@zitadel/components 0.1.0-alpha.18 → 0.1.0-alpha.19

package/dist/{orchestrator-CctLkpmB.mjs → orchestrator-CsHP57zo.mjs}

@@ -1,10 +1,11 @@
-import { C as focusVisibleStyles, E as emit, S as __decorate, T as t, d as hookName, w as baseHostStyles } from "./atoms-5-wYIl88.mjs";
-import { r as tokensCss } from "./tokens-BV-PPbQd.mjs";
+import { C as focusVisibleStyles, E as emit, S as __decorate, T as t, d as hookName, w as baseHostStyles } from "./atoms-B6QmUAzo.mjs";
+import { r as tokensCss } from "./tokens-DSnSf1mf.mjs";
 import { manifestRegistry } from "./manifests.mjs";
 import { t as default_default } from "./default-Bnjy2dJB.mjs";
 import { LitElement, css, html, nothing } from "lit";
 import { customElement, property, state } from "lit/decorators.js";
 import { unsafeHTML } from "lit/directives/unsafe-html.js";
+import { isCanonicalLoopbackHttpUrl } from "@zitadel/config/branding-url";
 import { MANDATORY_GATES_TAG } from "@zitadel/config/template";
 import { Liquid } from "liquidjs";
 import DOMPurify from "dompurify";
@@ -130,6 +131,30 @@ function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
+//#region ../shared-component-styles/dist/attribution-markup.mjs
+/**
+* Figma sign-in attribution chip (`6593:141767`): "Secured with" + 65×16 logotype.
+* Shared by Lit orchestrator HTML, dev playground, and paired React playgrounds.
+*/
+const ZITADEL_ATTRIBUTION_LOGOTYPE_SVG = "<svg class=\"zr-pill__logotype-svg\" xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 67.3501 15.1111\" width=\"65\" height=\"16\" fill=\"currentColor\" aria-hidden=\"true\" focusable=\"false\"><path d=\"M2.04839 4.265C2.06224 4.1284 2.1748 3.98591 2.32756 3.91161L8.98593 0.0494262C9.227 -0.0678242 9.45274 0.0334116 9.43089 0.248972V4.52681C9.41705 4.66341 9.30448 4.80589 9.15172 4.88019L2.49335 8.66426C2.25228 8.78151 2.02654 8.68027 2.04839 8.46471V4.265Z\"/><path d=\"M14.0086 5.25359C14.12 5.33388 14.1871 5.50261 14.1751 5.67205V13.2643C14.1561 13.5317 13.9555 13.6766 13.7798 13.5499L10.1005 11.4468C9.98908 11.3666 9.92196 11.1978 9.934 11.0284V3.32695C9.95299 3.05956 10.1535 2.91467 10.3293 3.04138L14.0086 5.25359Z\"/><path d=\"M7.37428 15.0817C7.24906 15.138 7.06938 15.1118 6.92865 15.0167L0.183465 11.1405C-0.038611 10.9903 -0.0638098 10.7442 0.133796 10.6554L3.76278 8.53833C3.888 8.48203 4.06767 8.50827 4.2084 8.60341L10.9046 12.5341C11.1267 12.6843 11.1557 12.9125 10.9543 13.0193L7.37428 15.0817Z\"/><path d=\"M65.6687 13.1043V2.00077H67.3501V13.1043H65.6687Z\"/><path d=\"M60.4255 13.2947C59.6535 13.2947 58.9715 13.1202 58.3793 12.7712C57.7871 12.4222 57.3218 11.9358 56.9834 11.3119C56.6556 10.688 56.4917 9.97418 56.4917 9.1705C56.4917 8.33509 56.6556 7.61073 56.9834 6.99739C57.3112 6.38405 57.7712 5.90819 58.3634 5.56979C58.9662 5.22083 59.6588 5.04634 60.4414 5.04634C61.2027 5.04634 61.869 5.21554 62.44 5.55393C63.011 5.88175 63.4552 6.33118 63.7724 6.90222C64.1002 7.47326 64.2642 8.12359 64.2642 8.85325C64.2642 9.0013 64.2589 9.1282 64.2483 9.23395C64.2483 9.33969 64.2377 9.46659 64.2166 9.61464H58.1731C58.2048 10.0588 58.3158 10.4553 58.5062 10.8043C58.6965 11.1427 58.9556 11.4124 59.2834 11.6133C59.6112 11.8036 59.9866 11.8988 60.4096 11.8988C60.8644 11.8988 61.2503 11.7983 61.5676 11.5974C61.8954 11.3859 62.1386 11.0898 62.2972 10.7091H64.0421C63.9046 11.185 63.672 11.6186 63.3441 12.0098C63.0269 12.4011 62.6251 12.7131 62.1386 12.9457C61.6522 13.1784 61.0811 13.2947 60.4255 13.2947ZM58.1889 8.42497H62.551C62.5299 7.81163 62.3131 7.3305 61.9007 6.98153C61.4883 6.62199 60.986 6.44222 60.3938 6.44222C59.865 6.44222 59.3839 6.60613 58.9503 6.93394C58.5168 7.26176 58.263 7.75876 58.1889 8.42497Z\"/><path d=\"M50.5389 13.2947C49.7563 13.2947 49.0796 13.1096 48.5085 12.7395C47.9481 12.3588 47.5145 11.8565 47.2078 11.2326C46.9117 10.6087 46.7637 9.91073 46.7637 9.13877C46.7637 8.37739 46.9117 7.69004 47.2078 7.0767C47.5145 6.45279 47.9481 5.96106 48.5085 5.60152C49.0796 5.2314 49.7563 5.04634 50.5389 5.04634C51.1205 5.04634 51.6492 5.16795 52.1251 5.41117C52.601 5.64382 52.9869 5.97692 53.283 6.41049V2.00077H54.9803V13.1043H53.3465L53.283 11.8829C53.0292 12.2954 52.6644 12.6337 52.1886 12.8981C51.7127 13.1625 51.1628 13.2947 50.5389 13.2947ZM50.872 11.8195C51.369 11.8195 51.7973 11.7032 52.1568 11.4705C52.5164 11.2379 52.7913 10.9206 52.9817 10.5188C53.172 10.1169 53.2672 9.66751 53.2672 9.1705C53.2672 8.59946 53.1561 8.1183 52.9341 7.72704C52.7226 