@zitadel/components 0.1.0-alpha.17 → 0.1.0-alpha.19

package/dist/{index-DjYJwejg.d.mts → index-Ce_81oFH.d.mts}

@@ -1,59 +1,13 @@
-import { $ as ExchangeHandoff200, A as CreateFlow201StepGates, At as ListFlowDefinitionsParams, B as CreateSchemaBody, Bt as QueryProjectsBody, C as CreateFlow201, Ct as GetUserByIDParams, D as CreateFlow201StepActionsItem, Dt as IssueChallenge201, E as CreateFlow201Step, Et as IntrospectBody, F as CreateFlowDefinitionBody, Ft as ListUsers200Item, G as CreateTeamBody, Gt as SubmitFlowEventBody, H as CreateSession201, Ht as RevokeTokenBody, I as CreateHandoff200, It as ListUsersParams, J as CreateUserBody, Jt as UpdateFlowDefinition200, K as CreateTeamParams, Kt as SubmitFlowStep200, L as CreateProject201, Lt as PatchProject200, M as CreateFlowBody, Mt as ListSchemasParams, N as CreateFlowBodyPurpose, Nt as ListSessions200, O as CreateFlow201StepChallenge, Ot as IssueChallengeBody, P as CreateFlowDefinition201, Pt as ListSessionsParams, Q as EndSessionParams, Qt as VerifyChallengeProofBody, R as CreateProjectBody, Rt as PatchProjectBody, S as CreateAuthAttemptBody, St as GetUserByID200, T as CreateFlow201BrandingLayout, Tt as Introspect200, U as CreateSessionBody, Ut as SetUserPasswordBody, V as CreateSchemaParams, Vt as RevokeSessionParams, W as CreateTeam201, Wt as SetUserPasswordParams, X as DeactivateFlowDefinitionParams, Xt as UpdateFlowDefinitionParams, Y as CreateUserParams, Yt as UpdateFlowDefinitionBody, Z as DeleteFlowDefinitionParams, Zt as VerifyChallengeProof200, _ as AuthorizeDevice200, _t as GetSessionParams, at as GetFlowStep200, b as AuthorizeGetParams, bt as GetToken200, ct as GetLiveDefault, dt as GetOpenIDConfiguration200, et as ExchangeHandoffBody, ft as GetProject200, g as ActivateFlowDefinitionParams, gt as GetSession200, ht as GetSchemaByIdParams, it as GetFlowDefinitionParams, j as CreateFlow201StepSsoProvidersItem, jt as ListSchemas200Item, k as CreateFlow201StepFieldsItem, kt as ListFlowDefinitions200, lt as GetMySession200, mt as GetSchemaById200, nt as GetAuthAttempt200, ot as GetHealthDefault, pt as GetReadyDefault, q as CreateUser201, qt as SubmitFlowStepBody, rt as GetFlowDefinition200, st as GetKeys200, tt as ExchangeHandoffParams, ut as GetMyUser200, v as AuthorizeDeviceParams, vt as GetTeam200, w as CreateFlow201Branding, wt as GetUserInfo200, x as CreateAuthAttempt201, xt as GetTokenBody, y as AuthorizeGetDefault, yt as GetTeamParams, z as CreateSchema201, zt as QueryProjects200 } from "./index-DSZnfOJH.mjs";
+import { $ as GetAuthAttempt200, $t as VerifyChallengeProof200, A as CreateFlow201StepGates, At as ListUserPasskeys200, B as CreateSchemaBody, Bt as QuerySessions200, C as CreateFlow201, Ct as ListBrandingParams, D as CreateFlow201StepActionsItem, Dt as ListFlowDefinitionsParams, E as CreateFlow201Step, Et as ListFlowDefinitions200, F as CreateFlowDefinitionBody, Ft as ListUsersParams, G as CreateTeamBody, Gt as QueryTeamsParams, H as CreateSession201, Ht as QuerySessionsParams, I as CreateHandoff200, It as PatchProject200, J as CreateUserBody, Jt as SubmitFlowStepBody, K as CreateTeamParams, Kt as SetUserPasswordBody, L as CreateProject201, Lt as PatchProjectBody, M as CreateFlowBody, Mt as ListUserTeams200, N as CreateFlowBodyPurpose, Nt as ListUserTeamsParams, O as CreateFlow201StepChallenge, Ot as ListSchemas200Item, P as CreateFlowDefinition201, Pt as ListUsers200, Q as ExchangeHandoffParams, Qt as UpdateTeamBody, R as CreateProjectBody, Rt as QueryProjects200, S as CreateBrandingParams, St as ListBranding200Item, T as CreateFlow201BrandingLayout, Tt as ListEventsParams, U as CreateSessionBody, Ut as QueryTeams200, V as CreateSchemaParams, Vt as QuerySessionsBody, W as CreateTeam201, Wt as QueryTeamsBody, X as ExchangeHandoff200, Xt as UpdateFlowDefinitionBody, Y as CreateUserParams, Yt as UpdateFlowDefinition200, Z as ExchangeHandoffBody, Zt as UpdateTeam200, _ as CompleteClaimBody, _t as GetUserByID200, at as GetFlowDefinition200, b as CreateBranding201, bt as IssueChallenge201, ct as GetLiveDefault, dt as GetProject200, en as VerifyChallengeProofBody, et as GetBrandingById200, ft as GetReadyDefault, g as CompleteClaim200, gt as GetTeam200, ht as GetSession200, it as GetEventParams, j as CreateFlow201StepSsoProvidersItem, jt as ListUserPasskeysParams, k as CreateFlow201StepFieldsItem, kt as ListSchemasParams, lt as GetMySession200, mt as GetSchemaByIdParams, nt as GetClaimStatusParams, ot as GetFlowStep200, pt as GetSchemaById200, q as CreateUser201, qt as SubmitFlowStep200, rt as GetEvent200, st as GetHealthDefault, tt as GetClaimStatus200, ut as GetMyUser200, v as CreateAuthAttempt201, vt as GetUserByIDParams, w as CreateFlow201Branding, wt as ListEvents200, x as CreateBrandingBody, xt as IssueChallengeBody, y as CreateAuthAttemptBody, yt as InitClaim201, z as CreateSchema201, zt as QueryProjectsBody } from "./index-CAi5gsHK.mjs";
 import * as _$lit from "lit";
 import { LitElement, PropertyValues, ReactiveController, ReactiveControllerHost, nothing } from "lit";
 import layoutChromeCss from "./templates/layout-chrome.css?inline";
 
