
+ * Paginated list of the teams a user belongs to.
+ */
+type ListUserTeams200 = {
+  teams: ListUserTeams200TeamsItem[];
+  /** Token to pass as `page_token` in the next request to fetch the following page.
+  Absent when there are no more results.
+   */
+  next_page_token?: string | null;
+}; //#endregion
+//#region src/generated/model/listUserTeams400Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/listUserTeamsParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type ListUserTeamsParams = {
   /**
-   * Unique identifier for this session.
+   * Maximum number of items to return.
+   * @minimum 1
+   * @maximum 100
+   */
+  limit?: number;
+  /**
+  * Token for fetching the next page of results.
+  Obtain this value from `next_page_token` in the previous response.
+  Omit to start from the beginning.
+  Its format is opaque and may change between releases.
+    */
+  page_token?: string;
+  /**
+   * The unique identifier of the project
    * @pattern ^[a-zA-Z0-9_-]+$
    */
+  project_id: string;
+}; //#endregion
+//#region src/generated/model/patchProject200.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The current state of a project.
+ */
+type PatchProject200 = {
+  /** The unique identifier of the project. */id: string; /** The name of the project. */
+  name: string;
+  /** Origins which are allowed for previewing and testing the project.
+   */
+  preview_origins?: string[]; /** The time when the project was created. */
+  created_at: string; /** The time when the project was last updated. */
+  updated_at: string;
+}; //#endregion
+//#region src/generated/model/patchProject400Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/patchProjectBody.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type PatchProjectBody = {
+  /** The name of the project. */name?: null | string;
+}; //#endregion
+//#region src/generated/model/patchProjectDefault.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+//#endregion
+//#region src/generated/model/queryProjects200ProjectsItem.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The current state of a project.
+ */
+type QueryProjects200ProjectsItem = {
+  /** The unique identifier of the project. */id: string; /** The name of the project. */
+  name: string;
+  /** Origins which are allowed for previewing and testing the project.
+   */
+  preview_origins?: string[]; /** The time when the project was created. */
+  created_at: string; /** The time when the project was last updated. */
+  updated_at: string;
+}; //#endregion
+//#region src/generated/model/queryProjects200.d.ts
+/**
+ * Paginated list of projects.
+ */
+type QueryProjects200 = {
+  projects: QueryProjects200ProjectsItem[];
+  /** Token to pass as `page_token` in the next request to fetch the following page.
+  Absent when there are no more results. The follow-up request must repeat the
+  same `sorting` that produced this token (omit only when both pages use the default).
+   */
+  next_page_token?: string | null;
+}; //#endregion
+//#region src/generated/model/queryProjects400Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/queryProjectsBodyFilterItemField.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type QueryProjectsBodyFilterItemField = (typeof QueryProjectsBodyFilterItemField)[keyof typeof QueryProjectsBodyFilterItemField];
+declare const QueryProjectsBodyFilterItemField: {
+  readonly created_at: "created_at";
+}; //#endregion
+//#region src/generated/model/queryProjectsBodyFilterItemOperation.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Filter operation defines the operations which can be used when filtering on a
+query endpoint.
+
+ */
+type QueryProjectsBodyFilterItemOperation = (typeof QueryProjectsBodyFilterItemOperation)[keyof typeof QueryProjectsBodyFilterItemOperation];
+declare const QueryProjectsBodyFilterItemOperation: {
+  readonly equals: "equals";
+  readonly not_equals: "not_equals";
+  readonly contains: "contains";
+  readonly not_contains: "not_contains";
+  readonly less_than: "less_than";
+  readonly less_than_or_equal: "less_than_or_equal";
+  readonly greater_than: "greater_than";
+  readonly greater_than_or_equal: "greater_than_or_equal";
+}; //#endregion
+//#region src/generated/model/queryProjectsBodyFilterItem.d.ts
+type QueryProjectsBodyFilterItem = {
+  field: QueryProjectsBodyFilterItemField;
+  /** Filter-value specifies which values can be filtered by a query endpoint. This
+  is a union of types. When a value is specified which is not assignable to the
+  field which is being filtered, a 400 error will be returned.
+   */
+  value?: string | number | boolean | null;
+  /** Filter operation defines the operations which can be used when filtering on a
+  query endpoint.
+   */
+  operation: QueryProjectsBodyFilterItemOperation;
+}; //#endregion
+//#region src/generated/model/queryProjectsBodySortingDirection.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type QueryProjectsBodySortingDirection = (typeof QueryProjectsBodySortingDirection)[keyof typeof QueryProjectsBodySortingDirection];
+declare const QueryProjectsBodySortingDirection: {
+  readonly asc: "asc";
+  readonly desc: "desc";
+}; //#endregion
+//#region src/generated/model/queryProjectsBodySortingField.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type QueryProjectsBodySortingField = (typeof QueryProjectsBodySortingField)[keyof typeof QueryProjectsBodySortingField];
+declare const QueryProjectsBodySortingField: {
+  readonly created_at: "created_at";
+}; //#endregion
+//#region src/generated/model/queryProjectsBodySorting.d.ts
+type QueryProjectsBodySorting = {
+  field: QueryProjectsBodySortingField;
+  direction: QueryProjectsBodySortingDirection;
+}; //#endregion
+//#region src/generated/model/queryProjectsBody.d.ts
+/**
+ * Request to query projects.
+ */
+type QueryProjectsBody = {
+  /**
+   * @minimum 1
+   * @maximum 100
+   */
+  limit?: number;
+  /** Token to retrieve the next page of results. Must be sent with the same
+  `sorting` as the request that issued the token. Omitting `sorting` reuses
+  the default sort and only succeeds when that default matches the token.
+   */
+  page_token?: string | null;
+  sorting?: QueryProjectsBodySorting; /** Filter criteria for querying projects. */
+  filter?: QueryProjectsBodyFilterItem[];
+}; //#endregion
+//#region src/generated/model/queryProjectsDefault.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+//#endregion
+//#region src/generated/model/querySessions200SessionsItemFactorsItemMethod.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * An authentication factor method.
+ */
+type QuerySessions200SessionsItemFactorsItemMethod = (typeof QuerySessions200SessionsItemFactorsItemMethod)[keyof typeof QuerySessions200SessionsItemFactorsItemMethod];
+declare const QuerySessions200SessionsItemFactorsItemMethod: {
+  readonly identifier: "identifier";
+  readonly password: "password";
+  readonly passkey: "passkey";
+}; //#endregion
+//#region src/generated/model/querySessions200SessionsItemFactorsItemPayload.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Method-specific factor metadata. Structure depends on the `method` field.