7.33577 52.4318 7.0344 52.0617 6.82291C51.7021 6.61141 51.3003 6.50567 50.8561 6.50567C50.4014 6.50567 49.9943 6.6167 49.6347 6.83877C49.2752 7.06084 48.9897 7.36749 48.7782 7.75876C48.5773 8.15003 48.4768 8.61532 48.4768 9.15463C48.4768 9.68337 48.5825 10.1487 48.794 10.5505C49.0055 10.9524 49.2911 11.2643 49.6506 11.4864C50.0101 11.7085 50.4173 11.8195 50.872 11.8195Z\"/><path d=\"M40.7882 13.2947C40.2806 13.2947 39.8153 13.2048 39.3923 13.025C38.9693 12.8347 38.6309 12.5597 38.3771 12.2002C38.1233 11.8406 37.9965 11.4071 37.9965 10.8995C37.9965 10.2967 38.1445 9.81556 38.4406 9.45602C38.7473 9.0859 39.1544 8.81624 39.662 8.64704C40.1801 8.46727 40.7459 8.37739 41.3592 8.37739H43.3579C43.3579 7.92267 43.2839 7.55786 43.1358 7.28291C42.9878 6.99739 42.7868 6.79118 42.533 6.66429C42.2792 6.52681 41.9832 6.45808 41.6448 6.45808C41.2006 6.45808 40.8094 6.56383 40.471 6.77532C40.1431 6.97624 39.9369 7.29876 39.8523 7.7429H38.1551C38.2079 7.17186 38.3983 6.68544 38.7261 6.28359C39.0645 5.88175 39.4928 5.57508 40.011 5.36358C40.5291 5.15209 41.079 5.04634 41.6606 5.04634C42.422 5.04634 43.0512 5.1891 43.5482 5.47462C44.0558 5.74957 44.4312 6.13555 44.6744 6.63256C44.9282 7.12958 45.0551 7.69531 45.0551 8.3298V10.7409C45.0657 11.0475 45.1292 11.2749 45.2455 11.4229C45.3724 11.5604 45.5945 11.6397 45.9117 11.6609V13.1043C45.4887 13.1043 45.1186 13.0567 44.8013 12.9616C44.4947 12.8664 44.2409 12.7236 44.04 12.5333C43.839 12.3324 43.6804 12.0786 43.5641 11.7719C43.3103 12.1949 42.9402 12.5544 42.4537 12.8505C41.9673 13.1466 41.4121 13.2947 40.7882 13.2947ZM41.1848 11.9147C41.6183 11.9147 41.999 11.8089 42.3268 11.5974C42.6547 11.3753 42.9084 11.0898 43.0882 10.7409C43.268 10.3813 43.3579 9.99533 43.3579 9.58291V9.55119H41.4861C41.1795 9.55119 40.8887 9.5882 40.6137 9.66223C40.3493 9.73625 40.1326 9.86315 39.9634 10.0429C39.8047 10.2121 39.7254 10.45 39.7254 10.7567C39.7254 11.1586 39.8682 11.4547 40.1537 11.645C40.4392 11.8248 40.7829 11.9147 41.1848 11.9147Z\"/><path d=\"M35.5197 13.1043C34.7372 13.1043 34.1344 12.914 33.7114 12.5333C33.2884 12.1526 33.0769 11.5287 33.0769 10.6615V6.64842H31.8873V5.23669H33.0769V3.3332H34.7583V5.23669H36.757V6.64842H34.7583V10.6615C34.7583 11.0634 34.8482 11.333 35.028 11.4705C35.2078 11.608 35.488 11.6767 35.8687 11.6767H36.757V13.1043H35.5197Z\"/><path d=\"M29.6602 3.85668C29.3536 3.85668 29.0892 3.7509 28.8671 3.53941C28.6556 3.31734 28.5499 3.04768 28.5499 2.73043C28.5499 2.42376 28.6556 2.16468 28.8671 1.95319C29.0892 1.74169 29.3536 1.63594 29.6602 1.63594C29.9775 1.63594 30.2419 1.74169 30.4533 1.95319C30.6754 2.16468 30.7865 2.42376 30.7865 2.73043C30.7865 3.04768 30.6754 3.31734 30.4533 3.53941C30.2419 3.7509 29.9775 3.85668 29.6602 3.85668ZM28.8195 13.1043V5.23669H30.5009V13.1043H28.8195Z\"/><path d=\"M19.8276 13.1043V11.8036L25.1098 3.42837H19.8911V2.00077H27.0608V3.30147L21.7628 11.6609H27.1084V13.1043H19.8276Z\"/></svg>";
+/** Inner markup for the default Zitadel attribution pill (label + logotype). */
+function zitadelAttributionPillInnerHtml() {
+	return `Secured with <span class="zr-pill__logotype">${ZITADEL_ATTRIBUTION_LOGOTYPE_SVG}</span>`;
+}
+//#endregion
+//#region src/internal/escape-html.ts
+/**
+* Escapes the five HTML-significant characters so a string is safe to
+* interpolate into either element text or a double-quoted attribute value.
+*
+* Used for the orchestrator-owned attribution markup, which is appended after
+* the Liquid output has already been sanitised — so it can't rely on the
+* DOMPurify pass and must escape its own (tenant-supplied) values.
+*/
+function escapeHtml(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+//#endregion
 //#region src/orchestrator/api-client.ts
 const apiRequestInit = { credentials: "include" };
 async function startFlow(api, input) {
@@ -175,2283 +200,2342 @@ async function revokeSession$1(api) {
 	await api.revokeMySession(apiRequestInit);
 }
 //#endregion
-//#region ../api/dist/runtime/base-url.mjs
-let proxyPath = "";
-function getProxyPath() {
-	return proxyPath;
-}
-function setProxyPath(path) {
-	proxyPath = path;
-}
-//#endregion
-//#region ../api/dist/chunk-CfYAbeIz.mjs
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-//#endregion
-//#region ../api/dist/generated/endpoints/zitadelNextGen.mjs
-/**
-* Generated by orval v8.10.0 🍺
-* Do not edit manually.
-* Zitadel NextGen
-* This is the next generation of the Zitadel identity platform.
