@zitadel/components 0.1.0-alpha.18 → 0.1.0-alpha.19

package/dist/{index-DIGjtG4z.d.mts → index-CAi5gsHK.d.mts}

@@ -343,7 +343,7 @@ declare global {
   }
 } //# sourceMappingURL=zl-checkbox.d.ts.map
 //#endregion
-//#region ../api/dist/index-D6qIOslB.d.mts
+//#region ../api/dist/index-Dt_0fSH9.d.mts
 //#region src/generated/model/completeClaim200.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -1704,6 +1704,17 @@ type CreateFlowDefinition201FlowDefinitionStepsItemTransitions = {
     Example: login → recovery → back to login.
     */
     action?: "switch" | "pivot" | null;
+    /** Local re-purposing. When set, taking this transition changes the
+    flow's current purpose to this value — the dispatch mode a step's
+    challenges run under — while the flow's original purpose stays
+    pinned. Must be a purpose this definition serves, and `target`
+    must be that purpose's entry step. Mutually exclusive with
+    `action`: a transition either re-purposes within this flow or
+    targets another flow, never both.
+    Example: a "Sign up" navigation on the login identifier step
+    (`{ target: register, purpose: register }`).
+    */
+    purpose?: "login" | "register" | "recovery" | "profiling" | "reauth" | "link_account" | null;
   };
 }; //#endregion
 //#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItem.d.ts
@@ -2096,6 +2107,17 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions = {
     Example: login → recovery → back to login.
     */
     action?: "switch" | "pivot" | null;
+    /** Local re-purposing. When set, taking this transition changes the
+    flow's current purpose to this value — the dispatch mode a step's
+    challenges run under — while the flow's original purpose stays
+    pinned. Must be a purpose this definition serves, and `target`
+    must be that purpose's entry step. Mutually exclusive with
+    `action`: a transition either re-purposes within this flow or
+    targets another flow, never both.
+    Example: a "Sign up" navigation on the login identifier step
+    (`{ target: register, purpose: register }`).
+    */
+    purpose?: "login" | "register" | "recovery" | "profiling" | "reauth" | "link_account" | null;
   };
 }; //#endregion
 //#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItem.d.ts
@@ -2382,43 +2404,18 @@ type CreateSchemaBody = {
   "x-auth-methods": {
     password?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
     passkey?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
     magic_link?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
     sso?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
     otp?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
   };
   /** A map of additional properties for the user definition, where the
@@ -2426,14 +2423,13 @@ type CreateSchemaBody = {
   */
   properties?: {
     [key: string]: {
-      /** The verification method for this property, if applicable */"x-verify"?: string | null; /** The level of uniqueness for this property, if applicable */
-      "x-unique"?: "unspecified" | "project" | "team" | null; /** The claim name for this property, if applicable */
-      "x-claim"?: string | null; /** Whether this property is editable by the user or not */
-      "x-editable"?: boolean; /** Whether this property contains sensitive information or not */
-      "x-sensitive"?: boolean;
-      /** Whether this property is used for multi-factor authentication or not
-       */
-      "x-mfa"?: boolean;
+      /** The level of uniqueness for this property, if applicable */"x-unique"?: "unspecified" | "project" | "team" | null; /** The claim name for this property, if applicable */
+      "x-claim"?: string | null;
+      /** Whether this property's value may appear in audit event payloads. Audit
+      payloads are deny-by-default: a property without this annotation
+      contributes its key but never its value.
+      */
+      "x-audit"?: boolean;
       /** A map of additional properties for the user definition, where the key is
       the property name and the value is the property schema.
       */
@@ -2563,7 +2559,7 @@ type CreateSession201SessionMetadata = {
  */
 /**
  * Current lifecycle state of the session:
-- `building`: has a user factor but is still gathering authentication factors
+- `building`: no verified authentication factors yet
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
 
@@ -2608,7 +2604,7 @@ type CreateSession201Session = {
   session_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
   /** Current lifecycle state of the session:
-  - `building`: has a user factor but is still gathering authentication factors
+  - `building`: no verified authentication factors yet
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
    */
@@ -2816,7 +2812,7 @@ type CreateTeamParams = {
    */
   project_id: string;
 }; //#endregion
-//#region src/generated/model/createUser201.d.ts
+//#region src/generated/model/createUser201Attributes.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2825,27 +2821,14 @@ type CreateTeamParams = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * The content of this response is determined by the configured
-schema for users.
+ * The user's content, satisfying the schema named by `schema`. Property
+names and types are determined entirely by that schema.
 
  */
-type CreateUser201 = {
-  /** The unique identifier of the created user. */id: string;
+type CreateUser201Attributes = {
   [key: string]: unknown;
 }; //#endregion
-//#region src/generated/model/createUser400Details.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Additional error-specific context.
- */
-//#endregion
-//#region src/generated/model/createUserBodyMetadataStatus.d.ts
+//#region src/generated/model/createUser201MetadataStatus.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2856,18 +2839,18 @@ type CreateUser201 = {
 /**
  * The status of the user.
  */
-type CreateUserBodyMetadataStatus = (typeof CreateUserBodyMetadataStatus)[keyof typeof CreateUserBodyMetadataStatus];
-declare const CreateUserBodyMetadataStatus: {
+type CreateUser201MetadataStatus = (typeof CreateUser201MetadataStatus)[keyof typeof CreateUser201MetadataStatus];
+declare const CreateUser201MetadataStatus: {
   readonly active: "active";
   readonly suspended: "suspended";
   readonly deactivated: "deactivated";
   readonly pending_purge: "pending_purge";
 }; //#endregion
-//#region src/generated/model/createUserBodyMetadata.d.ts
-type CreateUserBodyMetadata = {
+//#region src/generated/model/createUser201Metadata.d.ts
+type CreateUser201Metadata = {
   /** The time when the user was created. */created_at: string; /** The time when the user was last updated. */
   updated_at: string; /** The status of the user. */
-  status: CreateUserBodyMetadataStatus;
+  status: CreateUser201MetadataStatus;
   /** The team that owns this user's identity lifecycle, or `null` when the
   user is self-owned. This is a single team and a different concept from
   the user's team roster: it decides who may deprovision the user, not
@@ -2876,52 +2859,35 @@ type CreateUserBodyMetadata = {
    */
   lifecycle_owner_team_id?: string | null;
 }; //#endregion
-//#region src/generated/model/createUserBody.d.ts
+//#region src/generated/model/createUser201.d.ts
 /**
  * A user represents an individual identity in the system. It can be used to
 represent a human user, but also a service account or any other type of
-identity. The content of a user is determined by the configured schema for
-users, this is only a base schema.
+identity.
 