+- `identifier`: includes user_id
+- `password`: no additional data
+- `passkey`: includes credential details and verification flags
+
+ */
+type QuerySessions200SessionsItemFactorsItemPayload = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */user_id: string;
+} | {
+  [key: string]: unknown;
+} | {
+  /** The credential ID that was used */credential_id: string; /** Whether user verification was performed (PIN/biometric) */
+  user_verified: boolean; /** Whether the credential is backup eligible (can be synced) */
+  backup_eligible?: boolean; /** Whether the credential is currently backed up */
+  backup_state?: boolean; /** Authenticator attachment modality */
+  authenticator_attachment?: "platform" | "cross-platform";
+}; //#endregion
+//#region src/generated/model/querySessions200SessionsItemFactorsItem.d.ts
+/**
+ * A successfully verified authentication factor with verification metadata.
+Method-specific details are included in the `payload` field.
+
+ */
+type QuerySessions200SessionsItemFactorsItem = {
+  /** An authentication factor method. */method: QuerySessions200SessionsItemFactorsItemMethod; /** When this factor was successfully verified */
+  verified_at: string;
+  /** Method-specific factor metadata. Structure depends on the `method` field.
+  - `identifier`: includes user_id
+  - `password`: no additional data
+  - `passkey`: includes credential details and verification flags
+   */
+  payload?: QuerySessions200SessionsItemFactorsItemPayload;
+}; //#endregion
+//#region src/generated/model/querySessions200SessionsItemMetadata.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Arbitrary key/value metadata attached to the session.
+ */
+type QuerySessions200SessionsItemMetadata = {
+  [key: string]: unknown;
+} | null; //#endregion
+//#region src/generated/model/querySessions200SessionsItemState.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Current lifecycle state of the session:
+- `building`: has a user factor but is still gathering authentication factors
+- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
+- `expired`: TTL elapsed
+
+ */
+type QuerySessions200SessionsItemState = (typeof QuerySessions200SessionsItemState)[keyof typeof QuerySessions200SessionsItemState];
+declare const QuerySessions200SessionsItemState: {
+  readonly building: "building";
+  readonly active: "active";
+  readonly expired: "expired";
+}; //#endregion
+//#region src/generated/model/querySessions200SessionsItemUserAgent.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * User agent information captured at session creation.
+ */
+type QuerySessions200SessionsItemUserAgent = {
+  /** Client-supplied device fingerprint. */fingerprint?: string; /** IP address of the client at session creation. */
+  ip?: string;
+  [key: string]: unknown;
+} | null; //#endregion
+//#region src/generated/model/querySessions200SessionsItem.d.ts
+/**
+ * The current state of a session.
+
+A session is the durable post-auth primitive. It accumulates verified authentication
+factors and exposes `assurance_levels[]` — the set of assurance profiles its current
+factors satisfy. Sessions are read-only from the client's perspective: factors flow
+in through `auth_attempts`.
+
+ */
+type QuerySessions200SessionsItem = {
+  /**
+   * Unique identifier for this session (dialect-minted prefixed opaque string).
+   * @pattern ^sess_[a-zA-Z0-9_-]+$
+   */
   session_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
   /** Current lifecycle state of the session:
   - `building`: has a user factor but is still gathering authentication factors
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
-  - `revoked`: explicitly revoked via DELETE
    */
-  state: ListSessions200SessionsItemState;
+  state: QuerySessions200SessionsItemState;
   /** The authenticated user. Null for anonymous sessions and until the `user`
   factor has been verified through an `auth_attempt`.
    */
@@ -5933,33 +6420,33 @@ type ListSessions200SessionsItem = {
   Each value is a factor event object with at least `verified_at` and
   method-specific properties (e.g. `user_verified`, `hardware` for passkeys).
    */
-  factors: ListSessions200SessionsItemFactorsItem[];
+  factors: QuerySessions200SessionsItemFactorsItem[];
   /** All assurance levels whose schemas the current session factors satisfy.
   This list shrinks as factor freshness windows expire and grows when step-up
   auth_attempts add or refresh factors.
   Whether any level is "enough" is determined by the request context, not the session.
    */
   assurance_levels?: string[]; /** Arbitrary key/value metadata attached to the session. */
-  metadata?: ListSessions200SessionsItemMetadata; /** User agent information captured at session creation. */
-  user_agent?: ListSessions200SessionsItemUserAgent; /** When this session was created. */
+  metadata?: QuerySessions200SessionsItemMetadata; /** User agent information captured at session creation. */
+  user_agent?: QuerySessions200SessionsItemUserAgent; /** When this session was created. */
   created_at: string;
   /** When this session expires. Short TTL (10 min) for anonymous sessions;
   reset to the full configured session TTL once the first authentication factor is written.
    */
   expires_at: string;
 }; //#endregion
-//#region src/generated/model/listSessions200.d.ts
+//#region src/generated/model/querySessions200.d.ts
 /**
  * Paginated list of sessions.
  */
-type ListSessions200 = {
-  sessions: ListSessions200SessionsItem[];
+type QuerySessions200 = {
+  sessions: QuerySessions200SessionsItem[];
   /** Token to pass as `page_token` in the next request to fetch the following page.
   Absent when there are no more results.
    */
   next_page_token?: string | null;
 }; //#endregion
-//#region src/generated/model/listSessions400Details.d.ts
+//#region src/generated/model/querySessions400Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5971,7 +6458,7 @@ type ListSessions200 = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/listSessionsState.d.ts
+//#region src/generated/model/querySessionsBodyFilterItemField.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5979,55 +6466,20 @@ type ListSessions200 = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type ListSessionsState = (typeof ListSessionsState)[keyof typeof ListSessionsState];
-declare const ListSessionsState: {
-  readonly building: "building";
-  readonly active: "active";
-  readonly expired: "expired";
-  readonly revoked: "revoked";
-}; //#endregion
-//#region src/generated/model/listSessionsParams.d.ts
-type ListSessionsParams = {
-  /**
-   * Maximum number of items to return.
-   * @minimum 1
-   * @maximum 100
-   */
-  limit?: number;
-  /**
-  * Token for fetching the next page of results.
-  Obtain this value from `next_page_token` in the previous response.
-  Omit to start from the beginning.
-  Its format is opaque and may change between releases.
-    */
-  page_token?: string;
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-  /**
-   * Filter sessions by lifecycle state.
-   */
-  state?: ListSessionsState;
-  /**
-   * Filter sessions by user.