-//#region ../api/dist/zitadelNextGen-fcgWBw_N.d.mts
+//#region ../api/dist/zitadelNextGen-BkDpEAS9.d.mts
 //#region src/generated/endpoints/zitadelNextGen.d.ts
 declare namespace zitadelNextGen_d_exports {
-  export { activateFlowDefinition, authorizeDevice, authorizeGet, createAuthAttempt, createFlow, createFlowDefinition, createHandoff, createProject, createSchema, createSession, createTeam, createUser, deactivateFlowDefinition, deleteFlowDefinition, endSession, exchangeHandoff, getActivateFlowDefinitionUrl, getAuthAttempt, getAuthorizeDeviceUrl, getAuthorizeGetUrl, getCreateAuthAttemptUrl, getCreateFlowDefinitionUrl, getCreateFlowUrl, getCreateHandoffUrl, getCreateProjectUrl, getCreateSchemaUrl, getCreateSessionUrl, getCreateTeamUrl, getCreateUserUrl, getDeactivateFlowDefinitionUrl, getDeleteFlowDefinitionUrl, getEndSessionUrl, getExchangeHandoffUrl, getFlowDefinition, getFlowStep, getGetAuthAttemptUrl, getGetFlowDefinitionUrl, getGetFlowStepUrl, getGetHealthUrl, getGetKeysUrl, getGetLiveUrl, getGetMySessionUrl, getGetMyUserUrl, getGetOpenIDConfigurationUrl, getGetProjectUrl, getGetReadyUrl, getGetSchemaByIdUrl, getGetSessionUrl, getGetTeamUrl, getGetTokenUrl, getGetUserByIDUrl, getGetUserInfoUrl, getHealth, getIntrospectUrl, getIssueChallengeUrl, getKeys, getListFlowDefinitionsUrl, getListSchemasUrl, getListSessionsUrl, getListUsersUrl, getLive, getMySession, getMyUser, getOpenIDConfiguration, getPatchProjectUrl, getProject, getQueryProjectsUrl, getReady, getRevokeMySessionUrl, getRevokeSessionUrl, getRevokeTokenUrl, getSchemaById, getSession, getSetUserPasswordUrl, getSubmitFlowEventUrl, getSubmitFlowStepUrl, getTeam, getToken, getUpdateFlowDefinitionUrl, getUserByID, getUserInfo, getVerifyChallengeProofUrl, introspect, issueChallenge, listFlowDefinitions, listSchemas, listSessions, listUsers, patchProject, queryProjects, revokeMySession, revokeSession, revokeToken, setUserPassword, submitFlowEvent, submitFlowStep, updateFlowDefinition, verifyChallengeProof };
+  export { completeClaim, createAuthAttempt, createBranding, createFlow, createFlowDefinition, createHandoff, createProject, createSchema, createSession, createTeam, createUser, deleteFlowDefinition, deleteTeam, deleteUserByID, exchangeHandoff, getAuthAttempt, getBrandingById, getClaimStatus, getCompleteClaimUrl, getCreateAuthAttemptUrl, getCreateBrandingUrl, getCreateFlowDefinitionUrl, getCreateFlowUrl, getCreateHandoffUrl, getCreateProjectUrl, getCreateSchemaUrl, getCreateSessionUrl, getCreateTeamUrl, getCreateUserUrl, getDeleteFlowDefinitionUrl, getDeleteTeamUrl, getDeleteUserByIDUrl, getEvent, getExchangeHandoffUrl, getFlowDefinition, getFlowStep, getGetAuthAttemptUrl, getGetBrandingByIdUrl, getGetClaimStatusUrl, getGetEventUrl, getGetFlowDefinitionUrl, getGetFlowStepUrl, getGetHealthUrl, getGetLiveUrl, getGetMySessionUrl, getGetMyUserUrl, getGetProjectUrl, getGetReadyUrl, getGetSchemaByIdUrl, getGetSessionUrl, getGetTeamUrl, getGetUserByIDUrl, getHealth, getInitClaimUrl, getIssueChallengeUrl, getListBrandingUrl, getListEventsUrl, getListFlowDefinitionsUrl, getListSchemasUrl, getListUserPasskeysUrl, getListUserTeamsUrl, getListUsersUrl, getLive, getMySession, getMyUser, getPatchProjectUrl, getProject, getQueryProjectsUrl, getQuerySessionsUrl, getQueryTeamsUrl, getReady, getRevokeMySessionUrl, getRevokeSessionUrl, getSchemaById, getSession, getSetUserPasswordUrl, getSubmitFlowStepUrl, getTeam, getUpdateFlowDefinitionUrl, getUpdateTeamUrl, getUserByID, getVerifyChallengeProofUrl, initClaim, issueChallenge, listBranding, listEvents, listFlowDefinitions, listSchemas, listUserPasskeys, listUserTeams, listUsers, patchProject, queryProjects, querySessions, queryTeams, revokeMySession, revokeSession, setUserPassword, submitFlowStep, updateFlowDefinition, updateTeam, verifyChallengeProof };
 }
-declare const getGetOpenIDConfigurationUrl: () => string;
-/**
- * Retrieve the OpenID Connect configuration
- * @summary Get OpenID Connect configuration
- */
-declare const getOpenIDConfiguration: (options?: RequestInit) => Promise<GetOpenIDConfiguration200>;
-declare const getAuthorizeGetUrl: (params: AuthorizeGetParams) => string;
-/**
- * @summary Authorize a user
- */
-declare const authorizeGet: (params: AuthorizeGetParams, options?: RequestInit) => Promise<AuthorizeGetDefault>;
-declare const getAuthorizeDeviceUrl: (params: AuthorizeDeviceParams) => string;
-/**
- * @summary Authorize a device
- */
-declare const authorizeDevice: (params: AuthorizeDeviceParams, options?: RequestInit) => Promise<AuthorizeDevice200>;
-declare const getEndSessionUrl: (params?: EndSessionParams) => string;
-/**
- * @summary End a session
- */
-declare const endSession: (params?: EndSessionParams, options?: RequestInit) => Promise<void>;
-declare const getIntrospectUrl: () => string;
-/**
- * @summary Introspect a token
- */
-declare const introspect: (introspectBody: IntrospectBody, options?: RequestInit) => Promise<Introspect200>;
-declare const getGetKeysUrl: () => string;
-/**
- * @summary Get public keys
- */
-declare const getKeys: (options?: RequestInit) => Promise<GetKeys200>;
-declare const getRevokeTokenUrl: () => string;
-/**
- * @summary Revoke an access token or refresh token
- */
-declare const revokeToken: (revokeTokenBody: RevokeTokenBody, options?: RequestInit) => Promise<void>;
-declare const getGetTokenUrl: () => string;
-/**
- * @summary Get access token
- */
-declare const getToken: (getTokenBody: GetTokenBody, options?: RequestInit) => Promise<GetToken200>;
-declare const getGetUserInfoUrl: () => string;
-/**
- * @summary Get user info
- */
-declare const getUserInfo: (options?: RequestInit) => Promise<GetUserInfo200>;
 declare const getGetHealthUrl: () => string;
 /**
  * Check whether the server is healthy
@@ -81,17 +35,40 @@ declare const getListUsersUrl: (params?: ListUsersParams) => string;
 /**
  * @summary List users
  */
-declare const listUsers: (params?: ListUsersParams, options?: RequestInit) => Promise<ListUsers200Item[]>;
-declare const getGetUserByIDUrl: (userId: string, params: GetUserByIDParams) => string;
+declare const listUsers: (params?: ListUsersParams, options?: RequestInit) => Promise<ListUsers200>;
+declare const getGetUserByIDUrl: (userId: string, params?: GetUserByIDParams) => string;
 /**
  * @summary Get user by ID
  */
-declare const getUserByID: (userId: string, params: GetUserByIDParams, options?: RequestInit) => Promise<GetUserByID200>;
-declare const getSetUserPasswordUrl: (userId: string, params: SetUserPasswordParams) => string;
+declare const getUserByID: (userId: string, params?: GetUserByIDParams, options?: RequestInit) => Promise<GetUserByID200>;
+declare const getDeleteUserByIDUrl: (userId: string) => string;
+/**
+ * @summary Delete user by ID
+ */
+declare const deleteUserByID: (userId: string, options?: RequestInit) => Promise<void>;
+declare const getListUserPasskeysUrl: (userId: string, params?: ListUserPasskeysParams) => string;
+/**
+ * @summary List user passkeys
+ */
+declare const listUserPasskeys: (userId: string, params?: ListUserPasskeysParams, options?: RequestInit) => Promise<ListUserPasskeys200>;
+declare const getSetUserPasswordUrl: (userId: string) => string;
 /**
  * @summary Set user password
  */
-declare const setUserPassword: (userId: string, setUserPasswordBody: SetUserPasswordBody, params: SetUserPasswordParams, options?: RequestInit) => Promise<void>;
+declare const setUserPassword: (userId: string, setUserPasswordBody: SetUserPasswordBody, options?: RequestInit) => Promise<void>;
+declare const getListUserTeamsUrl: (userId: string, params?: ListUserTeamsParams) => string;
+/**
+ * The user's team roster, ordered by team name. Each entry carries the
+team's name, so a client renders a page without resolving ids one by one.
+
+This is the N:N roster and it is not lifecycle ownership: the single team
+that owns the user's lifecycle is reported as `metadata.lifecycle_owner_team_id`
+on the user read endpoints. Memberships the user was removed from are not
+returned.
+
+ * @summary List the teams a user belongs to
+ */
+declare const listUserTeams: (userId: string, params?: ListUserTeamsParams, options?: RequestInit) => Promise<ListUserTeams200>;
 declare const getGetMyUserUrl: () => string;
 /**
  * @summary Get my user information
@@ -104,7 +81,7 @@ the first capability step. Creates a new session implicitly unless
 `session_id` is provided (for step-up / reauth on an existing session).
 