-The server assigns the resource primary key (`id`) on create. Clients must
-not send `id` in the create body; it is returned in the create response.
+`attributes` is the document that satisfies the user schema named by
+`schema`: its property names and types are defined entirely by that schema,
+and it is what the schema validates. The rest of the object — `id`,
+`schema`, `metadata` — is the server-owned envelope. Keeping the two apart
+means a schema may name a property `id` or `metadata` without colliding with
+the envelope, and closed-world keywords (`additionalProperties: false`,
+`propertyNames`, `unevaluatedProperties`) behave as their author expects.
 
  */
-type CreateUserBody = {
-  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id?: string;
-  metadata?: CreateUserBodyMetadata;
-  [key: string]: unknown;
-}; //#endregion
-//#region src/generated/model/createUserDefault.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-//#endregion
-//#region src/generated/model/createUserParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type CreateUserParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
+type CreateUser201 = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id: string;
+  /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
    */
-  project_id: string;
-  /**
-   * The unique identifier of the team
-   * @pattern ^[a-zA-Z0-9_-]+$
+  schema: string;
+  /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
    */
-  team_id?: string;
+  attributes: CreateUser201Attributes;
+  metadata: CreateUser201Metadata;
 }; //#endregion
-//#region src/generated/model/deleteFlowDefinition409Details.d.ts
+//#region src/generated/model/createUser400Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2933,7 +2899,7 @@ type CreateUserParams = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/deleteFlowDefinitionParams.d.ts
+//#region src/generated/model/createUserBodyAttributes.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2941,14 +2907,42 @@ type CreateUserParams = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type DeleteFlowDefinitionParams = {
+/**
+ * The user's schema-defined content. Validated against `schema`; a
+property the schema does not permit is rejected with `user.invalid`.
+
+ */
+type CreateUserBodyAttributes = {
+  [key: string]: unknown;
+}; //#endregion
+//#region src/generated/model/createUserBody.d.ts
+/**
+ * `attributes` is the document that must satisfy the user schema named by
+`schema`.
+
+The resource primary key is server-assigned and returned in the response, so
+the request carries no `id`; `metadata` is server-owned for the same reason.
+Neither is part of this schema, which is what frees a user schema to declare
+properties of those names.
+
+A request carrying any other top-level property is rejected rather than
+ignored. `attributes` stays open, since the user schema is what determines
+what belongs in it.
+
+ */
+type CreateUserBody = {
   /**
-   * The project id to filter by.
-   * @pattern ^[a-zA-Z0-9_-]+$
+     * The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+        * @minLength 1
+     */
+  schema: string;
+  /** The user's schema-defined content. Validated against `schema`; a
+  property the schema does not permit is rejected with `user.invalid`.
    */
-  project_id: string;
+  attributes: CreateUserBodyAttributes;
 }; //#endregion
-//#region src/generated/model/deleteTeam400Details.d.ts
+//#region src/generated/model/createUserDefault.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2956,11 +2950,8 @@ type DeleteFlowDefinitionParams = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
 //#endregion
-//#region src/generated/model/deleteTeamParams.d.ts
+//#region src/generated/model/createUserParams.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2968,14 +2959,19 @@ type DeleteFlowDefinitionParams = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type DeleteTeamParams = {
+type CreateUserParams = {
   /**
    * The unique identifier of the project
    * @pattern ^[a-zA-Z0-9_-]+$
    */
   project_id: string;
+  /**
+   * The unique identifier of the team
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  team_id?: string;
 }; //#endregion
-//#region src/generated/model/deleteUserByID401Details.d.ts
+//#region src/generated/model/deleteFlowDefinition409Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2987,21 +2983,6 @@ type DeleteTeamParams = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/deleteUserByIDParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type DeleteUserByIDParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-}; //#endregion
 //#region src/generated/model/exchangeHandoff200SessionFactorsItemMethod.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -3085,7 +3066,7 @@ type ExchangeHandoff200SessionMetadata = {
  */
 /**
  * Current lifecycle state of the session:
-- `building`: has a user factor but is still gathering authentication factors
+- `building`: no verified authentication factors yet
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
 