-   * @pattern ^user_[a-zA-Z0-9_-]+$
-   */
-  user_id?: string;
-}; //#endregion
-//#region src/generated/model/listUsers200Item.d.ts
 /**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
+ * Field to filter sessions by:
+- `created_at`: RFC3339 timestamp
+- `user_id`: user id
+- `state`: one of `building`, `active`, `expired`
+
  */
-type ListUsers200Item = {
-  [key: string]: unknown;
+type QuerySessionsBodyFilterItemField = (typeof QuerySessionsBodyFilterItemField)[keyof typeof QuerySessionsBodyFilterItemField];
+declare const QuerySessionsBodyFilterItemField: {
+  readonly created_at: "created_at";
+  readonly user_id: "user_id";
+  readonly state: "state";
 }; //#endregion
-//#region src/generated/model/listUsers400Details.d.ts
+//#region src/generated/model/querySessionsBodyFilterItemOperation.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6036,10 +6488,40 @@ type ListUsers200Item = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
+ * Filter operation defines the operations which can be used when filtering on a
+query endpoint.
+
  */
-//#endregion
-//#region src/generated/model/listUsersParams.d.ts
+type QuerySessionsBodyFilterItemOperation = (typeof QuerySessionsBodyFilterItemOperation)[keyof typeof QuerySessionsBodyFilterItemOperation];
+declare const QuerySessionsBodyFilterItemOperation: {
+  readonly equals: "equals";
+  readonly not_equals: "not_equals";
+  readonly contains: "contains";
+  readonly not_contains: "not_contains";
+  readonly less_than: "less_than";
+  readonly less_than_or_equal: "less_than_or_equal";
+  readonly greater_than: "greater_than";
+  readonly greater_than_or_equal: "greater_than_or_equal";
+}; //#endregion
+//#region src/generated/model/querySessionsBodyFilterItem.d.ts
+type QuerySessionsBodyFilterItem = {
+  /** Field to filter sessions by:
+  - `created_at`: RFC3339 timestamp
+  - `user_id`: user id
+  - `state`: one of `building`, `active`, `expired`
+   */
+  field: QuerySessionsBodyFilterItemField;
+  /** Filter-value specifies which values can be filtered by a query endpoint. This
+  is a union of types. When a value is specified which is not assignable to the
+  field which is being filtered, a 400 error will be returned.
+   */
+  value?: string | number | boolean | null;
+  /** Filter operation defines the operations which can be used when filtering on a
+  query endpoint.
+   */
+  operation: QuerySessionsBodyFilterItemOperation;
+}; //#endregion
+//#region src/generated/model/querySessionsBodySortingDirection.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6047,20 +6529,12 @@ type ListUsers200Item = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type ListUsersParams = {
-  /**
-   * Number of items to skip before returning results.
-   * @minimum 0
-   */
-  offset?: number;
-  /**
-   * Maximum number of items to return.
-   * @minimum 1
-   * @maximum 100
-   */
-  limit?: number;
+type QuerySessionsBodySortingDirection = (typeof QuerySessionsBodySortingDirection)[keyof typeof QuerySessionsBodySortingDirection];
+declare const QuerySessionsBodySortingDirection: {
+  readonly asc: "asc";
+  readonly desc: "desc";
 }; //#endregion
-//#region src/generated/model/patchProject200.d.ts
+//#region src/generated/model/querySessionsBodySortingField.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6069,18 +6543,40 @@ type ListUsersParams = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * The current state of a project.
+ * Field to sort sessions by. Only stored columns are sortable: the keyset
+cursor holds the last row's sort values, so a computed value such as
+`state` would skip or duplicate rows between pages.
+
  */
-type PatchProject200 = {
-  /** The unique identifier of the project. */id: string; /** The name of the project. */
-  name: string;
-  /** Origins which are allowed for previewing and testing the project.
+type QuerySessionsBodySortingField = (typeof QuerySessionsBodySortingField)[keyof typeof QuerySessionsBodySortingField];
+declare const QuerySessionsBodySortingField: {
+  readonly created_at: "created_at";
+  readonly user_id: "user_id";
+}; //#endregion
+//#region src/generated/model/querySessionsBodySorting.d.ts
+type QuerySessionsBodySorting = {
+  /** Field to sort sessions by. Only stored columns are sortable: the keyset
+  cursor holds the last row's sort values, so a computed value such as
+  `state` would skip or duplicate rows between pages.
    */
-  previewOrigins?: string[]; /** The time when the project was created. */
-  createdAt: string; /** The time when the project was last updated. */
-  updatedAt: string;
+  field: QuerySessionsBodySortingField;
+  direction: QuerySessionsBodySortingDirection;
 }; //#endregion
-//#region src/generated/model/patchProject400Details.d.ts
+//#region src/generated/model/querySessionsBody.d.ts
+/**
+ * Request to query the sessions of a project.
+ */
+type QuerySessionsBody = {
+  /**
+   * @minimum 1
+   * @maximum 100
+   */
+  limit?: number; /** Token to retrieve the next page of results. */
+  page_token?: string | null;
+  sorting?: QuerySessionsBodySorting; /** Filter criteria for querying sessions. */
+  filter?: QuerySessionsBodyFilterItem[];
+}; //#endregion
+//#region src/generated/model/querySessionsDefault.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6088,11 +6584,8 @@ type PatchProject200 = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
 //#endregion
-//#region src/generated/model/patchProjectBody.d.ts
+//#region src/generated/model/querySessionsParams.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6100,10 +6593,14 @@ type PatchProject200 = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type PatchProjectBody = {
-  /** The name of the project. */name?: null | string;
+type QuerySessionsParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
 }; //#endregion
-//#region src/generated/model/patchProjectDefaultDetails.d.ts
+//#region src/generated/model/queryTeams200TeamsItemStatus.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6112,41 +6609,45 @@ type PatchProjectBody = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
- */
-//#endregion
-//#region src/generated/model/queryProjects200ProjectsItem.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
+ * The lifecycle state of a team.
+
+active: The team is available for use.
+deactivated: The team is no longer active but is retained for historical and audit purposes.
+
  */
+type QueryTeams200TeamsItemStatus = (typeof QueryTeams200TeamsItemStatus)[keyof typeof QueryTeams200TeamsItemStatus];
+declare const QueryTeams200TeamsItemStatus: {
+  readonly active: "active";
+  readonly deactivated: "deactivated";
+}; //#endregion
+//#region src/generated/model/queryTeams200TeamsItem.d.ts
 /**
- * The current state of a project.
+ * Details of a team.
  */
-type QueryProjects200ProjectsItem = {
-  /** The unique identifier of the project. */id: string; /** The name of the project. */
+type QueryTeams200TeamsItem = {
+  /** The unique identifier of the team. */id: string; /** The name of the team. */
   name: string;
-  /** Origins which are allowed for previewing and testing the project.
+  /** The lifecycle state of a team.