 The response contains an `id` field — the flow handle. Use it as the path
-parameter for all subsequent `/flow/{id}/submit` and `/flow/{id}/event` calls.
+parameter for all subsequent `/flow/{id}/submit` calls.
 
 The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
 the flow's orchestration state (current step, collected data, history).
@@ -155,14 +132,6 @@ frontend never sees a `complete` for intermediate flows.
  * @summary Submit step data and advance
  */
 declare const submitFlowStep: (id: string, submitFlowStepBody: SubmitFlowStepBody, options?: RequestInit) => Promise<SubmitFlowStep200>;
-declare const getSubmitFlowEventUrl: (id: string) => string;
-/**
- * Submits telemetry or fingerprint data from the frontend.
-Does not advance the state machine. Used for risk evaluation.
-
- * @summary Submit client-side event
- */
-declare const submitFlowEvent: (id: string, submitFlowEventBody: SubmitFlowEventBody, options?: RequestInit) => Promise<void>;
 declare const getCreateAuthAttemptUrl: () => string;
 /**
  * Starts a new authentication attempt. This is the entry point for the auth_attempts state machine.
@@ -257,6 +226,37 @@ declare const getPatchProjectUrl: (projectId: string) => string;
  * @summary Update project
  */
 declare const patchProject: (projectId: string, patchProjectBody: PatchProjectBody, options?: RequestInit) => Promise<PatchProject200>;
+declare const getInitClaimUrl: (projectId: string) => string;
+/**
+ * Starts a claim challenge for an unclaimed project. Authenticated by the
+project secret, this mints a single-use, short-lived challenge and returns
+the `claim_url` the developer opens in a browser to complete the claim,
+together with the `challenge_id` the CLI polls with. The exact expiry is
+carried by `expires_at` on the response.
+
+ * @summary Initialize a project claim
+ */
+declare const initClaim: (projectId: string, options?: RequestInit) => Promise<InitClaim201>;
+declare const getGetClaimStatusUrl: (projectId: string, params: GetClaimStatusParams) => string;
+/**
+ * Polled by the CLI while a browser completes the claim. Authorized by the
+project secret that initiated the challenge. Returns `pending`, or
+`completed` with the owning team, the claim timestamp, and the dashboard
+URL once the browser leg has finished.
+
+ * @summary Get claim status
+ */
+declare const getClaimStatus: (projectId: string, params: GetClaimStatusParams, options?: RequestInit) => Promise<GetClaimStatus200>;
+declare const getCompleteClaimUrl: (projectId: string) => string;
+/**
+ * Called by the browser after the developer authenticates on the claim page.
+Authenticated by the `__nextgen_session` cookie, it attaches the project to
+the developer's personal team using the `challenge_id` from the claim URL as
+its single-use, browser-safe authorization.
+
+ * @summary Complete a project claim
+ */
+declare const completeClaim: (projectId: string, completeClaimBody: CompleteClaimBody, options?: RequestInit) => Promise<CompleteClaim200>;
 declare const getCreateSessionUrl: () => string;
 /**
  * Creates an anonymous session shell with no user and no factors (`state: building`).
@@ -267,8 +267,16 @@ Use this explicitly when you want to:
   can be correlated with the eventual authenticated session from the start.
 - Track anonymous state (bot detection, device fingerprint) that survives until authentication.
 
-The returned `session_token` authorises GET and DELETE on this session.
-It is superseded when a handoff exchange completes — clients must replace it at that point.
+Creating a session is an app-plane operation on the project credential
+(`session.write`). The returned `session_token` is a session credential for the
+end-user client, not a management scope: it is delivered as the
+`__nextgen_session` cookie and authorises the self-service operations
+`GET /sessions/me` and `DELETE /sessions/me` (`nextgenSession` scheme). The
+by-id operations `GET /sessions/{session_id}` and `DELETE /sessions/{session_id}`
+are operator endpoints and require `session.read` / `session.delete` instead.
+
+The `session_token` is superseded when a handoff exchange completes — clients must
+replace it at that point.
 
 Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
 full session TTL when the first authentication factor is written via a completing `auth_attempt`.
@@ -276,14 +284,15 @@ full session TTL when the first authentication factor is written via a completin
  * @summary Create an anonymous session shell
  */
 declare const createSession: (createSessionBody: CreateSessionBody, options?: RequestInit) => Promise<CreateSession201>;
-declare const getListSessionsUrl: (params: ListSessionsParams) => string;
+declare const getQuerySessionsUrl: (params: QuerySessionsParams) => string;
 /**
- * Returns a paginated list of sessions for a project.
-Requires a project service key (OAuth2 client credentials).
+ * Returns the sessions of a project, paginated with a cursor.
+Sessions of every lifecycle state are returned; each carries its `state`.
+Requires `session.read` permission.
 
- * @summary List sessions
+ * @summary Query sessions
  */
-declare const listSessions: (params: ListSessionsParams, options?: RequestInit) => Promise<ListSessions200>;
+declare const querySessions: (querySessionsBody: QuerySessionsBody, params: QuerySessionsParams, options?: RequestInit) => Promise<QuerySessions200>;
 declare const getExchangeHandoffUrl: (params: ExchangeHandoffParams) => string;
 /**
  * Consumes a one-time `handoff_token` minted by `POST /auth_attempts/{id}/handoff`
@@ -307,7 +316,7 @@ Requires a project service key (OAuth2 client credentials).
  * @summary Exchange handoff token for a session
  */
 declare const exchangeHandoff: (exchangeHandoffBody: ExchangeHandoffBody, params: ExchangeHandoffParams, options?: RequestInit) => Promise<ExchangeHandoff200>;
-declare const getGetSessionUrl: (sessionId: string, params: GetSessionParams) => string;
+declare const getGetSessionUrl: (sessionId: string) => string;
 /**
  * Returns the current state of a session including its factors and all currently
 satisfied assurance levels.
@@ -318,17 +327,22 @@ against the same `session_id`) to restore a dropped assurance level.
 
  * @summary Get session state
  */
-declare const getSession: (sessionId: string, params: GetSessionParams, options?: RequestInit) => Promise<GetSession200>;
-declare const getRevokeSessionUrl: (sessionId: string, params: RevokeSessionParams) => string;
+declare const getSession: (sessionId: string, options?: RequestInit) => Promise<GetSession200>;
+declare const getRevokeSessionUrl: (sessionId: string) => string;
 /**
- * Revokes the session immediately (`state: revoked`). This is the logout operation.
+ * Permanently deletes the session, terminating it immediately.
+
+This is the operator revoke path and requires the `session.delete` scope on a
+project-bound credential. End-user logout with the `__nextgen_session` cookie is
+`DELETE /sessions/me` (`nextgenSession` scheme).
 
-The session_token issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated.
+Idempotent: deleting a session that does not exist (or was already deleted)
+still returns 204. After deletion, any tokens derived from the session are
+invalidated.
 