-* OpenAPI spec version: 0.0.1
-*/
-var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
-	completeClaim: () => completeClaim,
-	createAuthAttempt: () => createAuthAttempt,
-	createBranding: () => createBranding,
-	createFlow: () => createFlow,
-	createFlowDefinition: () => createFlowDefinition,
-	createHandoff: () => createHandoff,
-	createProject: () => createProject,
-	createSchema: () => createSchema,
-	createSession: () => createSession,
-	createTeam: () => createTeam,
-	createUser: () => createUser,
-	deleteFlowDefinition: () => deleteFlowDefinition,
-	deleteTeam: () => deleteTeam,
-	deleteUserByID: () => deleteUserByID,
-	exchangeHandoff: () => exchangeHandoff,
-	getAuthAttempt: () => getAuthAttempt,
-	getBrandingById: () => getBrandingById,
-	getClaimStatus: () => getClaimStatus,
-	getCompleteClaimUrl: () => getCompleteClaimUrl,
-	getCreateAuthAttemptUrl: () => getCreateAuthAttemptUrl,
-	getCreateBrandingUrl: () => getCreateBrandingUrl,
-	getCreateFlowDefinitionUrl: () => getCreateFlowDefinitionUrl,
-	getCreateFlowUrl: () => getCreateFlowUrl,
-	getCreateHandoffUrl: () => getCreateHandoffUrl,
-	getCreateProjectUrl: () => getCreateProjectUrl,
-	getCreateSchemaUrl: () => getCreateSchemaUrl,
-	getCreateSessionUrl: () => getCreateSessionUrl,
-	getCreateTeamUrl: () => getCreateTeamUrl,
-	getCreateUserUrl: () => getCreateUserUrl,
-	getDeleteFlowDefinitionUrl: () => getDeleteFlowDefinitionUrl,
-	getDeleteTeamUrl: () => getDeleteTeamUrl,
-	getDeleteUserByIDUrl: () => getDeleteUserByIDUrl,
-	getExchangeHandoffUrl: () => getExchangeHandoffUrl,
-	getFlowDefinition: () => getFlowDefinition,
-	getFlowStep: () => getFlowStep,
-	getGetAuthAttemptUrl: () => getGetAuthAttemptUrl,
-	getGetBrandingByIdUrl: () => getGetBrandingByIdUrl,
-	getGetClaimStatusUrl: () => getGetClaimStatusUrl,
-	getGetFlowDefinitionUrl: () => getGetFlowDefinitionUrl,
-	getGetFlowStepUrl: () => getGetFlowStepUrl,
-	getGetHealthUrl: () => getGetHealthUrl,
-	getGetLiveUrl: () => getGetLiveUrl,
-	getGetMySessionUrl: () => getGetMySessionUrl,
-	getGetMyUserUrl: () => getGetMyUserUrl,
-	getGetProjectUrl: () => getGetProjectUrl,
-	getGetReadyUrl: () => getGetReadyUrl,
-	getGetSchemaByIdUrl: () => getGetSchemaByIdUrl,
-	getGetSessionUrl: () => getGetSessionUrl,
-	getGetTeamUrl: () => getGetTeamUrl,
-	getGetUserByIDUrl: () => getGetUserByIDUrl,
-	getHealth: () => getHealth,
-	getInitClaimUrl: () => getInitClaimUrl,
-	getIssueChallengeUrl: () => getIssueChallengeUrl,
-	getListBrandingUrl: () => getListBrandingUrl,
-	getListFlowDefinitionsUrl: () => getListFlowDefinitionsUrl,
-	getListSchemasUrl: () => getListSchemasUrl,
-	getListUserPasskeysUrl: () => getListUserPasskeysUrl,
-	getListUserTeamsUrl: () => getListUserTeamsUrl,
-	getListUsersUrl: () => getListUsersUrl,
-	getLive: () => getLive,
-	getMySession: () => getMySession,
-	getMyUser: () => getMyUser,
-	getPatchProjectUrl: () => getPatchProjectUrl,
-	getProject: () => getProject,
-	getQueryProjectsUrl: () => getQueryProjectsUrl,
-	getQuerySessionsUrl: () => getQuerySessionsUrl,
-	getQueryTeamsUrl: () => getQueryTeamsUrl,
-	getReady: () => getReady,
-	getRevokeMySessionUrl: () => getRevokeMySessionUrl,
-	getRevokeSessionUrl: () => getRevokeSessionUrl,
-	getSchemaById: () => getSchemaById,
-	getSession: () => getSession,
-	getSetUserPasswordUrl: () => getSetUserPasswordUrl,
-	getSubmitFlowStepUrl: () => getSubmitFlowStepUrl,
-	getTeam: () => getTeam,
-	getUpdateFlowDefinitionUrl: () => getUpdateFlowDefinitionUrl,
-	getUpdateTeamUrl: () => getUpdateTeamUrl,
-	getUserByID: () => getUserByID,
-	getVerifyChallengeProofUrl: () => getVerifyChallengeProofUrl,
-	initClaim: () => initClaim,
-	issueChallenge: () => issueChallenge,
-	listBranding: () => listBranding,
-	listFlowDefinitions: () => listFlowDefinitions,
-	listSchemas: () => listSchemas,
-	listUserPasskeys: () => listUserPasskeys,
-	listUserTeams: () => listUserTeams,
-	listUsers: () => listUsers,
-	patchProject: () => patchProject,
-	queryProjects: () => queryProjects,
-	querySessions: () => querySessions,
-	queryTeams: () => queryTeams,
-	revokeMySession: () => revokeMySession,
-	revokeSession: () => revokeSession,
-	setUserPassword: () => setUserPassword,
-	submitFlowStep: () => submitFlowStep,
-	updateFlowDefinition: () => updateFlowDefinition,
-	updateTeam: () => updateTeam,
-	verifyChallengeProof: () => verifyChallengeProof
-});
-const getGetHealthUrl = () => {
-	return `${getProxyPath()}/healthz`;
-};
+//#region src/orchestrator/asset-fallback.ts
 /**
-* Check whether the server is healthy
-* @summary Check server health
+* Broken-branding-asset degradation.
+*
+* A `logo_url` / `hero_url` that is well-formed but unreachable clears every
+* gate on the way in — the CLI's zod shape check, the server's save gate —
+* and then renders as a 0×0 `<img>`: a silent hole where the brand should
+* be, with nothing in the console and nothing in `plan` output. The split
+* designs are the worst case, because their `.zl-split__placeholder` is
+* keyed on *no asset being configured*, so a configured-but-dead asset
+* leaves the whole brand pane blank.
+*
+* The templates cannot fix this themselves. They go through DOMPurify
+* (`sanitiser.ts`), which strips `onerror` along with every other inline
+* handler, so the recovery has to be orchestrator-side: arm a real `error`
+* listener on each rendered image after every commit, hide what fails, and
+* put the placeholder back when that empties a brand pane.
 */
-const getHealth = async (options) => {
-	return customFetch(getGetHealthUrl(), {
-		...options,
-		method: "GET"
-	});
-};
-const getGetLiveUrl = () => {
-	return `${getProxyPath()}/livez`;
-};
+/** Marks an image whose `error` listener is already attached. */
+const ARMED_ATTR = "data-zl-asset-armed";
+/** Marks an image that failed to load; `layout-chrome.css` hides it. */
+const BROKEN_ATTR = "data-zl-asset-broken";
+const BRAND_PANE_SELECTOR = ".zl-split__brand";
+const PLACEHOLDER_CLASS = "zl-split__placeholder";
+const AUTHORED_FALLBACK_ATTR = "data-zl-asset-fallback";
+const AUTHORED_FALLBACK_CONTENT_ATTR = "data-zl-asset-fallback-content";
 /**
-* Check whether the server is started
-* @summary Check server liveness
+* Arm every not-yet-armed `<img>` under `root`, and repair anything already
+* broken. Idempotent: safe to call on every Lit commit, since `unsafeHTML`
+* only re-parses when the rendered string actually changes and re-parsed
+* nodes arrive without the marker attribute.
 */
-const getLive = async (options) => {
-	return customFetch(getGetLiveUrl(), {
-		...options,
-		method: "GET"
-	});
-};
-const getGetReadyUrl = () => {
-	return `${getProxyPath()}/readyz`;
-};
+function armAssetFallbacks(root) {
+	let repairNeeded = false;
+	for (const img of root.querySelectorAll("img")) {
+		if (img.hasAttribute(ARMED_ATTR)) continue;
+		img.setAttribute(ARMED_ATTR, "");
+		if (img.getAttribute("src") && img.complete && img.naturalWidth === 0) {
+			markBroken(img);
+			repairNeeded = true;
+			continue;
+		}
+		img.addEventListener("error", () => {
+			markBroken(img);
+			repairBrandPanes(root);
+		}, { once: true });
+	}
+	if (repairNeeded) repairBrandPanes(root);
+}
+function markBroken(img) {
+	img.setAttribute(BROKEN_ATTR, "");
+	revealAuthoredFallback(img);
+	console.warn(`[zitadel-login] branding asset failed to load, hiding it: ${img.getAttribute("src") ?? ""}`);
+}
 /**
-* Check whether the server is ready to accept requests
-* @summary Check server readiness
+* Some shipped templates have a richer no-asset branch than the generic split
+* placeholder (the hero design's brand mark and compact text). They render that
+* branch hidden beside the image and opt in with data attributes, so the
+* orchestrator can reveal the exact authored fallback without knowing template
+* copy or structure.