@@ -3130,7 +3111,7 @@ type ExchangeHandoff200Session = {
   session_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
   /** Current lifecycle state of the session:
-  - `building`: has a user factor but is still gathering authentication factors
+  - `building`: no verified authentication factors yet
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
    */
@@ -3604,21 +3585,6 @@ type GetBrandingById200 = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/getBrandingByIdParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type GetBrandingByIdParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-}; //#endregion
 //#region src/generated/model/getClaimStatus200.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -3670,6 +3636,975 @@ type GetClaimStatusParams = {
    */
   challenge_id: string;
 }; //#endregion
+//#region src/generated/model/getEvent200.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Discriminated wide-event union (ADR 048 / ADR 049). Clients select the
+member via event_type; each member carries a typed payload.
+
+ */
+type GetEvent200 = ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.attempt.created";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.attempt.handed_off";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.check.failed";
+  /** Payload for `auth.check.failed` / `auth.check.succeeded`.
+  `auth_attempt_id` joins the check to its attempt for SIEM correlation.
+  */
+  payload: {
+    check_id: string;
+    check_type?: string;
+    auth_attempt_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.check.succeeded";
+  /** Payload for `auth.check.failed` / `auth.check.succeeded`.
+  `auth_attempt_id` joins the check to its attempt for SIEM correlation.
+  */
+  payload: {
+    check_id: string;
+    check_type?: string;
+    auth_attempt_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.factor.passkey.enrolled"; /** Payload for `auth.factor.*` events. */
+  payload: {
+    user_id: string;
+    factor_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.factor.password.set"; /** Payload for `auth.factor.*` events. */
+  payload: {
+    user_id: string;
+    factor_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.token.issued"; /** Payload for `auth.token.issued` events. */
+  payload: {
+    scopes?: string[];
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.token.revoked";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "authz.granted"; /** Payload for `authz.granted` events. */
+  payload: {
+    principal_type?: string;
+    principal_id?: string;
+    relation?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "branding.created";
+  /** Allowlisted fields for `branding.created`. Omits `liquid_template`.
+   */
+  payload: {
+    layout?: string;
+    logo_url?: string;
+    font_url?: string;
+    hero_url?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "flowdef.created";
+  /** Shared allowlisted fields for `flowdef.created` (full snapshot) and
+  `flowdef.updated` (delta: only changed fields present). Steps are omitted.
+  */
+  payload: {
+    name?: string;
+    status?: string;
+    user_schema?: string;
+    purposes?: {
+      [key: string]: string;
+    };
+    audience?: {
+      app_ids?: string[];
+      team_ids?: string[];
+    };
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "flowdef.deleted";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "flowdef.updated";
+  /** Shared allowlisted fields for `flowdef.created` (full snapshot) and
+  `flowdef.updated` (delta: only changed fields present). Steps are omitted.
+  */
+  payload: {
+    name?: string;
+    status?: string;
+    user_schema?: string;
+    purposes?: {
+      [key: string]: string;
+    };
+    audience?: {
+      app_ids?: string[];
+      team_ids?: string[];
+    };
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "project.created";
+  /** Shared allowlisted fields for `project.created` (full snapshot) and
+  `project.updated` (delta: only changed fields present).
+  */
+  payload: {
+    name?: string;
+    preview_origins?: string[];
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "project.deleted";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "project.updated";
+  /** Shared allowlisted fields for `project.created` (full snapshot) and
+  `project.updated` (delta: only changed fields present).
+  */
+  payload: {
+    name?: string;
+    preview_origins?: string[];
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "request.api"; /** Payload for `request.api` events. */
+  payload: {
+    operation_id: string; /** HTTP method. */
+    method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+    route_template: string;
+    /**
+     * @minimum 100
+     * @maximum 599
+     */
+    status: number; /** @minimum 0 */
+    duration_ms: number;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "schema.created";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "session.deleted"; /** Payload for `session.deleted` events. */
+  payload: {
+    reason?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "session.established"; /** Payload for `session.established` events. */
+  payload: {
+    user_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "team.created";
+  /** Shared allowlisted fields for `team.created` (snapshot) and
+  `team.updated` (delta: only changed fields present).
+  */
+  payload: {
+    name?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "team.deactivated";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "team.updated";
+  /** Shared allowlisted fields for `team.created` (snapshot) and
+  `team.updated` (delta: only changed fields present).
+  */
+  payload: {
+    name?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "user.create.failed"; /** Payload for `user.create.failed` events. */
+  payload: {
+    key_name?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "user.created";
+  /** Payload for `user.created`. Identity is `entity_id`; attribute values
+  appear only for schema fields marked `x-audit`.
+  */
+  payload: {
+    schema_id?: string;
+    attribute_keys?: string[];
+    attributes?: {
+      [key: string]: unknown;
+    };
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "user.deleted";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}); //#endregion
+//#region src/generated/model/getEvent401Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/getEventParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type GetEventParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+}; //#endregion
 //#region src/generated/model/getFlowDefinition200FlowDefinitionAudience.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -3922,6 +4857,17 @@ type GetFlowDefinition200FlowDefinitionStepsItemTransitions = {
     Example: login → recovery → back to login.
     */
     action?: "switch" | "pivot" | null;
+    /** Local re-purposing. When set, taking this transition changes the
+    flow's current purpose to this value — the dispatch mode a step's
+    challenges run under — while the flow's original purpose stays
+    pinned. Must be a purpose this definition serves, and `target`
+    must be that purpose's entry step. Mutually exclusive with
+    `action`: a transition either re-purposes within this flow or
+    targets another flow, never both.
+    Example: a "Sign up" navigation on the login identifier step
+    (`{ target: register, purpose: register }`).
+    */
+    purpose?: "login" | "register" | "recovery" | "profiling" | "reauth" | "link_account" | null;
   };
 }; //#endregion
 //#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItem.d.ts
@@ -4059,21 +5005,6 @@ type GetFlowDefinition200 = {
  * OpenAPI spec version: 0.0.1
  */
 //#endregion
-//#region src/generated/model/getFlowDefinitionParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type GetFlowDefinitionParams = {
-  /**
-   * The project id to filter by.
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-}; //#endregion
 //#region src/generated/model/getFlowStep200BrandingLayout.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -4731,7 +5662,7 @@ type GetMySession200Metadata = {
  */
 /**
  * Current lifecycle state of the session:
-- `building`: has a user factor but is still gathering authentication factors
+- `building`: no verified authentication factors yet
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
 
@@ -4776,7 +5707,7 @@ type GetMySession200 = {
   session_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
   /** Current lifecycle state of the session:
-  - `building`: has a user factor but is still gathering authentication factors
+  - `building`: no verified authentication factors yet
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
    */
@@ -4837,7 +5768,23 @@ Error code: auth.unauthorized
 
  */
 //#endregion
-//#region src/generated/model/getMyUser200MetadataStatus.d.ts
+//#region src/generated/model/getMyUser200Attributes.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The user's content, satisfying the schema named by `schema`. Property
+names and types are determined entirely by that schema.
+
+ */
+type GetMyUser200Attributes = {
+  [key: string]: unknown;
+}; //#endregion
+//#region src/generated/model/getMyUser200MetadataStatus.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -4872,17 +5819,29 @@ type GetMyUser200Metadata = {
 /**
  * A user represents an individual identity in the system. It can be used to
 represent a human user, but also a service account or any other type of
-identity. The content of a user is determined by the configured schema for
-users, this is only a base schema.
+identity.
 
-The server assigns the resource primary key (`id`) on create. Clients must
-not send `id` in the create body; it is returned in the create response.
+`attributes` is the document that satisfies the user schema named by
+`schema`: its property names and types are defined entirely by that schema,
+and it is what the schema validates. The rest of the object — `id`,
+`schema`, `metadata` — is the server-owned envelope. Keeping the two apart
+means a schema may name a property `id` or `metadata` without colliding with
+the envelope, and closed-world keywords (`additionalProperties: false`,
+`propertyNames`, `unevaluatedProperties`) behave as their author expects.
 