+     active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
    */
-  previewOrigins?: string[]; /** The time when the project was created. */
-  createdAt: string; /** The time when the project was last updated. */
-  updatedAt: string;
+  status: QueryTeams200TeamsItemStatus; /** The time when the team was created. */
+  created_at: string; /** The time when the team was last updated. */
+  updated_at: string;
 }; //#endregion
-//#region src/generated/model/queryProjects200.d.ts
+//#region src/generated/model/queryTeams200.d.ts
 /**
- * Paginated list of projects.
+ * Paginated list of teams.
  */
-type QueryProjects200 = {
-  projects: QueryProjects200ProjectsItem[];
+type QueryTeams200 = {
+  teams: QueryTeams200TeamsItem[];
   /** Token to pass as `page_token` in the next request to fetch the following page.
-  Absent when there are no more results.
+  Absent when there are no more results. The follow-up request must repeat the
+  same `sorting` that produced this token (omit only when both pages use the default).
    */
   next_page_token?: string | null;
 }; //#endregion
-//#region src/generated/model/queryProjects400Details.d.ts
+//#region src/generated/model/queryTeams400Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6158,7 +6659,7 @@ type QueryProjects200 = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/queryProjectsBodyFilterItemField.d.ts
+//#region src/generated/model/queryTeamsBodyFilterItemField.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6166,12 +6667,11 @@ type QueryProjects200 = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type QueryProjectsBodyFilterItemField = (typeof QueryProjectsBodyFilterItemField)[keyof typeof QueryProjectsBodyFilterItemField];
-declare const QueryProjectsBodyFilterItemField: {
-  readonly name: "name";
-  readonly createdAt: "createdAt";
+type QueryTeamsBodyFilterItemField = (typeof QueryTeamsBodyFilterItemField)[keyof typeof QueryTeamsBodyFilterItemField];
+declare const QueryTeamsBodyFilterItemField: {
+  readonly created_at: "created_at";
 }; //#endregion
-//#region src/generated/model/queryProjectsBodyFilterItemOperation.d.ts
+//#region src/generated/model/queryTeamsBodyFilterItemOperation.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6184,8 +6684,8 @@ declare const QueryProjectsBodyFilterItemField: {
 query endpoint.
 
  */
-type QueryProjectsBodyFilterItemOperation = (typeof QueryProjectsBodyFilterItemOperation)[keyof typeof QueryProjectsBodyFilterItemOperation];
-declare const QueryProjectsBodyFilterItemOperation: {
+type QueryTeamsBodyFilterItemOperation = (typeof QueryTeamsBodyFilterItemOperation)[keyof typeof QueryTeamsBodyFilterItemOperation];
+declare const QueryTeamsBodyFilterItemOperation: {
   readonly equals: "equals";
   readonly not_equals: "not_equals";
   readonly contains: "contains";
@@ -6195,9 +6695,9 @@ declare const QueryProjectsBodyFilterItemOperation: {
   readonly greater_than: "greater_than";
   readonly greater_than_or_equal: "greater_than_or_equal";
 }; //#endregion
-//#region src/generated/model/queryProjectsBodyFilterItem.d.ts
-type QueryProjectsBodyFilterItem = {
-  field: QueryProjectsBodyFilterItemField;
+//#region src/generated/model/queryTeamsBodyFilterItem.d.ts
+type QueryTeamsBodyFilterItem = {
+  field: QueryTeamsBodyFilterItemField;
   /** Filter-value specifies which values can be filtered by a query endpoint. This
   is a union of types. When a value is specified which is not assignable to the
   field which is being filtered, a 400 error will be returned.
@@ -6206,9 +6706,9 @@ type QueryProjectsBodyFilterItem = {
   /** Filter operation defines the operations which can be used when filtering on a
   query endpoint.
    */
-  operation: QueryProjectsBodyFilterItemOperation;
+  operation: QueryTeamsBodyFilterItemOperation;
 }; //#endregion
-//#region src/generated/model/queryProjectsBodySortingDirection.d.ts
+//#region src/generated/model/queryTeamsBodySortingDirection.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6216,12 +6716,12 @@ type QueryProjectsBodyFilterItem = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type QueryProjectsBodySortingDirection = (typeof QueryProjectsBodySortingDirection)[keyof typeof QueryProjectsBodySortingDirection];
-declare const QueryProjectsBodySortingDirection: {
+type QueryTeamsBodySortingDirection = (typeof QueryTeamsBodySortingDirection)[keyof typeof QueryTeamsBodySortingDirection];
+declare const QueryTeamsBodySortingDirection: {
   readonly asc: "asc";
   readonly desc: "desc";
 }; //#endregion
-//#region src/generated/model/queryProjectsBodySortingField.d.ts
+//#region src/generated/model/queryTeamsBodySortingField.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6229,31 +6729,34 @@ declare const QueryProjectsBodySortingDirection: {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type QueryProjectsBodySortingField = (typeof QueryProjectsBodySortingField)[keyof typeof QueryProjectsBodySortingField];
-declare const QueryProjectsBodySortingField: {
-  readonly name: "name";
-  readonly createdAt: "createdAt";
+type QueryTeamsBodySortingField = (typeof QueryTeamsBodySortingField)[keyof typeof QueryTeamsBodySortingField];
+declare const QueryTeamsBodySortingField: {
+  readonly created_at: "created_at";
 }; //#endregion
-//#region src/generated/model/queryProjectsBodySorting.d.ts
-type QueryProjectsBodySorting = {
-  field: QueryProjectsBodySortingField;
-  direction: QueryProjectsBodySortingDirection;
+//#region src/generated/model/queryTeamsBodySorting.d.ts
+type QueryTeamsBodySorting = {
+  field: QueryTeamsBodySortingField;
+  direction: QueryTeamsBodySortingDirection;
 }; //#endregion
-//#region src/generated/model/queryProjectsBody.d.ts
+//#region src/generated/model/queryTeamsBody.d.ts
 /**
- * Request to query projects.
+ * Request to query the teams of a project.
  */
-type QueryProjectsBody = {
+type QueryTeamsBody = {
   /**
    * @minimum 1
    * @maximum 100
    */
-  limit?: number; /** Token to retrieve the next page of results. */
+  limit?: number;
+  /** Token to retrieve the next page of results. Must be sent with the same
+  `sorting` as the request that issued the token. Omitting `sorting` reuses
+  the default sort and only succeeds when that default matches the token.