 */
-const getReady = async (options) => {
-	return customFetch(getGetReadyUrl(), {
-		...options,
-		method: "GET"
-	});
-};
-const getCreateUserUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/users?${stringifiedParams}` : `${getProxyPath()}/users`;
-};
+function revealAuthoredFallback(img) {
+	if (!img.hasAttribute(AUTHORED_FALLBACK_ATTR)) return;
+	const fallback = img.nextElementSibling;
+	if (fallback?.hasAttribute(AUTHORED_FALLBACK_CONTENT_ATTR)) fallback.removeAttribute("hidden");
+}
 /**
-* @summary Create user
+* Restore `.zl-split__placeholder` in any split brand pane whose only content
+* was assets that all failed. Deliberately narrow: a pane is only repaired
+* when it actually holds a broken image, so a pane an author left empty on
+* purpose — or a hero design whose landing copy still renders — is never
+* given decoration it did not ask for.
 */
-const createUser = async (createUserBody, params, options) => {
-	return customFetch(getCreateUserUrl(params), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(createUserBody)
-	});
-};
-const getListUsersUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/users?${stringifiedParams}` : `${getProxyPath()}/users`;
+function repairBrandPanes(root) {
+	for (const pane of root.querySelectorAll(BRAND_PANE_SELECTOR)) {
+		if (pane.querySelector(`.${PLACEHOLDER_CLASS}`)) continue;
+		const children = Array.from(pane.children);
+		if (!children.some(isBrokenImage)) continue;
+		if (children.some((child) => !isBrokenImage(child))) continue;
+		const placeholder = pane.ownerDocument.createElement("div");
+		placeholder.className = PLACEHOLDER_CLASS;
+		placeholder.setAttribute("aria-hidden", "true");
+		pane.append(placeholder);
+	}
+}
+function isBrokenImage(node) {
+	return node.tagName === "IMG" && node.hasAttribute(BROKEN_ATTR);
+}
+//#endregion
+//#region ../api/dist/generated/model/index.mjs
+const CreateFlow201BrandingLayout = {
+	centered: "centered",
+	split: "split"
 };
+//#endregion
+//#region src/orchestrator/branding-validator.ts
 /**
-* @summary List users
+* Lightweight paint-time validator for `Branding` payloads.
+*
+* Per `docs/design/branding/schema.md` §Shape invariants:
+*
+* 1. Every referenced URL is https, except logo/hero assets may use canonical
+*    loopback HTTP while the component itself renders on a loopback HTTP
+*    origin.
+* 2. `layout` is in the documented enum.
+* 3. `liquid_template` shape checks happen elsewhere (security pipeline runs
+*    server-side; structural validator is deferred until the full atom set
+*    lands).
+*
+* Failures are non-fatal: we collect issues, log a dev-build warning, and
+* return a sanitised payload with the offending fields stripped (set to
+* `undefined`) so the orchestrator falls back to the bundled defaults.
 */
-const listUsers = async (params, options) => {
-	return customFetch(getListUsersUrl(params), {
-		...options,
-		method: "GET"
-	});
-};
-const getGetUserByIDUrl = (userId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}?${stringifiedParams}` : `${getProxyPath()}/users/${userId}`;
-};
+const VALID_LAYOUTS = new Set(Object.values(CreateFlow201BrandingLayout));
+function validateBranding(input, context = {}) {
+	if (!input) return {
+		branding: void 0,
+		issues: []
+	};
+	const issues = [];
+	const out = { ...input };
+	const allowLoopbackHttp = context.renderingOrigin !== void 0 && isCanonicalLoopbackHttpUrl(context.renderingOrigin);
+	if (out.layout && !VALID_LAYOUTS.has(out.layout)) {
+		issues.push(`Unknown layout "${out.layout}" — falling back to "centered".`);
+		out.layout = CreateFlow201BrandingLayout.centered;
+	}
+	out.logo_url = sanitiseUrl(out.logo_url, "logo_url", issues, { allowed: allowLoopbackHttp });
+	out.font_url = sanitiseUrl(out.font_url, "font_url", issues);
+	out.hero_url = sanitiseUrl(out.hero_url, "hero_url", issues, { allowed: allowLoopbackHttp });
+	if (out.assets) out.assets = {
+		logo_dark: sanitiseUrl(out.assets.logo_dark, "assets.logo_dark", issues),
+		favicon: sanitiseUrl(out.assets.favicon, "assets.favicon", issues),
+		background_image: sanitiseUrl(out.assets.background_image, "assets.background_image", issues)
+	};
+	return {
+		branding: out,
+		issues
+	};
+}
+function sanitiseUrl(value, field, issues, loopbackHttp) {
+	if (value == null || value === "") return;
+	try {
+		const parsed = new URL(value);
+		if (parsed.protocol === "http:" && loopbackHttp?.allowed && isCanonicalLoopbackHttpUrl(value)) return parsed.toString();
+		if (parsed.protocol !== "https:") {
+			const loopbackHint = loopbackHttp ? "; canonical loopback http is allowed only on loopback development pages" : "";
+			issues.push(`${field} must use https (got "${parsed.protocol}"${loopbackHint}) — dropped.`);
+			return;
+		}
+		return parsed.toString();
+	} catch {
+		issues.push(`${field} is not a valid URL — dropped.`);
+		return;
+	}
+}
+//#endregion
+//#region src/orchestrator/exportparts.ts
 /**
-* @summary Get user by ID
+* Forwards atom-internal CSS Shadow Parts through the orchestrator boundary.
+*
+* Atoms stamp `part="..."` on their internals and declare the public set in
+* their manifest (`parts`). Those parts are visible one shadow boundary up —
+* inside the orchestrator's shadow root — but not to the embedding page,
+* because `::part()` pierces a single boundary unless each host in the chain
+* re-exports (`exportparts`). Templates never author the forwarding (the
+* sanitiser strips `exportparts`); the orchestrator stamps it after every
+* render commit so the mapping stays canonical for template-rendered and
+* gate-patched atoms alike.
+*
+* Exported names are mechanical, collision-free, and public contract
+* (override-ladder Tier 2, same stability rules as token names):
+* `<atom>-<part>` with the `zl-` prefix dropped — `zl-field`'s `input` part
+* becomes `zitadel-login::part(field-input)` on the host page. Manifests are
+* the canonical part catalogue; this module derives, never curates.
 */
-const getUserByID = async (userId, params, options) => {
-	return customFetch(getGetUserByIDUrl(userId, params), {
-		...options,
-		method: "GET"
-	});
-};
-const getDeleteUserByIDUrl = (userId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}?${stringifiedParams}` : `${getProxyPath()}/users/${userId}`;
-};
+const exportpartsByTag = new Map(manifestRegistry.filter((manifest) => manifest.parts.length > 0).map((manifest) => {
+	const short = manifest.tag.replace(/^zl-/, "");
+	const value = manifest.parts.map((part) => `${part}: ${short}-${part}`).join(", ");
+	return [manifest.tag, value];
+}));
 /**
-* @summary Delete user by ID
+* Stamps `exportparts` onto every known atom in `scope`. Idempotent — call
+* after each render commit: `unsafeHTML` re-parses replace previously
+* stamped nodes, and the mandatory-gates patcher appends atoms after
+* sanitisation.