  */
 type GetMyUser200 = {
-  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id?: string;
-  metadata?: GetMyUser200Metadata;
-  [key: string]: unknown;
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id: string;
+  /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
+   */
+  schema: string;
+  /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
+   */
+  attributes: GetMyUser200Attributes;
+  metadata: GetMyUser200Metadata;
 }; //#endregion
 //#region src/generated/model/getMyUser401Details.d.ts
 /**
@@ -4970,43 +5929,18 @@ type GetSchemaById200 = {
   "x-auth-methods": {
     password?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
     passkey?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
     magic_link?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
     sso?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
     otp?: {
       /** Whether the authentication method is enabled or not */enabled: boolean;
-      /**
-       * The position of the authentication method in the list of supported methods
-       * @minimum 0
-       */
-      position: number;
     };
   };
   /** A map of additional properties for the user definition, where the
@@ -5014,14 +5948,13 @@ type GetSchemaById200 = {
    */
   properties?: {
     [key: string]: {
-      /** The verification method for this property, if applicable */"x-verify"?: string | null; /** The level of uniqueness for this property, if applicable */
-      "x-unique"?: "unspecified" | "project" | "team" | null; /** The claim name for this property, if applicable */
-      "x-claim"?: string | null; /** Whether this property is editable by the user or not */
-      "x-editable"?: boolean; /** Whether this property contains sensitive information or not */
-      "x-sensitive"?: boolean;
-      /** Whether this property is used for multi-factor authentication or not
-       */
-      "x-mfa"?: boolean;
+      /** The level of uniqueness for this property, if applicable */"x-unique"?: "unspecified" | "project" | "team" | null; /** The claim name for this property, if applicable */
+      "x-claim"?: string | null;
+      /** Whether this property's value may appear in audit event payloads. Audit
+      payloads are deny-by-default: a property without this annotation
+      contributes its key but never its value.
+      */
+      "x-audit"?: boolean;
       /** A map of additional properties for the user definition, where the key is
       the property name and the value is the property schema.
       */
@@ -5054,11 +5987,6 @@ type GetSchemaById200 = {
  * OpenAPI spec version: 0.0.1
  */
 type GetSchemaByIdParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
   /**
    * The unique identifier of the team
    * @pattern ^[a-zA-Z0-9_-]+$
@@ -5148,7 +6076,7 @@ type GetSession200Metadata = {
  */
 /**
  * Current lifecycle state of the session:
-- `building`: has a user factor but is still gathering authentication factors
+- `building`: no verified authentication factors yet
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
 
@@ -5193,7 +6121,7 @@ type GetSession200 = {
   session_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
   /** Current lifecycle state of the session:
-  - `building`: has a user factor but is still gathering authentication factors
+  - `building`: no verified authentication factors yet
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
    */
@@ -5251,21 +6179,6 @@ type GetSession200 = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/getSessionParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type GetSessionParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-}; //#endregion
 //#region src/generated/model/getTeam200Status.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -5313,7 +6226,7 @@ type GetTeam200 = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/getTeamParams.d.ts
+//#region src/generated/model/getUserByID200Attributes.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5321,12 +6234,13 @@ type GetTeam200 = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type GetTeamParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
+/**
+ * The user's content, satisfying the schema named by `schema`. Property
+names and types are determined entirely by that schema.
+
+ */
+type GetUserByID200Attributes = {
+  [key: string]: unknown;
 }; //#endregion
 //#region src/generated/model/getUserByID200MetadataStatus.d.ts
 /**
@@ -5363,17 +6277,29 @@ type GetUserByID200Metadata = {
 /**
  * A user represents an individual identity in the system. It can be used to
 represent a human user, but also a service account or any other type of
-identity. The content of a user is determined by the configured schema for
-users, this is only a base schema.
+identity.
 
-The server assigns the resource primary key (`id`) on create. Clients must
-not send `id` in the create body; it is returned in the create response.
+`attributes` is the document that satisfies the user schema named by
+`schema`: its property names and types are defined entirely by that schema,
+and it is what the schema validates. The rest of the object — `id`,
+`schema`, `metadata` — is the server-owned envelope. Keeping the two apart
+means a schema may name a property `id` or `metadata` without colliding with
+the envelope, and closed-world keywords (`additionalProperties: false`,
+`propertyNames`, `unevaluatedProperties`) behave as their author expects.
 