+   */
   page_token?: string | null;
-  sorting?: QueryProjectsBodySorting; /** Filter criteria for querying projects. */
-  filter?: QueryProjectsBodyFilterItem[];
+  sorting?: QueryTeamsBodySorting; /** Filter criteria for querying teams. */
+  filter?: QueryTeamsBodyFilterItem[];
 }; //#endregion
-//#region src/generated/model/queryProjectsDefaultDetails.d.ts
+//#region src/generated/model/queryTeamsDefaultDetails.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6265,7 +6768,7 @@ type QueryProjectsBody = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/revokeSessionParams.d.ts
+//#region src/generated/model/queryTeamsParams.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6273,14 +6776,14 @@ type QueryProjectsBody = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type RevokeSessionParams = {
+type QueryTeamsParams = {
   /**
    * The unique identifier of the project
    * @pattern ^[a-zA-Z0-9_-]+$
    */
   project_id: string;
 }; //#endregion
-//#region src/generated/model/revokeToken4xxDetails.d.ts
+//#region src/generated/model/revokeMySession401.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6289,10 +6792,13 @@ type RevokeSessionParams = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
+ * The request lacks valid authentication credentials.
+
+Error code: auth.unauthorized
+
  */
 //#endregion
-//#region src/generated/model/revokeTokenBody.d.ts
+//#region src/generated/model/revokeSessionParams.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6300,11 +6806,14 @@ type RevokeSessionParams = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type RevokeTokenBody = {
-  /** The token to revoke (access token or refresh token) */token?: string; /** Optional hint about the type of the token being revoked (access_token or refresh_token) */
-  token_type_hint?: string;
+type RevokeSessionParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
 }; //#endregion
-//#region src/generated/model/revokeTokenDefaultDetails.d.ts
+//#region src/generated/model/setUserPassword400Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6332,9 +6841,9 @@ type SetUserPasswordBody = {
   /** Whether the user is required to change their password on the next login.
   If not provided, it will default to false.
    */
-  isChangeRequired?: boolean;
+  is_change_required?: boolean;
 }; //#endregion
-//#region src/generated/model/setUserPasswordDefaultDetails.d.ts
+//#region src/generated/model/setUserPasswordDefault.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6342,9 +6851,6 @@ type SetUserPasswordBody = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
 //#endregion
 //#region src/generated/model/setUserPasswordParams.d.ts
 /**
@@ -6361,63 +6867,6 @@ type SetUserPasswordParams = {
    */
   project_id: string;
 }; //#endregion
-//#region src/generated/model/submitFlowEvent400Details.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Additional error-specific context.
- */
-//#endregion
-//#region src/generated/model/submitFlowEventBodyPayload.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Event payload (fingerprint hash, timing data, etc.).
- */
-type SubmitFlowEventBodyPayload = {
-  [key: string]: unknown;
-}; //#endregion
-//#region src/generated/model/submitFlowEventBodyType.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type SubmitFlowEventBodyType = (typeof SubmitFlowEventBodyType)[keyof typeof SubmitFlowEventBodyType];
-declare const SubmitFlowEventBodyType: {
-  readonly fingerprint: "fingerprint";
-  readonly telemetry: "telemetry";
-}; //#endregion
-//#region src/generated/model/submitFlowEventBody.d.ts
-type SubmitFlowEventBody = {
-  /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */session_token?: string;
-  type: SubmitFlowEventBodyType; /** Event payload (fingerprint hash, timing data, etc.). */
-  payload?: SubmitFlowEventBodyPayload;
-}; //#endregion
-//#region src/generated/model/submitFlowEventDefaultDetails.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Additional error-specific context.
- */
-//#endregion
 //#region src/generated/model/submitFlowStep200BrandingLayout.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -6429,7 +6878,8 @@ type SubmitFlowEventBody = {
 /**
  * Layout preset selector. The default.liquid master template uses this
 to branch into layout variants. Customers who eject the template
-can ignore this field entirely.
+can ignore this field entirely; it also serves as the degrade target
+when a custom template fails component-side validation.
 
  */
 type SubmitFlowStep200BrandingLayout = (typeof SubmitFlowStep200BrandingLayout)[keyof typeof SubmitFlowStep200BrandingLayout];
@@ -6439,23 +6889,39 @@ declare const SubmitFlowStep200BrandingLayout: {
 }; //#endregion
 //#region src/generated/model/submitFlowStep200Branding.d.ts
 /**
- * Resolved branding configuration. Inherited from the app → team → project
-hierarchy at flow creation time (most specific wins). Read-only projection —
-branding is configured via the Team/App Branding API, not the Flow API.
+ * Branding configuration. Appears in two places with one shape:
+
+- On flow responses as a read-only projection: the server resolves the
+  latest branding revision for the project per step response (falling
+  back to built-in defaults when none is stored). Branding is configured
+  via the Branding API / `zitadel apply`, not the Flow API.
+- As the request body of `POST /branding`, which publishes the same
+  shape as a new immutable revision (see ADR 040).
 
  */
 type SubmitFlowStep200Branding = {
   /** Layout preset selector. The default.liquid master template uses this
   to branch into layout variants. Customers who eject the template
-  can ignore this field entirely.
+  can ignore this field entirely; it also serves as the degrade target
+  when a custom template fails component-side validation.
    */
   layout?: SubmitFlowStep200BrandingLayout;
-  /** The LiquidJS template string for rendering this step. The orchestrator
+  /**
+     * The LiquidJS template string for rendering this step. The orchestrator
   parses this template, injects the capability dictionaries as context,
   and renders the output HTML into its Shadow DOM.
-   */
+        * @maxLength 131072
+     */
   liquid_template?: string; /** Team logo URL. */
-  logo_url?: string; /** Custom font URL (e.g., Google Fonts CSS). */
+  logo_url?: string;
+  /** Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in
+  v1: `POST /branding` rejects a non-empty value, because the login
+  component loads this stylesheet at document level (shadow-scoped
+  `@font-face` rules never register faces) and an arbitrary URL would
+  grant `branding.write` page-wide CSS control over the embedding
+  application. Safe tenant font delivery is an ADR 040 follow-up;
+  until then, load fonts from the embedding page.
+   */
   font_url?: string; /** Hero/background image URL (used by split layout). */
   hero_url?: string;
 }; //#endregion
@@ -6832,9 +7298,11 @@ type SubmitFlowStep200Step = {
   (e.g. `error.email_required`; the `format` rule is spelled
   `error.<field>_invalid`), multiple violations joined with `"; "`.
   Field names appear verbatim, so clients localise unknown keys via
-  the generic `error.field_<rule>` catalog entries. Other failures
-  carry a verbatim diagnostic token instead (e.g. `user_not_found`,
-  `auth_attempt.password_invalid`).
+  the generic `error.field_<rule>` catalog entries. Other engine
+  failures carry `error.*` catalog keys as well (e.g.
+  `error.invalid_credentials`, `error.passkey_invalid`); a
+  non-`error.` payload is an outcome token (e.g. `user_not_found`)
+  that clients keep verbatim.