  * @summary Revoke session
  */
-declare const revokeSession: (sessionId: string, params: RevokeSessionParams, options?: RequestInit) => Promise<void>;
+declare const revokeSession: (sessionId: string, options?: RequestInit) => Promise<void>;
 declare const getGetMySessionUrl: () => string;
 /**
  * Returns the current state of the current session including its factors and all currently
@@ -343,20 +357,24 @@ against the same `session_id`) to restore a dropped assurance level.
 declare const getMySession: (options?: RequestInit) => Promise<GetMySession200>;
 declare const getRevokeMySessionUrl: () => string;
 /**
- * Revokes the session immediately (`state: revoked`). This is the logout operation.
+ * Logs out by permanently deleting the session.
 
-The __nextgen_session cookie issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated including the cookie itself, which is cleared in the response.
+The `__nextgen_session` cookie issued at creation (or superseded by a handoff
+exchange) is required. Idempotent: if the session is already gone this still
+returns 204. Any tokens derived from the session are invalidated, and the
+cookie itself is cleared in the response.
 
  * @summary Revoke my session
  */
 declare const revokeMySession: (options?: RequestInit) => Promise<void>;
 declare const getCreateSchemaUrl: (params: CreateSchemaParams) => string;
 /**
- * Create a new schema. The schema definition must include a unique $id field,
-which will be used to identify the schema in future requests. The $id must
-be a valid URI and should ideally point to the location where the schema
-can be accessed.
+ * Create a new schema. The optional `$id` field is the JSON Schema document
+URI used to identify the schema in future requests (GitOps-stable identity,
+not a free-form resource primary key). When `$id` is omitted, the server
+generates a `sch_*` URL. When provided, `$id` must be unique within the
+project and should ideally be a valid URI pointing at where the schema can
+be accessed.
 
 The schema can either be a concrete schema, e.g. a user schema, or a
 schema-url which will be resolved by the server.
@@ -372,12 +390,12 @@ supports pagination and filtering based on schema attributes.
  * @summary List all schemas
  */
 declare const listSchemas: (params: ListSchemasParams, options?: RequestInit) => Promise<ListSchemas200Item[]>;
-declare const getGetSchemaByIdUrl: (id: string, params: GetSchemaByIdParams) => string;
+declare const getGetSchemaByIdUrl: (id: string, params?: GetSchemaByIdParams) => string;
 /**
  * Get a schema by its ID. This will return the default revision of the schema.
  * @summary Get schema by ID
  */
-declare const getSchemaById: (id: string, params: GetSchemaByIdParams, options?: RequestInit) => Promise<GetSchemaById200>;
+declare const getSchemaById: (id: string, params?: GetSchemaByIdParams, options?: RequestInit) => Promise<GetSchemaById200>;
 declare const getCreateFlowDefinitionUrl: () => string;
 /**
  * Creates a new flow definition.
@@ -397,21 +415,21 @@ This endpoint can be used to view existing flow definitions and their configurat
  * @summary List flow definitions
  */
 declare const listFlowDefinitions: (params: ListFlowDefinitionsParams, options?: RequestInit) => Promise<ListFlowDefinitions200>;
-declare const getGetFlowDefinitionUrl: (id: string, params: GetFlowDefinitionParams) => string;
+declare const getGetFlowDefinitionUrl: (id: string) => string;
 /**
  * Get a flow definition by id
  * @summary Get a flow definition by id
  */
-declare const getFlowDefinition: (id: string, params: GetFlowDefinitionParams, options?: RequestInit) => Promise<GetFlowDefinition200>;
-declare const getUpdateFlowDefinitionUrl: (id: string, params: UpdateFlowDefinitionParams) => string;
+declare const getFlowDefinition: (id: string, options?: RequestInit) => Promise<GetFlowDefinition200>;
+declare const getUpdateFlowDefinitionUrl: (id: string) => string;
 /**
  * Update a flow definition by id. This endpoint replaces the existing flow definition.
 If `flow_definition.status` is omitted, the current status is preserved
 
  * @summary Update a flow definition by id
  */
-declare const updateFlowDefinition: (id: string, updateFlowDefinitionBody: UpdateFlowDefinitionBody, params: UpdateFlowDefinitionParams, options?: RequestInit) => Promise<UpdateFlowDefinition200>;
-declare const getDeleteFlowDefinitionUrl: (id: string, params: DeleteFlowDefinitionParams) => string;
+declare const updateFlowDefinition: (id: string, updateFlowDefinitionBody: UpdateFlowDefinitionBody, options?: RequestInit) => Promise<UpdateFlowDefinition200>;
+declare const getDeleteFlowDefinitionUrl: (id: string) => string;
 /**
  * Delete a flow definition by id.
 If the flow definition is currently being used by a flow, the deletion will fail.
@@ -419,36 +437,107 @@ If the flow definition is the last active flow definition for a given purpose, t
 
  * @summary Delete a flow definition by id
  */
-declare const deleteFlowDefinition: (id: string, params: DeleteFlowDefinitionParams, options?: RequestInit) => Promise<void>;
-declare const getActivateFlowDefinitionUrl: (id: string, params: ActivateFlowDefinitionParams) => string;
+declare const deleteFlowDefinition: (id: string, options?: RequestInit) => Promise<void>;
+declare const getCreateTeamUrl: (params: CreateTeamParams) => string;
+/**
+ * @summary Create team
+ */
+declare const createTeam: (createTeamBody: CreateTeamBody, params: CreateTeamParams, options?: RequestInit) => Promise<CreateTeam201>;
+declare const getQueryTeamsUrl: (params: QueryTeamsParams) => string;
 /**
- * Activate a flow definition by transitioning it from a `draft` state to an `active` state.
-Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
+ * Returns the teams of a project, paginated with a cursor.
 
- * @summary Activate a flow definition by ID.
+ * @summary Query teams
  */
-declare const activateFlowDefinition: (id: string, params: ActivateFlowDefinitionParams, options?: RequestInit) => Promise<void>;
-declare const getDeactivateFlowDefinitionUrl: (id: string, params: DeactivateFlowDefinitionParams) => string;
+declare const queryTeams: (queryTeamsBody: QueryTeamsBody, params: QueryTeamsParams, options?: RequestInit) => Promise<QueryTeams200>;
+declare const getGetTeamUrl: (teamId: string) => string;
 /**
- * Deactivates a flow definition in the `active` state by transitioning it to the `draft` state.
-Flow definitions in `draft` state cannot be used to start new flows. Existing flows that use the deactivated flow definition must gracefully handle this.
-Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
+ * Returns a Team by its id.
 
- * @summary Deactivate a flow definition by ID.
+ * @summary Get team
  */
-declare const deactivateFlowDefinition: (id: string, params: DeactivateFlowDefinitionParams, options?: RequestInit) => Promise<void>;
-declare const getCreateTeamUrl: (params: CreateTeamParams) => string;
+declare const getTeam: (teamId: string, options?: RequestInit) => Promise<GetTeam200>;
+declare const getDeleteTeamUrl: (teamId: string) => string;
 /**
- * @summary Create team
+ * Deactivates the team.
+
+The team is tombstoned rather than erased: it stays readable through
+getTeam with status `deactivated`. Its memberships are removed and the
+users whose lifecycle it owns are deactivated with it.
+
+The request is idempotent. Deleting a team that is already deactivated
+or doesn't exist succeeds without changing anything.
+
+ * @summary Delete team
  */
-declare const createTeam: (params: CreateTeamParams, createTeamBody?: CreateTeamBody, options?: RequestInit) => Promise<CreateTeam201>;
-declare const getGetTeamUrl: (teamId: string, params: GetTeamParams) => string;
+declare const deleteTeam: (teamId: string, options?: RequestInit) => Promise<void>;
+declare const getUpdateTeamUrl: (teamId: string) => string;
 /**
- * Returns the current state of a team.
+ * Update team. Only active teams can be updated.
 