  */
 type GetUserByID200 = {
-  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id?: string;
-  metadata?: GetUserByID200Metadata;
-  [key: string]: unknown;
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id: string;
+  /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
+   */
+  schema: string;
+  /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
+   */
+  attributes: GetUserByID200Attributes;
+  metadata: GetUserByID200Metadata;
 }; //#endregion
 //#region src/generated/model/getUserByID401Details.d.ts
 /**
@@ -5396,11 +6322,6 @@ type GetUserByID200 = {
  * OpenAPI spec version: 0.0.1
  */
 type GetUserByIDParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
   /**
    * The unique identifier of the team
    * @pattern ^[a-zA-Z0-9_-]+$
@@ -5644,6 +6565,1067 @@ type ListBrandingParams = {
    */
   project_id: string;
 }; //#endregion
+//#region src/generated/model/listEvents200DataItem.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Discriminated wide-event union (ADR 048 / ADR 049). Clients select the
+member via event_type; each member carries a typed payload.
+
+ */
+type ListEvents200DataItem = ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.attempt.created";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.attempt.handed_off";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.check.failed";
+  /** Payload for `auth.check.failed` / `auth.check.succeeded`.
+  `auth_attempt_id` joins the check to its attempt for SIEM correlation.
+  */
+  payload: {
+    check_id: string;
+    check_type?: string;
+    auth_attempt_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.check.succeeded";
+  /** Payload for `auth.check.failed` / `auth.check.succeeded`.
+  `auth_attempt_id` joins the check to its attempt for SIEM correlation.
+  */
+  payload: {
+    check_id: string;
+    check_type?: string;
+    auth_attempt_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.factor.passkey.enrolled"; /** Payload for `auth.factor.*` events. */
+  payload: {
+    user_id: string;
+    factor_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.factor.password.set"; /** Payload for `auth.factor.*` events. */
+  payload: {
+    user_id: string;
+    factor_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.token.issued"; /** Payload for `auth.token.issued` events. */
+  payload: {
+    scopes?: string[];
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "auth.token.revoked";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "authz.granted"; /** Payload for `authz.granted` events. */
+  payload: {
+    principal_type?: string;
+    principal_id?: string;
+    relation?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "branding.created";
+  /** Allowlisted fields for `branding.created`. Omits `liquid_template`.
+   */
+  payload: {
+    layout?: string;
+    logo_url?: string;
+    font_url?: string;
+    hero_url?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "flowdef.created";
+  /** Shared allowlisted fields for `flowdef.created` (full snapshot) and
+  `flowdef.updated` (delta: only changed fields present). Steps are omitted.
+  */
+  payload: {
+    name?: string;
+    status?: string;
+    user_schema?: string;
+    purposes?: {
+      [key: string]: string;
+    };
+    audience?: {
+      app_ids?: string[];
+      team_ids?: string[];
+    };
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "flowdef.deleted";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "flowdef.updated";
+  /** Shared allowlisted fields for `flowdef.created` (full snapshot) and
+  `flowdef.updated` (delta: only changed fields present). Steps are omitted.
+  */
+  payload: {
+    name?: string;
+    status?: string;
+    user_schema?: string;
+    purposes?: {
+      [key: string]: string;
+    };
+    audience?: {
+      app_ids?: string[];
+      team_ids?: string[];
+    };
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "project.created";
+  /** Shared allowlisted fields for `project.created` (full snapshot) and
+  `project.updated` (delta: only changed fields present).
+  */
+  payload: {
+    name?: string;
+    preview_origins?: string[];
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "project.deleted";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "project.updated";
+  /** Shared allowlisted fields for `project.created` (full snapshot) and
+  `project.updated` (delta: only changed fields present).
+  */
+  payload: {
+    name?: string;
+    preview_origins?: string[];
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "request.api"; /** Payload for `request.api` events. */
+  payload: {
+    operation_id: string; /** HTTP method. */
+    method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+    route_template: string;
+    /**
+     * @minimum 100
+     * @maximum 599
+     */
+    status: number; /** @minimum 0 */
+    duration_ms: number;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "schema.created";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "session.deleted"; /** Payload for `session.deleted` events. */
+  payload: {
+    reason?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "session.established"; /** Payload for `session.established` events. */
+  payload: {
+    user_id?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "team.created";
+  /** Shared allowlisted fields for `team.created` (snapshot) and
+  `team.updated` (delta: only changed fields present).
+  */
+  payload: {
+    name?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "team.deactivated";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "team.updated";
+  /** Shared allowlisted fields for `team.created` (snapshot) and
+  `team.updated` (delta: only changed fields present).
+  */
+  payload: {
+    name?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "user.create.failed"; /** Payload for `user.create.failed` events. */
+  payload: {
+    key_name?: string;
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "user.created";
+  /** Payload for `user.created`. Identity is `entity_id`; attribute values
+  appear only for schema fields marked `x-audit`.
+  */
+  payload: {
+    schema_id?: string;
+    attribute_keys?: string[];
+    attributes?: {
+      [key: string]: unknown;
+    };
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null; /** Additional emit-time metadata (already redacted). */
+  metadata?: {
+    [key: string]: unknown;
+  };
+} & {
+  event_type: "user.deleted";
+  /** Empty payload for event types with no typed fields
+  (e.g. `project.deleted`, `user.deleted`, `session.expired`).
+  */
+  payload: {
+    [key: string]: unknown;
+  };
+}); //#endregion
+//#region src/generated/model/listEvents200.d.ts
+/**
+ * Paginated list of events (ADR 027 / ADR 049).
+ */
+type ListEvents200 = {
+  data: ListEvents200DataItem[];
+  /** Token to pass as `page_token` in the next request to fetch the following page.
+  Absent when there are no more results.
+   */
+  next_page_token?: string | null;
+}; //#endregion
+//#region src/generated/model/listEvents400Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/listEventsCategoryItem.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type ListEventsCategoryItem = (typeof ListEventsCategoryItem)[keyof typeof ListEventsCategoryItem];
+declare const ListEventsCategoryItem: {
+  readonly request: "request";
+  readonly auth: "auth";
+  readonly session: "session";
+  readonly admin: "admin";
+  readonly entity: "entity";
+  readonly signal: "signal";
+}; //#endregion
+//#region src/generated/model/listEventsDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/listEventsOrder.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type ListEventsOrder = (typeof ListEventsOrder)[keyof typeof ListEventsOrder];
+declare const ListEventsOrder: {
+  readonly asc: "asc";
+  readonly desc: "desc";
+}; //#endregion
+//#region src/generated/model/listEventsParams.d.ts
+type ListEventsParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+  /**
+  * Filter by wide-event category. Repeatable (OR within the parameter).
+    */
+  category?: ListEventsCategoryItem[];
+  /**
+  * Exact-match filter on `event_type`. Repeatable (OR within the parameter).
+    */
+  event_type?: string[];
+  actor_id?: string;
+  client_id?: string;
+  session_id?: string;
+  flow_id?: string;
+  request_id?: string;
+  fingerprint?: string;
+  entity_type?: string;
+  entity_id?: string;
+  /**
+   * Filter by emit-time team scope stored on the event.
+   */
+  team_id?: string;
+  /**
+   * Inclusive lower bound on `created_at` (RFC 3339).
+   */
+  created_after?: string;
+  /**
+   * Exclusive upper bound on `created_at` (RFC 3339).
+   */
+  created_before?: string;
+  /**
+  * Sort direction on `(created_at, id)`. Default `desc` (newest first)
+  for audit UI. Pass `asc` for oldest-first.
+    */
+  order?: ListEventsOrder;
+  /**
+  * Token for fetching the next page of results.
+  Obtain this value from `next_page_token` in the previous response.
+  Omit to start from the beginning.
+  Its format is opaque and may change between releases.
+    */
+  page_token?: string;
+  /**
+   * Maximum number of items to return.
+   * @minimum 1
+   * @maximum 100
+   */
+  limit?: number;
+}; //#endregion
 //#region src/generated/model/listFlowDefinitions200FlowDefinitionsItemStatus.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -5869,11 +7851,22 @@ type ListUserPasskeysParams = {
   Its format is opaque and may change between releases.
     */
   page_token?: string;
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
+}; //#endregion
+//#region src/generated/model/listUsers200UsersItemAttributes.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The user's content, satisfying the schema named by `schema`. Property
+names and types are determined entirely by that schema.
+
+ */
+type ListUsers200UsersItemAttributes = {
+  [key: string]: unknown;
 }; //#endregion
 //#region src/generated/model/listUsers200UsersItemMetadataStatus.d.ts
 /**
@@ -5910,17 +7903,29 @@ type ListUsers200UsersItemMetadata = {
 /**
  * A user represents an individual identity in the system. It can be used to
 represent a human user, but also a service account or any other type of
-identity. The content of a user is determined by the configured schema for
-users, this is only a base schema.
+identity.
 