    */
   error?: string | null;
   /** Present only on terminal steps. Tells the frontend what to do:
@@ -6883,9 +7351,13 @@ type SubmitFlowStep200 = {
   and builds name-keyed indexes locally for lookup.
    */
   step: SubmitFlowStep200Step;
-  /** Resolved branding configuration. Inherited from the app → team → project
-  hierarchy at flow creation time (most specific wins). Read-only projection —
-  branding is configured via the Team/App Branding API, not the Flow API.
+  /** Branding configuration. Appears in two places with one shape:
+     - On flow responses as a read-only projection: the server resolves the
+    latest branding revision for the project per step response (falling
+    back to built-in defaults when none is stored). Branding is configured
+    via the Branding API / `zitadel apply`, not the Flow API.
+  - As the request body of `POST /branding`, which publishes the same
+    shape as a new immutable revision (see ADR 040).
    */
   branding?: SubmitFlowStep200Branding; /** Present when `step.complete` is `redirect`. */
   redirect_uri?: string;
@@ -6910,7 +7382,8 @@ type SubmitFlowStep200 = {
 /**
  * Layout preset selector. The default.liquid master template uses this
 to branch into layout variants. Customers who eject the template
-can ignore this field entirely.
+can ignore this field entirely; it also serves as the degrade target
+when a custom template fails component-side validation.
 
  */
 //#endregion
@@ -7004,7 +7477,7 @@ type SubmitFlowStepBody = {
    */
   sso_provider_id?: string;
 }; //#endregion
-//#region src/generated/model/submitFlowStepDefaultDetails.d.ts
+//#region src/generated/model/submitFlowStepDefault.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7012,9 +7485,6 @@ type SubmitFlowStepBody = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
 //#endregion
 //#region src/generated/model/updateFlowDefinition200FlowDefinitionAudience.d.ts
 /**
@@ -7793,7 +8263,7 @@ type UpdateFlowDefinitionBody = {
    */
   flow_definition: UpdateFlowDefinitionBodyFlowDefinition;
 }; //#endregion
-//#region src/generated/model/updateFlowDefinitionDefaultDetails.d.ts
+//#region src/generated/model/updateFlowDefinitionDefault.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7801,9 +8271,6 @@ type UpdateFlowDefinitionBody = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
 //#endregion
 //#region src/generated/model/updateFlowDefinitionParams.d.ts
 /**
@@ -7820,6 +8287,96 @@ type UpdateFlowDefinitionParams = {
    */
   project_id: string;
 }; //#endregion
+//#region src/generated/model/updateTeam200Status.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The lifecycle state of a team.
+
+active: The team is available for use.
+deactivated: The team is no longer active but is retained for historical and audit purposes.
+
+ */
+type UpdateTeam200Status = (typeof UpdateTeam200Status)[keyof typeof UpdateTeam200Status];
+declare const UpdateTeam200Status: {
+  readonly active: "active";
+  readonly deactivated: "deactivated";
+}; //#endregion
+//#region src/generated/model/updateTeam200.d.ts
+/**
+ * Details of a team.
+ */
+type UpdateTeam200 = {
+  /** The unique identifier of the team. */id: string; /** The name of the team. */
+  name: string;
+  /** The lifecycle state of a team.
+     active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
+   */
+  status: UpdateTeam200Status; /** The time when the team was created. */
+  created_at: string; /** The time when the team was last updated. */
+  updated_at: string;
+}; //#endregion
+//#region src/generated/model/updateTeam400Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/updateTeamBody.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type UpdateTeamBody = {
+  /**
+   * The name of the team. Must be unique within the project.
+   * @minLength 1
+   * @maxLength 200
+   */
+  name?: string;
+}; //#endregion
+//#region src/generated/model/updateTeamDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/updateTeamParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type UpdateTeamParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+}; //#endregion
 //#region src/generated/model/verifyChallengeProof200ChallengesItemMethod.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -7899,8 +8456,8 @@ The client verifies the proof by POST /auth_attempts/{attempt_id}/challenges/{ch
  */
 type VerifyChallengeProof200ChallengesItem = {
   /**
-   * Unique identifier for this challenge
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this challenge (dialect-minted prefixed opaque string).
+   * @pattern ^ch_[a-zA-Z0-9_-]+$
    */
   challenge_id: string; /** An authentication factor method. */
   method: VerifyChallengeProof200ChallengesItemMethod;
@@ -8032,8 +8589,8 @@ Clients drive the attempt by:
  */
 type VerifyChallengeProof200 = {
   /**
-   * Unique identifier for this authentication attempt
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this authentication attempt (dialect-minted prefixed opaque string).
+   * @pattern ^att_[a-zA-Z0-9_-]+$
    */
   attempt_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
@@ -8168,6 +8725,16 @@ declare class ZlField extends LitElement {
   formResetCallback(): void;
   formStateRestoreCallback(state: string | null): void;
   focus(options?: FocusOptions): void;
+  /**
+   * The string this control contributes to form submission — the uniform
+   * read/write contract `<zitadel-login>` uses to capture and restore field
+   * values without knowing each atom's internal shape. The getter reads the
+   * live `<input>` so browser/password-manager autofill that writes the native
+   * control directly (bypassing the `value` property and its `input` event) is
+   * still captured.
+   */
+  get formValue(): string;
+  set formValue(value: string);
   render(): _$lit.TemplateResult<1>;
   private renderLabelRow;
   private renderTrailingIcon;
@@ -8217,6 +8784,13 @@ declare global {
  *   gap         24px (spacing-04) between header / main / footer slots
  *   footer      min-height 1.5rem to reserve room for the attribution
  *               pill even when the slot is empty (prevents jitter).
+ *
+ * All of the above is page chrome. In widget mode (`data-widget`, stamped
+ * by the orchestrators whenever their `variant` is not `page`) the shell
+ * sheds it entirely — background, viewport min-height, AND the responsive
+ * padding — leaving a transparent, content-sized pass-through: the
+ * embedding app owns spacing around the card. Only the region gap
+ * survives, because it separates real content (card → attribution pill).
  */
 declare class ZlPageShell extends LitElement {
   static styles: _$lit.CSSResult[];
@@ -8361,7 +8935,7 @@ declare class ZlPasskey extends LitElement {
    */
   startCeremony(): Promise<void>;
   private handleCancelSubmit;
-  render(): typeof nothing | _$lit.TemplateResult<1>;
+  render(): _$lit.TemplateResult<1> | typeof nothing;
   /**
    * `navigator.credentials.get()` — authentication ceremony.
    */
@@ -8464,20 +9038,26 @@ type ZlSelectChangeDetail = {
   value: string;
 };
 /**
- * Atom: `<zl-select>` — a select-only combobox bound to a single choice.