 */
-const deleteUserByID = async (userId, params, options) => {
-	return customFetch(getDeleteUserByIDUrl(userId, params), {
-		...options,
-		method: "DELETE"
-	});
-};
-const getListUserPasskeysUrl = (userId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/passkeys?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/passkeys`;
-};
+function stampExportparts(scope) {
+	for (const [tag, value] of exportpartsByTag) for (const el of scope.querySelectorAll(tag)) if (el.getAttribute("exportparts") !== value) el.setAttribute("exportparts", value);
+}
+//#endregion
+//#region src/orchestrator/mandatory-gates.ts
+const MANDATORY_GATES_MARKER = "ZL_MANDATORY_GATES";
+/** Every atom tag that participates as a named form field. */
+const FIELD_ATOM_TAGS = "zl-field, zl-select, zl-checkbox";
+const mandatoryGatesMarkerComment = `<!--${MANDATORY_GATES_MARKER}-->`;
+function patchMandatoryGates(html, step, locale) {
+	const template = document.createElement("template");
+	template.innerHTML = html;
+	const fragment = template.content;
+	const additions = collectMissingAtoms(fragment, step, locale);
+	const marker = findMarkerComment(fragment);
+	if (marker?.parentNode) {
+		for (const node of additions) marker.parentNode.insertBefore(node, marker);
+		marker.remove();
+	} else for (const node of additions) fragment.appendChild(node);
+	return template.innerHTML;
+}
+function collectMissingAtoms(fragment, step, locale) {
+	const additions = [];
+	if (step.fields) for (const field of step.fields) {
+		if (!field.required) continue;
+		if (hasFieldFor(fragment, field.name)) continue;
+		additions.push(buildField(field.name, field.text_key, field.type, locale, field.required));
+	}
+	if (step.actions && !hasPrimaryButton(fragment)) {
+		const primary = step.actions.find((action) => action.primary);
+		if (primary) additions.push(buildSubmit(primary.name, primary.text_key, locale));
+	}
+	return additions;
+}
+function hasPrimaryButton(fragment) {
+	return Boolean(fragment.querySelector("zl-button[hierarchy=\"primary\"]"));
+}
+function hasFieldFor(fragment, name) {
+	for (const field of fragment.querySelectorAll(FIELD_ATOM_TAGS)) if (field.getAttribute("name") === name) return true;
+	return false;
+}
+function findMarkerComment(fragment) {
+	const walker = (fragment.ownerDocument ?? document).createTreeWalker(fragment, NodeFilter.SHOW_COMMENT);
+	let node = walker.nextNode();
+	while (node) {
+		if (node.nodeValue?.trim() === "ZL_MANDATORY_GATES") return node;
+		node = walker.nextNode();
+	}
+	return null;
+}
+function buildField(name, textKey, type, locale, required) {
+	const el = document.createElement("zl-field");
+	el.setAttribute("name", name);
+	el.setAttribute("label", lookup(locale, textKey ?? name));
+	el.setAttribute("type", type);
+	if (required) el.setAttribute("required", "");
+	return el;
+}
+function buildSubmit(name, textKey, locale) {
+	const el = document.createElement("zl-button");
+	el.setAttribute("hierarchy", "primary");
+	el.setAttribute("size", "medium");
+	el.setAttribute("type", "submit");
+	el.setAttribute("block", "");
+	el.setAttribute("action", name);
+	el.setAttribute("label", lookup(locale, textKey ?? "submit.continue"));
+	return el;
+}
+function lookup(locale, key) {
+	return locale[key] ?? key;
+}
+//#endregion
+//#region src/orchestrator/liquid.ts
 /**
-* @summary List user passkeys
+* LiquidJS engine factory for the `<zitadel-login>` orchestrator.
+*
+* Configures the engine per the security pipeline in
+* `docs/design/flowengine/template-security.md` and registers the
+* `| t` filter and `{% mandatory_gates %}` tag from
+* `docs/design/branding/templates.md`.
+*
+* Hard rules:
+*
+* - `{{ }}` output is HTML-escaped (LiquidJS default since v10).
+* - The `| raw` filter is overridden to a no-op string passthrough that still
+*   escapes (Layer 1 of the security pipeline).
+* - Partials are loaded from an in-memory map; no filesystem access.
 */
-const listUserPasskeys = async (userId, params, options) => {
-	return customFetch(getListUserPasskeysUrl(userId, params), {
-		...options,
-		method: "GET"
-	});
-};
-const getSetUserPasswordUrl = (userId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/password?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/password`;
-};
+const TEMPLATE_NAMES$1 = { default: "default" };
 /**
-* @summary Set user password
+* Maps catalog `error.*` keys with no `_<rule>` suffix (so
+* {@link localiseFlowErrorKeys} can't derive the field from the key itself)
+* to their field name — the credential errors with bespoke catalog copy
+* (`error.email_exists`, `error.invalid_credentials`, …). Rule-suffixed keys
+* (`error.<field>_<rule>`) derive their field from the key. Consumed only by
+* {@link localiseFlowErrorKeys}, which stamps the resolved `field` onto the
+* error; the template filters (`fieldError` / `formLevelError`) then route by
+* that `field`, and an error whose field the step omits is downgraded to a
+* fieldless banner message.
 */
-const setUserPassword = async (userId, setUserPasswordBody, params, options) => {
-	return customFetch(getSetUserPasswordUrl(userId, params), {
-		...options,
-		method: "PUT",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
+const fieldErrorKeys = {
+	"error.email_required": "email",
+	"error.email_invalid": "email",
+	"error.email_exists": "email",
+	"error.password_required": "password",
+	"error.password_incorrect": "password",
+	"error.invalid_credentials": "password"
+};
+function createLiquidEngine(options) {
+	const engine = new Liquid({
+		templates: {
+			[TEMPLATE_NAMES$1.default]: default_default,
+			...options.templates ?? {}
 		},
-		body: JSON.stringify(setUserPasswordBody)
+		cache: true,
+		jsTruthy: true,
+		relativeReference: false,
+		strictFilters: false,
+		strictVariables: false,
+		outputEscape: "escape"
 	});
-};
-const getListUserTeamsUrl = (userId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	engine.registerFilter("raw", (value) => stringify(value));
+	const warnedMissingKeys = /* @__PURE__ */ new Set();
+	engine.registerFilter("t", function tFilter(key, ...args) {
+		const lookupKey = stringify(key);
+		let template = options.locale[lookupKey] ?? injectedKeyFallback(options.locale, lookupKey) ?? fieldLabelFallback(lookupKey);
+		if (template === void 0) {
+			template = lookupKey;
+			if (lookupKey !== "" && !warnedMissingKeys.has(lookupKey)) {
+				warnedMissingKeys.add(lookupKey);
+				console.warn(`[zitadel-login] missing text key "${lookupKey}" — rendering the raw key`);
+			}
+		}
+		return interpolate(template, args.map(stringify));
 	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/teams?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/teams`;
-};
-/**
-* The user's team roster, ordered by team name. Each entry carries the
-team's name, so a client renders a page without resolving ids one by one.