-The server assigns the resource primary key (`id`) on create. Clients must
-not send `id` in the create body; it is returned in the create response.
+`attributes` is the document that satisfies the user schema named by
+`schema`: its property names and types are defined entirely by that schema,
+and it is what the schema validates. The rest of the object — `id`,
+`schema`, `metadata` — is the server-owned envelope. Keeping the two apart
+means a schema may name a property `id` or `metadata` without colliding with
+the envelope, and closed-world keywords (`additionalProperties: false`,
+`propertyNames`, `unevaluatedProperties`) behave as their author expects.
 
  */
 type ListUsers200UsersItem = {
-  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id?: string;
-  metadata?: ListUsers200UsersItemMetadata;
-  [key: string]: unknown;
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id: string;
+  /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
+   */
+  schema: string;
+  /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
+   */
+  attributes: ListUsers200UsersItemAttributes;
+  metadata: ListUsers200UsersItemMetadata;
 }; //#endregion
 //#region src/generated/model/listUsers200.d.ts
 /**
@@ -6053,11 +8058,6 @@ type ListUserTeamsParams = {
   Its format is opaque and may change between releases.
     */
   page_token?: string;
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
 }; //#endregion
 //#region src/generated/model/patchProject200.d.ts
 /**
@@ -6179,6 +8179,10 @@ declare const QueryProjectsBodyFilterItemField: {
  * Filter operation defines the operations which can be used when filtering on a
 query endpoint.
 
+On text fields, `contains` is a case-insensitive substring match. `equals`
+compares the whole value and is case-sensitive unless the field documents
+otherwise.
+
  */
 type QueryProjectsBodyFilterItemOperation = (typeof QueryProjectsBodyFilterItemOperation)[keyof typeof QueryProjectsBodyFilterItemOperation];
 declare const QueryProjectsBodyFilterItemOperation: {
@@ -6201,6 +8205,9 @@ type QueryProjectsBodyFilterItem = {
   value?: string | number | boolean | null;
   /** Filter operation defines the operations which can be used when filtering on a
   query endpoint.
+     On text fields, `contains` is a case-insensitive substring match. `equals`
+  compares the whole value and is case-sensitive unless the field documents
+  otherwise.
    */
   operation: QueryProjectsBodyFilterItemOperation;
 }; //#endregion
@@ -6344,7 +8351,7 @@ type QuerySessions200SessionsItemMetadata = {
  */
 /**
  * Current lifecycle state of the session:
-- `building`: has a user factor but is still gathering authentication factors
+- `building`: no verified authentication factors yet
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
 
@@ -6389,7 +8396,7 @@ type QuerySessions200SessionsItem = {
   session_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
   /** Current lifecycle state of the session:
-  - `building`: has a user factor but is still gathering authentication factors
+  - `building`: no verified authentication factors yet
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
    */
@@ -6470,7 +8477,8 @@ type QuerySessions200 = {
  * Field to filter sessions by:
 - `created_at`: RFC3339 timestamp
 - `user_id`: user id
-- `state`: one of `building`, `active`, `expired`
+- `state`: one of `building`, `active`, `expired`. State is computed at read
+  time, so a session expiring mid-request can match `active` but return `expired`.
 
  */
 type QuerySessionsBodyFilterItemField = (typeof QuerySessionsBodyFilterItemField)[keyof typeof QuerySessionsBodyFilterItemField];
@@ -6491,6 +8499,10 @@ declare const QuerySessionsBodyFilterItemField: {
  * Filter operation defines the operations which can be used when filtering on a
 query endpoint.
 
+On text fields, `contains` is a case-insensitive substring match. `equals`
+compares the whole value and is case-sensitive unless the field documents
+otherwise.
+
  */
 type QuerySessionsBodyFilterItemOperation = (typeof QuerySessionsBodyFilterItemOperation)[keyof typeof QuerySessionsBodyFilterItemOperation];
 declare const QuerySessionsBodyFilterItemOperation: {
@@ -6508,7 +8520,8 @@ type QuerySessionsBodyFilterItem = {
   /** Field to filter sessions by:
   - `created_at`: RFC3339 timestamp
   - `user_id`: user id
-  - `state`: one of `building`, `active`, `expired`
+  - `state`: one of `building`, `active`, `expired`. State is computed at read
+    time, so a session expiring mid-request can match `active` but return `expired`.
    */
   field: QuerySessionsBodyFilterItemField;
   /** Filter-value specifies which values can be filtered by a query endpoint. This
@@ -6518,6 +8531,9 @@ type QuerySessionsBodyFilterItem = {
   value?: string | number | boolean | null;
   /** Filter operation defines the operations which can be used when filtering on a
   query endpoint.
+     On text fields, `contains` is a case-insensitive substring match. `equals`
+  compares the whole value and is case-sensitive unless the field documents
+  otherwise.
    */
   operation: QuerySessionsBodyFilterItemOperation;
 }; //#endregion
@@ -6666,10 +8682,19 @@ type QueryTeams200 = {
  * Zitadel NextGen
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Field to filter or sort teams by.
+
+Team names are unique per project case-insensitively, so `name` is matched
+case-insensitively by `equals` as well as by `contains`.
+
  */
 type QueryTeamsBodyFilterItemField = (typeof QueryTeamsBodyFilterItemField)[keyof typeof QueryTeamsBodyFilterItemField];
 declare const QueryTeamsBodyFilterItemField: {
   readonly created_at: "created_at";
+  readonly name: "name";
+  readonly status: "status";
 }; //#endregion
 //#region src/generated/model/queryTeamsBodyFilterItemOperation.d.ts
 /**
@@ -6683,6 +8708,10 @@ declare const QueryTeamsBodyFilterItemField: {
  * Filter operation defines the operations which can be used when filtering on a
 query endpoint.
 