+ * Atom: `<zl-select>` — a select bound to a single choice.
  *
  * Spec lineage (file `8UjCXw8yemgljmbkWGrSfE`, "Zitadel - Design System - External"):
  *   - trigger + open/selected matrix:  node `4397:4816` (Dropdown)
  *   - option (Items) state matrix:      node `4397:4098` (Input text)
  *
- * The trigger mirrors `<zl-field>`'s box; the popup is a `role="listbox"` whose
- * options paint the Figma hover / keyboard-active wash and the chosen row's
- * solid fill + check glyph. Follows the WAI-ARIA select-only combobox pattern:
- * focus stays on the trigger and `aria-activedescendant` tracks the active
- * option, so arrow keys move a virtual cursor without moving DOM focus.
+ * Agent-first contract (see `packages/components/AGENTS.md` → "Input atoms expose
+ * a real native control"): the operable, accessible, form-associated, and
+ * automatable control is a real native `<select>`. Screen readers, keyboard
+ * users, password managers, native form submission/validation, and automation
+ * drivers (Playwright `selectOption`, the chrome-devtools accessibility
+ * snapshot, the Codex in-app browser) all interact with that native element via
+ * the stable `data-testid="zitadel-select-${name}"`.
  *
- * Form participation: `<zl-select>` is a form-associated custom element; its
- * `value` is the selected option's value (empty string = nothing chosen).
+ * The Figma-styled trigger + popup (`.zr-select__trigger` / `.zr-select__listbox`)
+ * are a pointer-only **visual** layer: they are `aria-hidden` and never in the
+ * tab order, so they don't duplicate the native control in the accessibility
+ * tree. A mouse user sees the styled popup; everyone else (keyboard, AT, agents)
+ * uses the native `<select>` and its native popup. Both paths converge on
+ * `value`, emit `zl-change`, and mirror `internals.setFormValue()`.
  */
 declare class ZlSelect extends LitElement {
   static formAssociated: boolean;
@@ -8501,12 +9081,21 @@ declare class ZlSelect extends LitElement {
    */
   accessor options: ZlSelectOption[];
   accessor required: boolean;
+  /**
+   * Inline validation message shown under the control (empty = none). Set by
+   * the orchestrator's template when the flow re-renders with a field error;
+   * display-only — submission gating lives in `<zitadel-login>`, mirroring
+   * `<zl-field>`'s `error` contract so the router treats every field type the
+   * same way.
+   */
+  accessor error: string;
+  accessor invalid: boolean;
   accessor disabled: boolean;
   accessor open: boolean;
   accessor ariaLabelText: string | undefined;
   accessor testId: string | undefined;
-  private accessor activeIndex;
-  private accessor triggerEl;
+  private accessor activeValue;
+  private accessor nativeEl;
   private readonly baseId;
   private readonly internals;
   private defaultValue;
@@ -8517,25 +9106,51 @@ declare class ZlSelect extends LitElement {
   formResetCallback(): void;
   formStateRestoreCallback(state: string | null): void;
   focus(options?: FocusOptions): void;
+  /**
+   * The string this control contributes to form submission — the uniform
+   * read/write contract `<zitadel-login>` uses to capture and restore field
+   * values without knowing each atom's internal shape. For a select that is
+   * simply the chosen option's value (empty = nothing chosen).
+   */
+  get formValue(): string;
+  set formValue(value: string);
+  /**
+   * Options as painted in the listbox: a leading empty row (labelled with the
+   * placeholder) so the user can return to "no selection". For a `required`
+   * field this empty row is the prompt — choosing it leaves the value empty,
+   * so `required` validation still blocks submit (native `<select>`
+   * semantics). Any empty-valued member of the caller's list is dropped first,
+   * so a schema enum that lists "" doesn't render a second, duplicate empty
+   * option. The public `options` property stays the caller's list.
+   */
+  private get listOptions();
   render(): _$lit.TemplateResult<1>;
   private renderLabel;
   private renderOption;
-  private optionId;
   private handleLabelClick;
   private handleTriggerClick;
-  private handleTriggerKeyDown;
+  /**
+   * The native `<select>` is the source of truth for keyboard, AT, and
+   * automation. Its `change` event covers native-popup selection as well as
+   * programmatic value-setting by automation drivers.
+   */
+  private handleNativeChange;
   private handleOptionClick;
   private handleOptionPointerMove;
   private handleDocumentPointerDown;
-  private openMenu;
-  private close;
-  private commitActive;
-  private moveActive;
-  private setActive;
-  private firstEnabledIndex;
-  private lastEnabledIndex;
+  /**
+   * Escape closes the styled popup and stops propagation so it doesn't also
+   * dismiss an enclosing dialog.
+   */
+  private handleDocumentKeydown;
+  /**
+   * Apply a new value from any input path (native select, styled popup), keeping
+   * `value`, form state, and listeners in sync and emitting the `zl-change`
+   * contract plus a composed native `change` for host forms.