-
-This is the N:N roster and it is not lifecycle ownership: the single team
-that owns the user's lifecycle is reported as `metadata.lifecycle_owner_team_id`
-on the user read endpoints. Memberships the user was removed from are not
-returned.
-
-* @summary List the teams a user belongs to
-*/
-const listUserTeams = async (userId, params, options) => {
-	return customFetch(getListUserTeamsUrl(userId, params), {
-		...options,
-		method: "GET"
+	/** Resolves `{text_key}.placeholder` — empty when undefined (not the raw key). */
+	engine.registerFilter("fieldPlaceholder", (textKey) => {
+		const lookupKey = `${stringify(textKey)}.placeholder`;
+		return options.locale[lookupKey] ?? "";
 	});
-};
-const getGetMyUserUrl = () => {
-	return `${getProxyPath()}/users/me`;
-};
-/**
-* @summary Get my user information
-*/
-const getMyUser = async (options) => {
-	return customFetch(getGetMyUserUrl(), {
-		...options,
-		method: "GET"
+	/** Resolves `{text_key}.help` — empty when undefined. */
+	engine.registerFilter("fieldHelp", (textKey) => {
+		const lookupKey = `${stringify(textKey)}.help`;
+		return options.locale[lookupKey] ?? "";
 	});
-};
-const getCreateFlowUrl = () => {
-	return `${getProxyPath()}/flow`;
-};
-/**
-* Resolves a flow definition based on purpose + audience context and returns
-the first capability step. Creates a new session implicitly unless
-`session_id` is provided (for step-up / reauth on an existing session).
-
-The response contains an `id` field — the flow handle. Use it as the path
-parameter for all subsequent `/flow/{id}/submit` calls.
-
-The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
-the flow's orchestration state (current step, collected data, history).
-The server is stateless between requests — all flow state lives in this
-cookie. The browser sends it automatically on subsequent requests.
-
-* @summary Start a new flow
-*/
-const createFlow = async (createFlowBody, options) => {
-	return customFetch(getCreateFlowUrl(), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(createFlowBody)
+	/**
+	* Builds `<zl-select>` options from a field's closed `validation.enum`. The
+	* wire only carries the allowed values (strings), so the label defaults to the
+	* value — author the enum with display-ready text. Piped through `| json` into
+	* the element's `options` attribute.
+	*/
+	engine.registerFilter("selectOptions", (values) => {
+		if (!Array.isArray(values)) return [];
+		return values.map((value) => {
+			const v = stringify(value);
+			return {
+				value: v,
+				label: v
+			};
+		});
 	});
-};
-const getGetFlowStepUrl = (id) => {
-	return `${getProxyPath()}/flow/${id}`;
-};
-/**
-* Returns the current capability step without advancing the state machine.
-Useful for page reloads or re-rendering after a network error.
-
-* @summary Get current step (re-render)
-*/
-const getFlowStep = async (id, options) => {
-	return customFetch(getGetFlowStepUrl(id), {
-		...options,
-		method: "GET"
+	/** Resolves `{text_key}.title` for form-level `<zl-alert heading>`. */
+	engine.registerFilter("alertHeading", (textKey) => {
+		const lookupKey = `${stringify(textKey)}.title`;
+		return options.locale[lookupKey] ?? "";
 	});
-};
-const getSubmitFlowStepUrl = (id) => {
-	return `${getProxyPath()}/flow/${id}/submit`;
-};
-/**
-* Submits user input for the current step. The server validates,
-processes (e.g., verifies a credential), advances the state machine
-through any invisible steps, and returns the next visible step.
-
-The response sets an updated encrypted `HttpOnly` cookie (`_zflow`)
-with the new flow state. The server is stateless — all orchestration
-state is carried in this cookie between requests.
-
-**Important:** The `id` in the response may differ from the `id` used in
-the request. This happens when a flow pivots (pushes a new flow onto the
-stack) or when a stacked flow completes (auto-pops to the parent flow).
-Always use the `id` from the latest response for the next request.
-
-## Flow completion
-
-When `step.type` is `complete`, the flow is terminal. The `step.behavior`
-field tells the frontend what to do:
-
-| `behavior`   | Action                                                     |
-|------------- |------------------------------------------------------------|
-| `redirect`   | Navigate to `redirect_uri` (OIDC/SAML auth request done). |
-| `show`       | Render the step as a success screen (e.g., registration).  |
-
-A `complete` step is only returned when the **entire flow stack** is done.
-If a stacked flow (e.g., recovery pivoted from login) finishes, the server
-auto-pops to the parent flow and returns the parent's next step — the
-frontend never sees a `complete` for intermediate flows.
-
-* @summary Submit step data and advance
-*/
-const submitFlowStep = async (id, submitFlowStepBody, options) => {
-	return customFetch(getSubmitFlowStepUrl(id), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(submitFlowStepBody)
+	/** Resolves `{text_key}.body` for form-level `<zl-alert>` message slot. */
+	engine.registerFilter("alertBody", (textKey) => {
+		const lookupKey = `${stringify(textKey)}.body`;
+		return options.locale[lookupKey] ?? "";
 	});
-};
-const getCreateAuthAttemptUrl = () => {
-	return `${getProxyPath()}/auth_attempts`;
-};
+	/** Localized inline error for `fieldName`, or empty when none applies. */
+	engine.registerFilter("fieldError", (fieldName, errors) => {
+		const name = stringify(fieldName);
+		if (!Array.isArray(errors)) return "";
+		for (const item of errors) {
+			const err = item;
+			if (err.field !== name) continue;
+			return err.text_key ? options.locale[err.text_key] ?? err.text_key : err.message ?? "";
+		}
+		return "";
+	});
+	/**
+	* Automation-hook token for a field name: strips the
+	* `x-auth-methods#` credential prefix so testids stay method-named
+	* (`zitadel-field-password`), while the `name` attribute keeps the
+	* raw wire key. See hookName for the contract.
+	*/
+	engine.registerFilter("testid", (fieldName) => hookName(stringify(fieldName)));
+	/**
+	* True when the error should render as `<zl-alert>`, not on a field. A
+	* field-scoped error (`field` set by {@link localiseFlowErrorKeys} when the
+	* step renders that field) routes inline instead; everything else — engine
+	* errors, and orphaned field errors already downgraded to a fieldless
+	* message — falls to the banner.
+	*/
+	engine.registerFilter("formLevelError", (err) => {
+		return !err?.field;
+	});
+	engine.registerTag(MANDATORY_GATES_TAG, {
+		parse() {},
+		render() {
+			return mandatoryGatesMarkerComment;
+		}
+	});
+	return engine;
+}
 /**
-* Starts a new authentication attempt. This is the entry point for the auth_attempts state machine.
-
-An attempt is an ephemeral (15-minute TTL) state machine that drives a single authentication round.
-It accepts factor challenges, verifies proofs, and completes into a session or handoff token.
-
-Accepts a project_id and challenge_nonce (from POST /bootstrap/challenge). For step-up re-auth,
-also include session_id to add factors to an existing session.