- * @summary Get team
+ * @summary Update team
  */
-declare const getTeam: (teamId: string, params: GetTeamParams, options?: RequestInit) => Promise<GetTeam200>; //#endregion
+declare const updateTeam: (teamId: string, updateTeamBody: UpdateTeamBody, options?: RequestInit) => Promise<UpdateTeam200>;
+declare const getCreateBrandingUrl: (params: CreateBrandingParams) => string;
+/**
+ * Publishes a new immutable branding revision for the project. Branding
+revisions cannot be updated or deleted; every edit publishes a new
+revision, and flow responses resolve the latest revision per project
+(see ADR 040).
+
+The `liquid_template` is validated lexically on save (size, encoding,
+banned patterns such as `<script>` tags, inline event handlers, and the
+`| raw` filter). Authoritative LiquidJS validation runs at authoring
+time via `zitadel plan` / `zitadel apply`.
+
+ * @summary Publish a new branding revision
+ */
+declare const createBranding: (createBrandingBody: CreateBrandingBody, params: CreateBrandingParams, options?: RequestInit) => Promise<CreateBranding201>;
+declare const getListBrandingUrl: (params: ListBrandingParams) => string;
+/**
+ * Lists branding revisions for the project, newest first, capped at the
+100 most recent. The first entry is the revision flow responses
+currently resolve. Deliberately unpaginated in v1 — list endpoints
+gain a real query mechanism together (ADR 031); advertising pagination
+parameters the server ignores would be worse than none.
+
+ * @summary List branding revisions
+ */
+declare const listBranding: (params: ListBrandingParams, options?: RequestInit) => Promise<ListBranding200Item[]>;
+declare const getGetBrandingByIdUrl: (id: string) => string;
+/**
+ * Retrieves a single branding revision, including its stored configuration.
+ * @summary Get a branding revision by ID
+ */
+declare const getBrandingById: (id: string, options?: RequestInit) => Promise<GetBrandingById200>;
+declare const getListEventsUrl: (params: ListEventsParams) => string;
+/**
+ * Returns project-scoped audit events, newest-first by keyset on
+`(created_at, id)` (ADR 027 / ADR 049). Pass `order=asc` for oldest-first.
+Requires `events.read`.
+
+Pre-claim projects return an empty list (events are stored but not
+visible until claim succeeds). Team-scoped credentials see only events
+whose emit-time `team_id` matches the credential team (enforced when
+team-scoped tokens exist).
+
+Clients discriminate each item via `event_type` (OpenAPI Event oneOf) —
+see docs/design/api/events-catalog.md.
+
+ * @summary List events
+ */
+declare const listEvents: (params: ListEventsParams, options?: RequestInit) => Promise<ListEvents200>;
+declare const getGetEventUrl: (id: string, params: GetEventParams) => string;
+/**
+ * Loads a single event by `(project_id, id)`. Requires `events.read`.
+Events are not registered in `resource_scope_index`; project scope is
+required on the query (ADR 049). Misses and cross-project ids return 404.
+
+Pre-claim projects return 404 (stored events stay invisible until claim).
+
+ * @summary Get event by ID
+ */
+declare const getEvent: (id: string, params: GetEventParams, options?: RequestInit) => Promise<GetEvent200>; //#endregion
 //#endregion
 //#region ../api/dist/runtime/api-factory.d.mts
 //#region src/runtime/api-factory.d.ts
@@ -473,6 +562,8 @@ interface ZitadelProject {
   readonly projectId: string;
   /** Full URL of the Zitadel auth backend. */
   readonly url?: string;
+  /** The project's publishable key (ADR 036), sent as the bearer when set. */
+  readonly publishableKey?: string;
 }
 /**
  * Initializes app-wide SDK configuration and returns the frozen
@@ -510,9 +601,163 @@ declare const de: Locale;
 //#region src/orchestrator/locales/it.d.ts
 declare const it: Locale;
 //#endregion
+//#region src/orchestrator/locales/business.d.ts
+declare const businessLocales: Readonly<Record<string, Partial<Locale>>>;
+//#endregion
 //#region src/orchestrator/locales/index.d.ts
 declare const builtinLocales: Readonly<Record<string, Locale>>;
 //#endregion
+//#region src/orchestrator/branding.d.ts
+type FlowLayout = CreateFlow201BrandingLayout;
+type BrandingPalette = {
+  primary?: string;
+  on_primary?: string;
+  background?: string;
+  surface?: string;
+  muted?: string;
+  border?: string;
+  text?: string;
+  text_muted?: string;
+  link?: string;
+  success?: string;
+  warning?: string;
+  error?: string;
+};
+type BrandingTypography = {
+  font_family?: string;
+  font_family_mono?: string;
+  scale?: number;
+};
+type BrandingShape = {
+  radius?: "none" | "sm" | "md" | "lg" | "full";
+  density?: "compact" | "regular" | "comfortable";
+};
+type BrandingTheme = {
+  mode?: "light" | "dark" | "auto";
+  dark?: {
+    palette?: BrandingPalette;
+  };
+};
+type BrandingAssets = {
+  logo_dark?: string;
+  favicon?: string;
+  background_image?: string;
+};
+/**
+ * Wire shape (`CreateFlow201Branding`) plus the v2 client-only extension.
+ * Structurally a superset, so any `CreateFlow201Branding` payload from the
+ * wire is assignable to `Branding` without a cast.
+ *
+ * `attribution.show_zitadel` controls the "Secured with Zitadel" pill in
+ * the orchestrator footer. Tenants set it to `false` only when they have a
+ * licence that permits removing attribution (community / OSS deployments
+ * always show it). The flag intentionally lives on `Branding` so it can
+ * be overridden per-flow alongside the rest of the visual surface.
+ */
+type Branding = CreateFlow201Branding & {
+  palette?: BrandingPalette;
+  typography?: BrandingTypography;
+  shape?: BrandingShape;
+  assets?: BrandingAssets;
+  theme?: BrandingTheme;
+  attribution?: BrandingAttribution;
+};
+type BrandingAttribution = {
+  show_zitadel?: boolean;
+  custom_link?: {
+    label: string;
+    href: string;
+  };
+};
+//#endregion
+//#region src/orchestrator/theme-controller.d.ts
+type ResolvedTheme = "light" | "dark";
+/** Theme inputs a caller may express, before resolution. */
+type ThemeMode = "light" | "dark" | "auto";
+declare class ThemeController implements ReactiveController {
+  private readonly host;
+  private branding;
+  /** Element-level `theme` property — the embedding developer's explicit call. */
+  private explicitMode;
+  /** Used when neither the element nor the branding payload names a mode. */
+  private fallbackMode;
+  private mediaQuery;
+  private _theme;
+  constructor(host: ReactiveControllerHost);
+  get theme(): ResolvedTheme;
+  setBranding(branding: Branding | undefined): void;
+  /**
+   * Sets the element-level preference and the fallback used when neither the
+   * element nor the branding payload names a mode. Precedence, strongest
+   * first: element `theme` property → `branding.theme.mode` → fallback. The
+   * element wins because the page embedding the widget knows its own surface
+   * better than the tenant's stored branding does.
+   */
+  setModePreference(explicit: ThemeMode | undefined, fallback: ThemeMode): void;
+  hostConnected(): void;
+  hostDisconnected(): void;
+  private refresh;
+  private attach;
+  private detach;
+  private onMediaChange;
+  private update;
+}
+//#endregion
+//#region src/orchestrator/surface.d.ts
+/**
+ * Shared base for the orchestrator host elements (`<zitadel-login>`,
+ * `<zitadel-session>`) that render a themable page/widget surface.
+ *
+ * Owns the `variant` / `theme` public properties, the {@link ThemeController},
+ * and the per-update surface application (base tokens, branding overrides,
+ * font links, and the `data-theme` host stamp). Subclasses call
+ * {@link applySurfaceTheme} from their `willUpdate` so the resolved theme is