+   */
+  private commitValue;
   private syncFormState;
-  private triggerTestId;
+  private nativeTestId;
 }
 declare const zlSelectManifest: AtomManifest;
 declare global {
@@ -8544,5 +9159,5 @@ declare global {
   }
 } //# sourceMappingURL=zl-select.d.ts.map
 //#endregion
-export { ExchangeHandoff200 as $, ZlCheckbox as $t, CreateFlow201StepGates as A, ListFlowDefinitionsParams as At, CreateSchemaBody as B, QueryProjectsBody as Bt, CreateFlow201 as C, GetUserByIDParams as Ct, CreateFlow201StepActionsItem as D, IssueChallenge201 as Dt, CreateFlow201Step as E, IntrospectBody as Et, CreateFlowDefinitionBody as F, ListUsers200Item as Ft, CreateTeamBody as G, SubmitFlowEventBody as Gt, CreateSession201 as H, RevokeTokenBody as Ht, CreateHandoff200 as I, ListUsersParams as It, CreateUserBody as J, UpdateFlowDefinition200 as Jt, CreateTeamParams as K, SubmitFlowStep200 as Kt, CreateProject201 as L, PatchProject200 as Lt, CreateFlowBody as M, ListSchemasParams as Mt, CreateFlowBodyPurpose as N, ListSessions200 as Nt, CreateFlow201StepChallenge as O, IssueChallengeBody as Ot, CreateFlowDefinition201 as P, ListSessionsParams as Pt, EndSessionParams as Q, VerifyChallengeProofBody as Qt, CreateProjectBody as R, PatchProjectBody as Rt, CreateAuthAttemptBody as S, GetUserByID200 as St, CreateFlow201BrandingLayout as T, Introspect200 as Tt, CreateSessionBody as U, SetUserPasswordBody as Ut, CreateSchemaParams as V, RevokeSessionParams as Vt, CreateTeam201 as W, SetUserPasswordParams as Wt, DeactivateFlowDefinitionParams as X, UpdateFlowDefinitionParams as Xt, CreateUserParams as Y, UpdateFlowDefinitionBody as Yt, DeleteFlowDefinitionParams as Z, VerifyChallengeProof200 as Zt, AuthorizeDevice200 as _, GetSessionParams as _t, ZlPill as a, zlButtonManifest as an, GetFlowStep200 as at, AuthorizeGetParams as b, GetToken200 as bt, ZlPasskeyErrorDetail as c, IconName as cn, GetLiveDefault as ct, ZlPageShell as d, GetOpenIDConfiguration200 as dt, ZlCheckboxChangeDetail as en, ExchangeHandoffBody as et, zlPageShellManifest as f, GetProject200 as ft, ActivateFlowDefinitionParams as g, GetSession200 as gt, zlFieldManifest as h, GetSchemaByIdParams as ht, zlSelectManifest as i, ZlButton as in, GetFlowDefinitionParams as it, CreateFlow201StepSsoProvidersItem as j, ListSchemas200Item as jt, CreateFlow201StepFieldsItem as k, ListFlowDefinitions200 as kt, ZlPasskeyResultDetail as l, ZlIcon as ln, GetMySession200 as lt, ZlFieldType as m, GetSchemaById200 as mt, ZlSelectChangeDetail as n, ZlCard as nn, GetAuthAttempt200 as nt, zlPillManifest as o, ZlAlert as on, GetHealthDefault as ot, ZlField as p, GetReadyDefault as pt, CreateUser201 as q, SubmitFlowStepBody as qt, ZlSelectOption as r, zlCardManifest as rn, GetFlowDefinition200 as rt, ZlPasskey as s, zlAlertManifest as sn, GetKeys200 as st, ZlSelect as t, zlCheckboxManifest as tn, ExchangeHandoffParams as tt, zlPasskeyManifest as u, zlIconManifest as un, GetMyUser200 as ut, AuthorizeDeviceParams as v, GetTeam200 as vt, CreateFlow201Branding as w, GetUserInfo200 as wt, CreateAuthAttempt201 as x, GetTokenBody as xt, AuthorizeGetDefault as y, GetTeamParams as yt, CreateSchema201 as z, QueryProjects200 as zt };
-//# sourceMappingURL=index-BwQLFs9R.d.mts.map
+export { ExchangeHandoff200 as $, SubmitFlowStepBody as $t, CreateFlow201StepGates as A, ListFlowDefinitionsParams as At, CreateSchemaBody as B, PatchProjectBody as Bt, CreateFlow201 as C, GetUserByIDParams as Ct, CreateFlow201StepActionsItem as D, ListBranding200Item as Dt, CreateFlow201Step as E, IssueChallengeBody as Et, CreateFlowDefinitionBody as F, ListUserTeams200 as Ft, CreateTeamBody as G, QuerySessionsParams as Gt, CreateSession201 as H, QueryProjectsBody as Ht, CreateHandoff200 as I, ListUserTeamsParams as It, CreateUserBody as J, QueryTeamsParams as Jt, CreateTeamParams as K, QueryTeams200 as Kt, CreateProject201 as L, ListUsers200 as Lt, CreateFlowBody as M, ListSchemasParams as Mt, CreateFlowBodyPurpose as N, ListUserPasskeys200 as Nt, CreateFlow201StepChallenge as O, ListBrandingParams as Ot, CreateFlowDefinition201 as P, ListUserPasskeysParams as Pt, DeleteUserByIDParams as Q, SubmitFlowStep200 as Qt, CreateProjectBody as R, ListUsersParams as Rt, CreateBrandingParams as S, GetUserByID200 as St, CreateFlow201BrandingLayout as T, IssueChallenge201 as Tt, CreateSessionBody as U, QuerySessions200 as Ut, CreateSchemaParams as V, QueryProjects200 as Vt, CreateTeam201 as W, QuerySessionsBody as Wt, DeleteFlowDefinitionParams as X, SetUserPasswordBody as Xt, CreateUserParams as Y, RevokeSessionParams as Yt, DeleteTeamParams as Z, SetUserPasswordParams as Zt, CompleteClaimBody as _, IconName as _n, GetSchemaByIdParams as _t, ZlPill as a, UpdateTeamParams as an, GetClaimStatus200 as at, CreateBranding201 as b, GetTeam200 as bt, ZlPasskeyErrorDetail as c, ZlCheckbox as cn, GetFlowDefinitionParams as ct, ZlPageShell as d, ZlCard as dn, GetLiveDefault as dt, UpdateFlowDefinition200 as en, ExchangeHandoffBody as et, zlPageShellManifest as f, zlCardManifest as fn, GetMySession200 as ft, CompleteClaim200 as g, zlAlertManifest as gn, GetSchemaById200 as gt, zlFieldManifest as h, ZlAlert as hn, GetReadyDefault as ht, zlSelectManifest as i, UpdateTeamBody as in, GetBrandingByIdParams as it, CreateFlow201StepSsoProvidersItem as j, ListSchemas200Item as jt, CreateFlow201StepFieldsItem as k, ListFlowDefinitions200 as kt, ZlPasskeyResultDetail as l, ZlCheckboxChangeDetail as ln, GetFlowStep200 as lt, ZlFieldType as m, zlButtonManifest as mn, GetProject200 as mt, ZlSelectChangeDetail as n, UpdateFlowDefinitionParams as nn, GetAuthAttempt200 as nt, zlPillManifest as o, VerifyChallengeProof200 as on, GetClaimStatusParams as ot, ZlField as p, ZlButton as pn, GetMyUser200 as pt, CreateUser201 as q, QueryTeamsBody as qt, ZlSelectOption as r, UpdateTeam200 as rn, GetBrandingById200 as rt, ZlPasskey as s, VerifyChallengeProofBody as sn, GetFlowDefinition200 as st, ZlSelect as t, UpdateFlowDefinitionBody as tn, ExchangeHandoffParams as tt, zlPasskeyManifest as u, zlCheckboxManifest as un, GetHealthDefault as ut, CreateAuthAttempt201 as v, ZlIcon as vn, GetSession200 as vt, CreateFlow201Branding as w, InitClaim201 as wt, CreateBrandingBody as x, GetTeamParams as xt, CreateAuthAttemptBody as y, zlIconManifest as yn, GetSessionParams as yt, CreateSchema201 as z, PatchProject200 as zt };
+//# sourceMappingURL=index-DIGjtG4z.d.mts.map