-
-* @summary Create a new authentication attempt
+* Fallbacks for text keys the flow engine derives from tenant-chosen step
+* names (`<step>.action.back` for the injected back action — see
+* `internal/domain/flow_state_machine.go` `buildStep`). Step names are open,
+* so no dictionary can enumerate them; a missing step-specific key falls back
+* to its generic entry instead of leaking the raw key into the UI.
 */
-const createAuthAttempt = async (createAuthAttemptBody, options) => {
-	return customFetch(getCreateAuthAttemptUrl(), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(createAuthAttemptBody)
-	});
-};
-const getGetAuthAttemptUrl = (attemptId) => {
-	return `${getProxyPath()}/auth_attempts/${attemptId}`;
-};
+const INJECTED_KEY_FALLBACKS = [{
+	suffix: ".action.back",
+	fallback: "action.back"
+}];
+function injectedKeyFallback(locale, key) {
+	for (const { suffix, fallback } of INJECTED_KEY_FALLBACKS) if (key.endsWith(suffix)) return locale[fallback];
+}
 /**
-* Polls the current state of an authentication attempt.
-
-Returns the attempt's state, available factors for the next challenge,
-challenges issued so far, and any errors preventing progress.
-
-Use this for polling during long-running factor verifications (e.g., waiting for
-a federated IdP callback or a device flow).
-
-* @summary Get authentication attempt state
+* Fallback for field-label keys (`<step>.field.<name>` — see
+* `FlowField.TextKey` in `internal/domain/flow_field_resolver.go`). Both
+* halves are tenant-chosen (step names and schema property names), so no
+* catalog can enumerate the keys; a miss renders a humanised property name
+* ("dateOfBirth" → "Date of birth") instead of leaking the raw key into the
+* form. Sub-keys like `.placeholder`/`.help` are excluded — they resolve
+* through their own filters, which stay empty on a miss.
 */
-const getAuthAttempt = async (attemptId, options) => {
-	return customFetch(getGetAuthAttemptUrl(attemptId), {
-		...options,
-		method: "GET"
-	});
-};
-const getIssueChallengeUrl = (attemptId) => {
-	return `${getProxyPath()}/auth_attempts/${attemptId}/challenges`;
-};
+function fieldLabelFallback(key) {
+	const index = key.lastIndexOf(".field.");
+	if (index === -1) return void 0;
+	const field = key.slice(index + 7);
+	if (field === "" || field.includes(".")) return void 0;
+	return capitaliseFirst(humaniseFieldName(field));
+}
 /**
-* Issues a single-factor verification challenge within an auth attempt.
-
-This advances the authentication state machine by requesting a specific factor method
-(password, passkey, TOTP, OTP via SMS, etc.). The server responds with challenge details
-including method, metadata, and any UI hints. The client then verifies the proof
-by calling POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.
-
-* @summary Issue a factor challenge
+* Rule-suffix fallbacks for the server's field-validation keys
+* (`error.<field>_<rule>` — see `FlowFieldValidationError.TextKey` in
+* `internal/domain/flow_field_resolver.go`). Field names come from the
+* tenant's user schema, so no catalog can enumerate the specific keys;
+* a miss resolves to the rule's generic entry, interpolated with the
+* field's label (`{0}`). The server spells the format rule `_invalid`
+* (the catalog's existing convention, e.g. `error.email_invalid`), so
+* that suffix takes the format wording; `_unknown_field` (a submitted
+* name that is not a step field) takes the catch-all.
 */
-const issueChallenge = async (attemptId, issueChallengeBody, options) => {
-	return customFetch(getIssueChallengeUrl(attemptId), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(issueChallengeBody)
-	});
-};
-const getVerifyChallengeProofUrl = (attemptId, challengeId) => {
-	return `${getProxyPath()}/auth_attempts/${attemptId}/challenges/${challengeId}/verify`;
-};
-/**
-* Submits a proof (credential, code, assertion) to verify a factor challenge.
-
-The proof format depends on the challenge method. For example:
-- `password` method: { password: "…" }
-- `totp` method: { totp: { code: "123456" } }
-- `passkey` method: { passkey: { assertion: "…" } }
-- `recovery_code` method: { recovery_code: "…" }
-
-On successful verification, the factor is written to the auth attempt.
-The attempt moves to the next pending challenge or completes if all required factors are verified.
-
-* @summary Verify a factor proof
-*/
-const verifyChallengeProof = async (attemptId, challengeId, verifyChallengeProofBody, options) => {
-	return customFetch(getVerifyChallengeProofUrl(attemptId, challengeId), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(verifyChallengeProofBody)
-	});
-};
-const getCreateHandoffUrl = (attemptId) => {
-	return `${getProxyPath()}/auth_attempts/${attemptId}/handoff`;
-};
-/**
-* Completes the authentication attempt and mints a `handoff_token`.
-
-Call this after all required factors have been verified and the attempt is in `completed` state.
-The handoff token is short-lived (≤60 seconds) and must be exchanged at
-POST /sessions/exchange to receive the final session and session_token.
-
-The handoff token is:
-- Single-use (atomic exchange, no retry)
-- Audience-bound (requires matching project key for exchange)
-- Idempotency-safe within a 5-minute window (see conventions)
-
-* @summary Complete authentication and create handoff token
-*/
-const createHandoff = async (attemptId, options) => {
-	return customFetch(getCreateHandoffUrl(attemptId), {
-		...options,
-		method: "POST"
-	});
-};
-const getCreateProjectUrl = () => {
-	return `${getProxyPath()}/projects`;
-};
-/**
-* @summary Create project
-*/
-const createProject = async (createProjectBody, options) => {
-	return customFetch(getCreateProjectUrl(), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(createProjectBody)
-	});
-};
-const getQueryProjectsUrl = () => {
-	return `${getProxyPath()}/projects/query`;
-};
+const FLOW_ERROR_RULE_FALLBACKS = [
+	{
+		suffix: "_required",
+		generic: "error.field_required"
+	},
+	{
+		suffix: "_min_length",
+		generic: "error.field_min_length"
+	},
+	{
+		suffix: "_max_length",
+		generic: "error.field_max_length"
+	},
+	{
+		suffix: "_format",
+		generic: "error.field_format"
+	},
+	{
+		suffix: "_invalid",
+		generic: "error.field_format"
+	},
+	{
+		suffix: "_unknown_field",
+		generic: "error.field_invalid"
+	}
+];
+const FLOW_ERROR_CATCH_ALL_KEY = "error.field_invalid";
 /**
-* @summary Query projects
+* Localises a `step.error` payload of `error.*` catalog keys —
+* field-validation violations and general engine failures (e.g.
+* `error.invalid_credentials`, `error.passkey_invalid`) alike.
+* Returns `null` unless EVERY `"; "`-joined segment is an `error.*` key
+* — the caller keeps other payloads (outcome tokens such as
+* `user_not_found`) verbatim.
+*
+* Keys the locale knows pass through as `text_key` entries: the template
+* localises them via `| t`, and `fieldErrorKeys` routes the known ones
+* inline to their field. Unknown keys with a recognised rule suffix are
+* pre-localised here from their generic {@link FLOW_ERROR_RULE_FALLBACKS}
+* entry; unknown keys without one pass through as `text_key` (matching
+* `| t`'s behaviour for non-validation keys such as
+* `error.sign_in_server`, which localises via `.title`/`.body`).