+ * committed in the same update cycle that reads it.
+ *
+ * Not a registered custom element — purely an implementation-sharing base.
+ */
+declare class ZitadelSurface extends LitElement {
+  /**
+   * Sizing/chrome mode. Components size to content; pages compose them —
+   * so the default is `widget`: content-sized, transparent host, no
+   * document-level default-font injection. Dedicated routes — the hosted
+   * shell and the scaffolded pages — opt into `page`, which claims the
+   * viewport, paints the surface background, and ships the brand font.
+   * Fine-grained height override in both modes: `--zl-page-min-height`.
+   */
+  accessor variant: "widget" | "page";
+  /**
+   * Colour mode: `light`, `dark`, or `auto` (follow `prefers-color-scheme`).
+   * Empty means "not stated", and resolution falls through to the tenant's
+   * `branding.theme.mode`, then to a variant-derived default — `dark` for
+   * `page` (the hosted design system surface) and `auto` for `widget`, so an
+   * embedded widget matches the visitor's preference instead of forcing a
+   * dark card onto a light page. Set it explicitly when your app's surface
+   * is fixed: `<zitadel-login theme="light">`.
+   */
+  accessor theme: "" | ThemeMode;
+  /**
+   * Visually hide the surface's own heading block (the step title and
+   * subtitle on `<zitadel-login>`, the heading line on
+   * `<zitadel-session>`) while keeping it in the accessibility tree. For
+   * embedders whose page already carries the heading — a brand-voice
+   * "Welcome back" above the card — so the widget doesn't repeat it.
+   * Reflected so host-page CSS and DOM assertions can key off the
+   * attribute, like `variant`.
+   */
+  accessor suppressHeader: boolean;
+  protected readonly themeController: ThemeController;
+  /**
+   * Resolve the active theme and commit it to this element's surface: adopt
+   * the base token sheet, layer the branding overrides, manage the
+   * document-level font links, and stamp `data-theme` / `data-theme-dark` on
+   * the host so token lookups (and host-page selectors) flip with the mode.
+   * `branding` is `undefined` for surfaces without a tenant payload — the
+   * theme then resolves through the element preference and variant fallback.
+   */
+  protected applySurfaceTheme(branding: Branding | undefined): void;
+}
+//#endregion
 //#region src/orchestrator/zitadel-login.d.ts
 /**
  * `<zitadel-login>` — the auth-UI orchestrator.
@@ -546,7 +791,7 @@ declare const builtinLocales: Readonly<Record<string, Locale>>;
  * - `docs/design/branding/form-participation.md`
  * - `docs/design/flowengine/template-security.md`
  */
-declare class ZitadelLogin extends LitElement {
+declare class ZitadelLogin extends ZitadelSurface {
   static shadowRootOptions: ShadowRootInit;
   static styles: _$lit.CSSResult;
   accessor purpose: CreateFlowBodyPurpose;
@@ -602,24 +847,24 @@ declare class ZitadelLogin extends LitElement {
    */
   accessor lang: string;
   /**
-   * Custom locale dictionaries keyed by language code. When set, these take
-   * precedence over the built-in dictionaries for matching language codes.
+   * Custom locale dictionaries keyed by language code. Entries may be
+   * partial — each is merged over the built-in dictionary for its language,
+   * so a preset like {@link businessLocales} (or a hand-written subset) is
+   * directly assignable:
    *
    * ```ts
-   * import { en } from "@zitadel/components";
-   * const locales = {
-   *   en: { ...en, "identifier.title": "Welcome" },
-   *   de: myGermanDict,
-   * };
+   * import { businessLocales } from "@zitadel/components";
+   * loginElement.locales = businessLocales;
+   * // or override individual keys:
+   * loginElement.locales = { en: { "identifier.title": "Welcome" } };
    * ```
    */
-  accessor locales: Record<string, Locale> | undefined;
+  accessor locales: Readonly<Record<string, Partial<Locale>>> | undefined;
   private accessor response;
   private accessor branding;
   private accessor loading;
   private accessor startupError;
   private accessor formValues;
-  private readonly themeController;
   private engine;
   private readonly sanitise;
   /**
@@ -627,7 +872,28 @@ declare class ZitadelLogin extends LitElement {
    * every `formValues` change otherwise re-parses the same template.
    */
   private tenantTemplateCache;
+  /**
+   * Whether the widget currently owns a same-document history entry (the
+   * "sentinel"). The sentinel exists so the browser's back gesture fires
+   * `popstate` instead of leaving the page. Exactly one sentinel is on
+   * the stack at a time: it is pushed when a step with a `kind: "back"`
+   * action renders, re-armed by `onPopState` after the browser consumes
+   * it, and retired by `applyResponse` when a step without a back action
+   * renders. The entry reuses the current URL, so the host page's
+   * location (including any hash-router fragment) is never modified.
+   */
+  private armed;
+  /**
+   * Set immediately before a self-initiated `history.back()` so the
+   * resulting `popstate` is ignored instead of being interpreted as a
+   * user back gesture.
+   */
+  private ignoreNextPop;
+  /** Bound `popstate` handler stored for cleanup in `disconnectedCallback`. */
+  private readonly handlePopState;
   createRenderRoot(): HTMLElement | DocumentFragment;
+  connectedCallback(): void;
+  disconnectedCallback(): void;
   /**
    * Start the flow after the first render rather than in `connectedCallback`.
    * Frameworks that wrap web components (e.g. `@lit/react` in the console)
@@ -653,10 +919,15 @@ declare class ZitadelLogin extends LitElement {
   updated(changed: PropertyValues<this>): void;
   /**
    * Apply captured values and move focus once the new step has fully
-   * rendered. This commit produces the step's `zl-field`/`zl-button` atoms,
-   * but those render their own shadow DOM on a later microtask — so await
-   * this element's update *and* the child atoms' first render before touching
-   * them, rather than guessing a frame with `requestAnimationFrame`.
+   * rendered. This commit produces the step's field/action atoms, but those
+   * render their own shadow DOM on a later microtask — so await this element's
+   * update *and* the child atoms' first render before touching them, rather
+   * than guessing a frame with `requestAnimationFrame`.
+   *
+   * Focus on the *initial* response is page-mode-only: a dedicated login
+   * route should focus its first field, but a widget embedded further down
+   * an arbitrary page must not steal focus and scroll-jump on load. Step
+   * swaps are user-initiated, so focus moves in both modes.
    */
   private hydrateStepAfterRender;
   render(): _$lit.TemplateResult<1>;
@@ -714,9 +985,34 @@ declare class ZitadelLogin extends LitElement {
    * `family_name` when the register step ran.
    */
   private deriveIdentity;
+  /** All rendered input atoms exposing the `formValue` contract. */
+  private fieldAtoms;
   private applyValuesToFields;
-  private captureValuesFromFields;
-  private currentFieldValue;
+  /**
+   * Names of the current step's `required` fields whose captured value is
+   * empty. Reads each atom's live `formValue` (the getter reflects the native
+   * control, so autofill that skipped `input` events is still seen), so this
+   * is browser-independent and does not rely on native constraint validation.
+   */
+  private missingRequiredFields;
+  /**
+   * Surface a client-side required-field error using the server's own
+   * validation dialect (`error.<field>_required`, "; "-joined), so it flows