+On text fields, `contains` is a case-insensitive substring match. `equals`
+compares the whole value and is case-sensitive unless the field documents
+otherwise.
+
  */
 type QueryTeamsBodyFilterItemOperation = (typeof QueryTeamsBodyFilterItemOperation)[keyof typeof QueryTeamsBodyFilterItemOperation];
 declare const QueryTeamsBodyFilterItemOperation: {
@@ -6697,6 +8726,10 @@ declare const QueryTeamsBodyFilterItemOperation: {
 }; //#endregion
 //#region src/generated/model/queryTeamsBodyFilterItem.d.ts
 type QueryTeamsBodyFilterItem = {
+  /** Field to filter or sort teams by.
+     Team names are unique per project case-insensitively, so `name` is matched
+  case-insensitively by `equals` as well as by `contains`.
+   */
   field: QueryTeamsBodyFilterItemField;
   /** Filter-value specifies which values can be filtered by a query endpoint. This
   is a union of types. When a value is specified which is not assignable to the
@@ -6705,6 +8738,9 @@ type QueryTeamsBodyFilterItem = {
   value?: string | number | boolean | null;
   /** Filter operation defines the operations which can be used when filtering on a
   query endpoint.
+     On text fields, `contains` is a case-insensitive substring match. `equals`
+  compares the whole value and is case-sensitive unless the field documents
+  otherwise.
    */
   operation: QueryTeamsBodyFilterItemOperation;
 }; //#endregion
@@ -6728,13 +8764,26 @@ declare const QueryTeamsBodySortingDirection: {
  * Zitadel NextGen
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Field to filter or sort teams by.
+
+Team names are unique per project case-insensitively, so `name` is matched
+case-insensitively by `equals` as well as by `contains`.
+
  */
 type QueryTeamsBodySortingField = (typeof QueryTeamsBodySortingField)[keyof typeof QueryTeamsBodySortingField];
 declare const QueryTeamsBodySortingField: {
   readonly created_at: "created_at";
+  readonly name: "name";
+  readonly status: "status";
 }; //#endregion
 //#region src/generated/model/queryTeamsBodySorting.d.ts
 type QueryTeamsBodySorting = {
+  /** Field to filter or sort teams by.
+     Team names are unique per project case-insensitively, so `name` is matched
+  case-insensitively by `equals` as well as by `contains`.
+   */
   field: QueryTeamsBodySortingField;
   direction: QueryTeamsBodySortingDirection;
 }; //#endregion
@@ -6798,33 +8847,6 @@ Error code: auth.unauthorized
 