+   * through the same localisation and inline/banner routing as a real
+   * backend rejection — no native browser bubble. Idempotent: re-running with
+   * the same keys (both submit entry points fire on one click) is a no-op.
+   */
+  private reportRequiredErrors;
+  /**
+   * Snapshot the current step's field values straight from the rendered input
+   * atoms through their uniform `formValue` contract. Tag-agnostic: every
+   * form-participating atom is read the same way, so a new field type needs no
+   * change here. Declared fields default to "" so the backend still runs its
+   * required-checks and challenge dispatch instead of silently advancing on a
+   * field-less payload. Captured values are folded into `formValues` for
+   * cross-step identity (the signed-in greeting) and post-error restoration.
+   */
+  private collectSubmitFields;
   /**
    * True once the user retired the current step error by editing a field or
    * dismissing the alert. Deliberately NON-reactive: consulting reactive
@@ -729,7 +1025,16 @@ declare class ZitadelLogin extends LitElement {
    */
   private stepErrorDismissed;
   private handleAtomInput;
-  /** `zl-change` from <zl-checkbox>/<zl-select>: only error clearing. */
+  /**
+   * `zl-change` from <zl-checkbox>/<zl-select>. Persist the atom's value into
+   * `formValues` — mirroring `handleAtomInput` for text fields — so a later
+   * step re-render (a validation error re-parses the template via `unsafeHTML`
+   * and rebuilds the atoms) restores the selection/checked state through
+   * `applyValuesToFields` instead of dropping back to the template default.
+   * Reads the live `formValue` off the atom rather than the event's `value`
+   * token, because an unchecked checkbox reports "" there but keeps its token
+   * in the detail. Also clears stale errors on the edited field.
+   */
   private handleAtomEdited;
   /** Explicit dismiss of the step-error alert (it removes itself). */
   private handleAlertDismiss;
@@ -740,6 +1045,7 @@ declare class ZitadelLogin extends LitElement {
    * Imperative on purpose; see {@link stepErrorDismissed}.
    */
   private clearStaleErrors;
+  /** Mirror a value onto the matching rendered atom (used after atom events). */
   private syncFieldElementValue;
   private handleAtomSubmit;
   /** Secondary navigation rows (`data-action` on `.zl-card-nav__link`). */
@@ -766,8 +1072,36 @@ declare class ZitadelLogin extends LitElement {
    */
   private handlePasskeyError;
   private findPrimaryAction;
+  /**
+   * On the initial paint, only a field earns focus: script-moved focus with
+   * no prior interaction matches `:focus-visible`, so autofocusing a button
+   * on a field-less step (passkey-first) paints a ring that reads as a
+   * pre-selected state. Step swaps keep button focus — there the browser
+   * derives the modality from the user's actual input.
+   */
   private moveFocusToFirstField;
   private submit;
+  /**
+   * Handle the browser's back/forward gesture (ADR 022). When `popstate`
+   * fires:
+   *
+   * - **Self-initiated** (`ignoreNextPop`) → `applyResponse` is retiring
+   *   the sentinel; ignore.
+   * - **Back press while armed** → the browser consumed the sentinel.
+   *   Re-arm it immediately — so the stack shape is identical on every
+   *   step and repeated presses behave the same at any flow depth — then
+   *   submit the step's `kind: "back"` action.
+   * - **Landing on the sentinel while armed** → the host page pushed an
+   *   entry above the sentinel (e.g. an in-page `#anchor` click) and the
+   *   user backed out of it. They are back where the widget expects them
+   *   — not asking the flow to go back; do nothing.
+   * - **Forward press onto a retired sentinel** (it survives as a forward
+   *   entry after `history.back()`) → bounce back: flow state is
+   *   server-authoritative, the browser cannot skip ahead
+   *   (ADR 022 §Edge cases).
+   * - Anything else is host-page traversal — leave the browser alone.
+   */
+  private onPopState;
   private handleTransportError;
 }
 declare global {
@@ -793,9 +1127,7 @@ declare global {
  * action, and calls the typed `revokeMySession` operation in `@zitadel/api`
  * (`DELETE /sessions/me`). The server clears the session cookie via
  * `Set-Cookie: Max-Age=0`; on success the element fires `zitadel-signout`
- * and optionally navigates to `post-sign-out-url`. (`getEndSessionUrl()`
- * additionally exposes the OIDC end-session URL for consumers that prefer a
- * user-agent-driven redirect.)
+ * and optionally navigates to `post-sign-out-url`.
  *
  * ## Template-slot mode
  *
@@ -837,12 +1169,13 @@ declare class ZitadelLogout extends LitElement {
   /** URL to navigate to after a successful sign-out. */
   accessor postSignOutUrl: string;
   /**
-   * OIDC `client_id` to forward as a query parameter on the end-session
-   * request, mirroring the standard end-session contract. Optional —
-   * leaving this empty is fine when the backend can resolve the client
-   * from the session cookie alone.
+   * Colour mode: `light`, `dark`, or `auto` (follow `prefers-color-scheme`).
+   * Empty means "not stated" and defaults to `auto` — the control lives
+   * inside the app's own chrome, so it follows the visitor's preference
+   * rather than forcing the dark login surface. Set it explicitly when the
+   * surrounding app surface is fixed: `<zitadel-logout theme="dark">`.
    */
-  accessor clientId: string;
+  accessor theme: "" | ThemeMode;
   private accessor displayName;
   private accessor displayEmail;
   private accessor displayUserId;
@@ -853,8 +1186,10 @@ declare class ZitadelLogout extends LitElement {
   private pendingTemplate;
   private projectedContainer;
   private identityRequested;
+  private readonly themeController;
   connectedCallback(): void;
   disconnectedCallback(): void;
+  willUpdate(): void;
   updated(): void;
   /** Declarative config read from this element's attributes. */
   private get projectAttrs();
@@ -890,13 +1225,6 @@ declare class ZitadelLogout extends LitElement {
    * `zitadel-signout` and optionally navigates to `postSignOutUrl`.
    */
   private doLogout;
-  /**
-   * Returns the absolute URL the end-session request will hit. Useful for
-   * test assertions and for consumers that prefer to navigate the browser
-   * directly (instead of fetching) so the OIDC session-end redirect is
-   * driven by the user agent.
-   */
-  getEndSessionUrl(): string;
   private handleSignOutClick;
   render(): _$lit.TemplateResult<1> | typeof nothing;
 }
@@ -908,7 +1236,7 @@ declare global {
 //#endregion
 //#region src/orchestrator/zitadel-session.d.ts
 /**
- * `<zitadel-session>` — the full-screen "signed in" card.
+ * `<zitadel-session>` — the "signed in" card.
  *
  * Renders the post-sign-in confirmation surface (Figma `7355:8959`): a
  * centred auth card reading "Signed in as {identity}" with a **Sign out**
@@ -916,6 +1244,14 @@ declare global {
  * `<zl-button>` atoms as the `<zitadel-login>` orchestrator, so it inherits
  * tenant branding tokens with no hardcoded colour, radius, or shadow.
  *
+ * Like `<zitadel-login>` it is widget-first: the default `variant="widget"`
+ * is content-sized and transparent so the card drops into an app's own
+ * page; dedicated signed-in routes opt into `variant="page"`, which claims
+ * the viewport and paints the surface background (the page paint lives on
+ * the internal `<zl-page-shell>`). `theme` resolves through the shared
+ * surface base — explicit value, else `dark` for `page` / `auto` for
+ * `widget`.
+ *
  * This is the companion surface to `<zitadel-login>` for the "go straight to