  */
 //#endregion
-//#region src/generated/model/revokeSessionParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type RevokeSessionParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-}; //#endregion
-//#region src/generated/model/setUserPassword400Details.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Additional error-specific context.
- */
-//#endregion
 //#region src/generated/model/setUserPasswordBody.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -6852,21 +8874,6 @@ type SetUserPasswordBody = {
  * OpenAPI spec version: 0.0.1
  */
 //#endregion
-//#region src/generated/model/setUserPasswordParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type SetUserPasswordParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-}; //#endregion
 //#region src/generated/model/submitFlowStep200BrandingLayout.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -7738,6 +9745,17 @@ type UpdateFlowDefinition200FlowDefinitionStepsItemTransitions = {
     Example: login → recovery → back to login.
     */
     action?: "switch" | "pivot" | null;
+    /** Local re-purposing. When set, taking this transition changes the
+    flow's current purpose to this value — the dispatch mode a step's
+    challenges run under — while the flow's original purpose stays
+    pinned. Must be a purpose this definition serves, and `target`
+    must be that purpose's entry step. Mutually exclusive with
+    `action`: a transition either re-purposes within this flow or
+    targets another flow, never both.
+    Example: a "Sign up" navigation on the login identifier step
+    (`{ target: register, purpose: register }`).
+    */
+    purpose?: "login" | "register" | "recovery" | "profiling" | "reauth" | "link_account" | null;
   };
 }; //#endregion
 //#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItem.d.ts
@@ -8130,6 +10148,17 @@ type UpdateFlowDefinitionBodyFlowDefinitionStepsItemTransitions = {
     Example: login → recovery → back to login.
     */
     action?: "switch" | "pivot" | null;
+    /** Local re-purposing. When set, taking this transition changes the
+    flow's current purpose to this value — the dispatch mode a step's
+    challenges run under — while the flow's original purpose stays
+    pinned. Must be a purpose this definition serves, and `target`
+    must be that purpose's entry step. Mutually exclusive with
+    `action`: a transition either re-purposes within this flow or
+    targets another flow, never both.
+    Example: a "Sign up" navigation on the login identifier step
+    (`{ target: register, purpose: register }`).
+    */
+    purpose?: "login" | "register" | "recovery" | "profiling" | "reauth" | "link_account" | null;
   };
 }; //#endregion
 //#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStepsItem.d.ts
@@ -8272,21 +10301,6 @@ type UpdateFlowDefinitionBody = {
  * OpenAPI spec version: 0.0.1
  */
 //#endregion
-//#region src/generated/model/updateFlowDefinitionParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type UpdateFlowDefinitionParams = {
-  /**
-   * The project id to filter by.
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-}; //#endregion
 //#region src/generated/model/updateTeam200Status.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -8362,21 +10376,6 @@ type UpdateTeamBody = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/updateTeamParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type UpdateTeamParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-}; //#endregion
 //#region src/generated/model/verifyChallengeProof200ChallengesItemMethod.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -9159,5 +11158,5 @@ declare global {
   }
 } //# sourceMappingURL=zl-select.d.ts.map
 //#endregion
-export { ExchangeHandoff200 as $, SubmitFlowStepBody as $t, CreateFlow201StepGates as A, ListFlowDefinitionsParams as At, CreateSchemaBody as B, PatchProjectBody as Bt, CreateFlow201 as C, GetUserByIDParams as Ct, CreateFlow201StepActionsItem as D, ListBranding200Item as Dt, CreateFlow201Step as E, IssueChallengeBody as Et, CreateFlowDefinitionBody as F, ListUserTeams200 as Ft, CreateTeamBody as G, QuerySessionsParams as Gt, CreateSession201 as H, QueryProjectsBody as Ht, CreateHandoff200 as I, ListUserTeamsParams as It, CreateUserBody as J, QueryTeamsParams as Jt, CreateTeamParams as K, QueryTeams200 as Kt, CreateProject201 as L, ListUsers200 as Lt, CreateFlowBody as M, ListSchemasParams as Mt, CreateFlowBodyPurpose as N, ListUserPasskeys200 as Nt, CreateFlow201StepChallenge as O, ListBrandingParams as Ot, CreateFlowDefinition201 as P, ListUserPasskeysParams as Pt, DeleteUserByIDParams as Q, SubmitFlowStep200 as Qt, CreateProjectBody as R, ListUsersParams as Rt, CreateBrandingParams as S, GetUserByID200 as St, CreateFlow201BrandingLayout as T, IssueChallenge201 as Tt, CreateSessionBody as U, QuerySessions200 as Ut, CreateSchemaParams as V, QueryProjects200 as Vt, CreateTeam201 as W, QuerySessionsBody as Wt, DeleteFlowDefinitionParams as X, SetUserPasswordBody as Xt, CreateUserParams as Y, RevokeSessionParams as Yt, DeleteTeamParams as Z, SetUserPasswordParams as Zt, CompleteClaimBody as _, IconName as _n, GetSchemaByIdParams as _t, ZlPill as a, UpdateTeamParams as an, GetClaimStatus200 as at, CreateBranding201 as b, GetTeam200 as bt, ZlPasskeyErrorDetail as c, ZlCheckbox as cn, GetFlowDefinitionParams as ct, ZlPageShell as d, ZlCard as dn, GetLiveDefault as dt, UpdateFlowDefinition200 as en, ExchangeHandoffBody as et, zlPageShellManifest as f, zlCardManifest as fn, GetMySession200 as ft, CompleteClaim200 as g, zlAlertManifest as gn, GetSchemaById200 as gt, zlFieldManifest as h, ZlAlert as hn, GetReadyDefault as ht, zlSelectManifest as i, UpdateTeamBody as in, GetBrandingByIdParams as it, CreateFlow201StepSsoProvidersItem as j, ListSchemas200Item as jt, CreateFlow201StepFieldsItem as k, ListFlowDefinitions200 as kt, ZlPasskeyResultDetail as l, ZlCheckboxChangeDetail as ln, GetFlowStep200 as lt, ZlFieldType as m, zlButtonManifest as mn, GetProject200 as mt, ZlSelectChangeDetail as n, UpdateFlowDefinitionParams as nn, GetAuthAttempt200 as nt, zlPillManifest as o, VerifyChallengeProof200 as on, GetClaimStatusParams as ot, ZlField as p, ZlButton as pn, GetMyUser200 as pt, CreateUser201 as q, QueryTeamsBody as qt, ZlSelectOption as r, UpdateTeam200 as rn, GetBrandingById200 as rt, ZlPasskey as s, VerifyChallengeProofBody as sn, GetFlowDefinition200 as st, ZlSelect as t, UpdateFlowDefinitionBody as tn, ExchangeHandoffParams as tt, zlPasskeyManifest as u, zlCheckboxManifest as un, GetHealthDefault as ut, CreateAuthAttempt201 as v, ZlIcon as vn, GetSession200 as vt, CreateFlow201Branding as w, InitClaim201 as wt, CreateBrandingBody as x, GetTeamParams as xt, CreateAuthAttemptBody as y, zlIconManifest as yn, GetSessionParams as yt, CreateSchema201 as z, PatchProject200 as zt };
-//# sourceMappingURL=index-DIGjtG4z.d.mts.map
+export { GetAuthAttempt200 as $, VerifyChallengeProof200 as $t, CreateFlow201StepGates as A, ListUserPasskeys200 as At, CreateSchemaBody as B, QuerySessions200 as Bt, CreateFlow201 as C, ListBrandingParams as Ct, CreateFlow201StepActionsItem as D, ListFlowDefinitionsParams as Dt, CreateFlow201Step as E, ListFlowDefinitions200 as Et, CreateFlowDefinitionBody as F, ListUsersParams as Ft, CreateTeamBody as G, QueryTeamsParams as Gt, CreateSession201 as H, QuerySessionsParams as Ht, CreateHandoff200 as I, PatchProject200 as It, CreateUserBody as J, SubmitFlowStepBody as Jt, CreateTeamParams as K, SetUserPasswordBody as Kt, CreateProject201 as L, PatchProjectBody as Lt, CreateFlowBody as M, ListUserTeams200 as Mt, CreateFlowBodyPurpose as N, ListUserTeamsParams as Nt, CreateFlow201StepChallenge as O, ListSchemas200Item as Ot, CreateFlowDefinition201 as P, ListUsers200 as Pt, ExchangeHandoffParams as Q, UpdateTeamBody as Qt, CreateProjectBody as R, QueryProjects200 as Rt, CreateBrandingParams as S, ListBranding200Item as St, CreateFlow201BrandingLayout as T, ListEventsParams as Tt, CreateSessionBody as U, QueryTeams200 as Ut, CreateSchemaParams as V, QuerySessionsBody as Vt, CreateTeam201 as W, QueryTeamsBody as Wt, ExchangeHandoff200 as X, UpdateFlowDefinitionBody as Xt, CreateUserParams as Y, UpdateFlowDefinition200 as Yt, ExchangeHandoffBody as Z, UpdateTeam200 as Zt, CompleteClaimBody as _, GetUserByID200 as _t, ZlPill as a, zlCardManifest as an, GetFlowDefinition200 as at, CreateBranding201 as b, IssueChallenge201 as bt, ZlPasskeyErrorDetail as c, ZlAlert as cn, GetLiveDefault as ct, ZlPageShell as d, ZlIcon as dn, GetProject200 as dt, VerifyChallengeProofBody as en, GetBrandingById200 as et, zlPageShellManifest as f, zlIconManifest as fn, GetReadyDefault as ft, CompleteClaim200 as g, GetTeam200 as gt, zlFieldManifest as h, GetSession200 as ht, zlSelectManifest as i, ZlCard as in, GetEventParams as it, CreateFlow201StepSsoProvidersItem as j, ListUserPasskeysParams as jt, CreateFlow201StepFieldsItem as k, ListSchemasParams as kt, ZlPasskeyResultDetail as l, zlAlertManifest as ln, GetMySession200 as lt, ZlFieldType as m, GetSchemaByIdParams as mt, ZlSelectChangeDetail as n, ZlCheckboxChangeDetail as nn, GetClaimStatusParams as nt, zlPillManifest as o, ZlButton as on, GetFlowStep200 as ot, ZlField as p, GetSchemaById200 as pt, CreateUser201 as q, SubmitFlowStep200 as qt, ZlSelectOption as r, zlCheckboxManifest as rn, GetEvent200 as rt, ZlPasskey as s, zlButtonManifest as sn, GetHealthDefault as st, ZlSelect as t, ZlCheckbox as tn, GetClaimStatus200 as tt, zlPasskeyManifest as u, IconName as un, GetMyUser200 as ut, CreateAuthAttempt201 as v, GetUserByIDParams as vt, CreateFlow201Branding as w, ListEvents200 as wt, CreateBrandingBody as x, IssueChallengeBody as xt, CreateAuthAttemptBody as y, InitClaim201 as yt, CreateSchema201 as z, QueryProjectsBody as zt };
+//# sourceMappingURL=index-CAi5gsHK.d.mts.map