  * /login" flow: the orchestrator signs the user in and redirects here (or to
  * the consumer's own page); this element proves the session and offers a way
@@ -938,7 +1274,7 @@ declare global {
  * destination contract is still being decided. Consumers redirect after
  * sign-in via the `<zitadel-login>` `post-sign-in-url`.
  */
-declare class ZitadelSession extends LitElement {
+declare class ZitadelSession extends ZitadelSurface {
   static styles: _$lit.CSSResult[];
   /**
    * SDK project handle returned by `configureZitadel()`. Set from JS (or a
@@ -967,6 +1303,7 @@ declare class ZitadelSession extends LitElement {
   connectedCallback(): void;
   /** Single identity line: human-readable name, then email, then user_id. */
   private get identityLabel();
+  willUpdate(): void;
   updated(): void;
   /** Declarative config read from this element's attributes. */
   private get projectAttrs();
@@ -992,88 +1329,6 @@ declare global {
   }
 } //# sourceMappingURL=zitadel-session.d.ts.map
 //#endregion
-//#region src/orchestrator/branding.d.ts
-type FlowLayout = CreateFlow201BrandingLayout;
-type BrandingPalette = {
-  primary?: string;
-  on_primary?: string;
-  background?: string;
-  surface?: string;
-  muted?: string;
-  border?: string;
-  text?: string;
-  text_muted?: string;
-  link?: string;
-  success?: string;
-  warning?: string;
-  error?: string;
-};
-type BrandingTypography = {
-  font_family?: string;
-  font_family_mono?: string;
-  scale?: number;
-};
-type BrandingShape = {
-  radius?: "none" | "sm" | "md" | "lg" | "full";
-  density?: "compact" | "regular" | "comfortable";
-};
-type BrandingTheme = {
-  mode?: "light" | "dark" | "auto";
-  dark?: {
-    palette?: BrandingPalette;
-  };
-};
-type BrandingAssets = {
-  logo_dark?: string;
-  favicon?: string;
-  background_image?: string;
-};
-/**
- * Wire shape (`CreateFlow201Branding`) plus the v2 client-only extension.
- * Structurally a superset, so any `CreateFlow201Branding` payload from the
- * wire is assignable to `Branding` without a cast.
- *
- * `attribution.show_zitadel` controls the "Secured with Zitadel" pill in
- * the orchestrator footer. Tenants set it to `false` only when they have a
- * licence that permits removing attribution (community / OSS deployments
- * always show it). The flag intentionally lives on `Branding` so it can
- * be overridden per-flow alongside the rest of the visual surface.
- */
-type Branding = CreateFlow201Branding & {
-  palette?: BrandingPalette;
-  typography?: BrandingTypography;
-  shape?: BrandingShape;
-  assets?: BrandingAssets;
-  theme?: BrandingTheme;
-  attribution?: BrandingAttribution;
-};
-type BrandingAttribution = {
-  show_zitadel?: boolean;
-  custom_link?: {
-    label: string;
-    href: string;
-  };
-};
-//#endregion
-//#region src/orchestrator/theme-controller.d.ts
-type ResolvedTheme = "light" | "dark";
-declare class ThemeController implements ReactiveController {
-  private readonly host;
-  private branding;
-  private mediaQuery;
-  private _theme;
-  constructor(host: ReactiveControllerHost);
-  get theme(): ResolvedTheme;
-  setBranding(branding: Branding | undefined): void;
-  hostConnected(): void;
-  hostDisconnected(): void;
-  private refresh;
-  private attach;
-  private detach;
-  private onMediaChange;
-  private update;
-}
-//#endregion
 //#region src/orchestrator/branding-to-tokens.d.ts
 type BrandingToTokensOptions = {
   resolvedTheme?: ResolvedTheme;
@@ -1093,12 +1348,22 @@ declare function buildBrandingStylesheet(branding: Branding | undefined, options
  * root) so the base values exist before branding patches them.
  */
 declare function applyBrandingTokens(shadowRoot: ShadowRoot, branding: Branding | undefined, resolvedTheme: ResolvedTheme): void;
+/**
+ * Standalone branding→theme resolution for callers outside the orchestrator
+ * (SSR, tests, embedders composing atoms by hand). `<zitadel-login>` itself
+ * uses {@link ThemeController}, which layers the element's `theme` property
+ * and a variant-derived fallback on top of the same branding input.
+ *
+ * Defaults to dark: the design system's primary surface, and the mode a
+ * hosted login page renders when a tenant states no preference.
+ */
 declare function resolveTheme(branding: Branding | undefined): ResolvedTheme;
 //#endregion
 //#region src/orchestrator/font-loader.d.ts
 /**
  * Inject the tenant's `branding.font_url` stylesheet. Pass `null`/`undefined`
- * to remove it (e.g. when a flow resolves with no tenant font).
+ * to withdraw this surface's registration (e.g. when a flow resolves with no
+ * tenant font); the link disappears once no surface registers a URL.
  */
 declare function applyFontUrl(shadowRoot: ShadowRoot, fontUrl: string | null | undefined): void;
 //#endregion
@@ -1141,7 +1406,10 @@ type BrandingValidationResult = {
   branding: Branding | undefined;
   issues: readonly string[];
 };
-declare function validateBranding(input: Branding | undefined): BrandingValidationResult;
+type BrandingValidationContext = {
+  /** Origin of the document that will paint the branding payload. */renderingOrigin?: string;
+};
+declare function validateBranding(input: Branding | undefined, context?: BrandingValidationContext): BrandingValidationResult;
 //#endregion
 //#region src/orchestrator/template-context.d.ts
 type FlowMessage = {
@@ -1152,6 +1420,13 @@ type FlowError = {
   code?: string;
   text_key?: string;
   message?: string;
+  /**
+   * Name of the step field this error targets. When set (and the step renders
+   * that field), the template routes the error inline under the control via
+   * the `fieldError` filter; when absent it renders in the form-level banner
+   * (`formLevelError`). See `localiseFlowErrorKeys` in `liquid.ts`.
+   */
+  field?: string;
 };
 type FlowIdentity = {
   display_name?: string;
@@ -1180,5 +1455,5 @@ type LiquidContext = {
   loading: boolean;
 };
 //#endregion
-export { ZitadelSession as A, BrandingAssets as C, BrandingTheme as D, BrandingShape as E, de as F, Locale as I, en as L, ZitadelLogin as M, builtinLocales as N, BrandingTypography as O, it as P, Branding as S, BrandingPalette as T, applyBrandingTokens as _, LiquidContext as a, ResolvedTheme as b, getCurrentStep as c, createSanitiser as d, MANDATORY_GATES_MARKER as f, applyFontUrl as g, TEMPLATE_NAMES as h, FlowMessage as i, ZitadelLogout as j, FlowLayout as k, startFlow as l, patchMandatoryGates as m, FlowError as n, BrandingValidationResult as o, mandatoryGatesMarkerComment as p, FlowIdentity as r, validateBranding as s, layoutChromeCss as t, submitStep as u, buildBrandingStylesheet as v, BrandingAttribution as w, ThemeController as x, resolveTheme as y };
-//# sourceMappingURL=index-DjYJwejg.d.mts.map
+export { BrandingPalette as A, en as B, ZitadelLogin as C, Branding as D, ThemeMode as E, builtinLocales as F, businessLocales as I, it as L, BrandingTheme as M, BrandingTypography as N, BrandingAssets as O, FlowLayout as P, de as R, ZitadelLogout as S, ThemeController as T, applyFontUrl as _, LiquidContext as a, resolveTheme as b, validateBranding as c, submitStep as d, createSanitiser as f, TEMPLATE_NAMES as g, patchMandatoryGates as h, FlowMessage as i, BrandingShape as j, BrandingAttribution as k, getCurrentStep as l, mandatoryGatesMarkerComment as m, FlowError as n, BrandingValidationContext as o, MANDATORY_GATES_MARKER as p, FlowIdentity as r, BrandingValidationResult as s, layoutChromeCss as t, startFlow as u, applyBrandingTokens as v, ResolvedTheme as w, ZitadelSession as x, buildBrandingStylesheet as y, Locale as z };
+//# sourceMappingURL=index-Ce_81oFH.d.mts.map