 */
-const queryProjects = async (queryProjectsBody, options) => {
-	return customFetch(getQueryProjectsUrl(), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(queryProjectsBody)
-	});
-};
-const getGetProjectUrl = (projectId) => {
-	return `${getProxyPath()}/projects/${projectId}`;
-};
+function localiseFlowErrorKeys(raw, ctx) {
+	const segments = raw.split("; ");
+	if (!segments.every((segment) => segment.startsWith("error."))) return null;
+	return segments.map((key) => localiseFlowErrorKey(key, ctx));
+}
+function localiseFlowErrorKey(key, ctx) {
+	const inlineField = fieldErrorKeys[key];
+	const orphanedInline = inlineField !== void 0 && ctx.fields !== void 0 && !ctx.fields.includes(inlineField);
+	if (!orphanedInline && ctx.locale[key] !== void 0) return inlineField !== void 0 ? {
+		field: inlineField,
+		text_key: key
+	} : { text_key: key };
+	for (const { suffix, generic } of FLOW_ERROR_RULE_FALLBACKS) {
+		if (!key.endsWith(suffix)) continue;
+		const field = key.slice(6, key.length - suffix.length);
+		if (field === "") break;
+		const message = capitaliseFirst(interpolate(ctx.locale[generic] ?? ctx.locale[FLOW_ERROR_CATCH_ALL_KEY] ?? "Please check {0}.", [fieldLabel(ctx, field)]));
+		return ctx.fields !== void 0 && ctx.fields.includes(field) ? {
+			field,
+			message
+		} : { message };
+	}
+	if (orphanedInline && ctx.locale[key] !== void 0) return { message: ctx.locale[key] };
+	return { text_key: key };
+}
+/** `<step>.field.<name>` from the locale, else a humanised field name. */
+function fieldLabel(ctx, field) {
+	return ctx.locale[`${ctx.stepName}.field.${field}`] ?? humaniseFieldName(field);
+}
 /**
-* Returns the current state of a project.
-
-* @summary Get project
+* `x-auth-methods#password` → "password", `givenName` → "given name",
+* `date_of_birth` → "date of birth".
 */
-const getProject = async (projectId, options) => {
-	return customFetch(getGetProjectUrl(projectId), {
-		...options,
-		method: "GET"
-	});
-};
-const getPatchProjectUrl = (projectId) => {
-	return `${getProxyPath()}/projects/${projectId}`;
-};
+function humaniseFieldName(field) {
+	return (field.includes("#") ? field.split("#").pop() : field).replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_.-]+/g, " ").trim().toLowerCase();
+}
+/** Messages may open with a lowercase field label; sentence-case them. */
+function capitaliseFirst(text) {
+	return text.length > 0 ? text[0]?.toUpperCase() + text.slice(1) : text;
+}
+function stringify(value) {
+	if (value == null) return "";
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	try {
+		return JSON.stringify(value);
+	} catch {
+		return String(value);
+	}
+}
 /**
-* Updates the state of a project.
-
-* @summary Update project
+* Positional `{n}` substitution shared by the `| t` filter and the
+* pre-localising fallback in {@link localiseFlowErrorKeys}, so both
+* produce byte-identical output for the same template and args.
 */
-const patchProject = async (projectId, patchProjectBody, options) => {
-	return customFetch(getPatchProjectUrl(projectId), {
-		...options,
-		method: "PATCH",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(patchProjectBody)
+function interpolate(template, args) {
+	if (args.length === 0) return template;
+	return template.replace(/\{(\d+)\}/g, (match, index) => {
+		return args[Number(index)] ?? match;
 	});
-};
-const getInitClaimUrl = (projectId) => {
-	return `${getProxyPath()}/projects/${projectId}/claim/init`;
-};
+}
+//#endregion
+//#region src/orchestrator/locales/en.ts
 /**
-* Starts a claim challenge for an unclaimed project. Authenticated by the
-project secret, this mints a single-use, short-lived challenge and returns
-the `claim_url` the developer opens in a browser to complete the claim,
-together with the `challenge_id` the CLI polls with. The exact expiry is
-carried by `expires_at` on the response.
-
-* @summary Initialize a project claim
+* Minimal English locale dictionary.
+*
+* The `| t` filter looks up `text_key` strings here. Missing keys fall through
+* to the raw key (matches the spec in
+* `docs/design/flowengine/flow-engine-guide.md`).
+*
+* Text keys are auto-generated by the server from the flow definition:
+*   - Step titles:       `<step>.title`
+*   - Step descriptions: `<step>.description`
+*   - Field labels:      `<step>.field.<field>`
+*   - Action labels:     `<step>.action.<action>`
+*
+* Copy aligned to Figma screens file `xkvBjkOJ8ENuHdTGZHXezK` (May 2026).
+* MVP only — multi-locale support is deferred.
 */
-const initClaim = async (projectId, options) => {
-	return customFetch(getInitClaimUrl(projectId), {
-		...options,
-		method: "POST"
-	});
-};
-const getGetClaimStatusUrl = (projectId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/projects/${projectId}/claim/status?${stringifiedParams}` : `${getProxyPath()}/projects/${projectId}/claim/status`;
+const en = {
+	"identifier.title": "Sign in",
+	"identifier.description": "Enter your email to continue",
+	"identifier.field.email": "Email",
+	"identifier.field.email.placeholder": "you@example.com",
+	"identifier.field.password": "Password",
+	"identifier.action.submit": "Sign in",
+	"identifier.action.continue": "Continue",
+	"identifier.action.passkey": "Sign in with a passkey",
+	"identifier.action.register.lead": "Don't have an account? ",
+	"identifier.action.register.link": "Sign up",
+	"authenticate.title": "Sign in",
+	"authenticate.description": "Enter your password",
+	"authenticate.field.password": "Password",
+	"authenticate.action.submit": "Sign in",
+	"choose-register.title": "Create your account",
+	"choose-register.description": "Choose how you'd like to sign up",
+	"choose-register.action.register-with-password": "Sign up with password",
+	"choose-register.action.register-with-passkey": "Sign up with passkey",
+	"collect-credentials.title": "Create your account",
+	"collect-credentials.description": "Set up your email and password",
+	"collect-credentials.field.email": "Email",
+	"collect-credentials.field.email.placeholder": "you@example.com",
+	"collect-credentials.field.password": "Password",
+	"collect-credentials.action.submit": "Sign up",
+	"register-password.title": "Create your password",
+	"register-password.description": "Choose a secure password for your account",
+	"register-password.field.password": "Password",
+	"register-password.action.submit": "Sign up",
+	"register-password.action.back": "Back",
+	"passkey-upsell.title": "Sign in faster next time",
+	"passkey-upsell.description": "No password needed ever again.",
+	"passkey-upsell.description.line1": "No password needed ever again.",
+	"passkey-upsell.description.line2": "Sign in with Face ID, Touch ID, or PIN.",
+	"passkey-upsell.action.passkey_register": "Set up passkey",
+	"passkey-upsell.action.skip": "Skip for now",
+	"passkey-upsell.action.setup": "Set up passkey",
+	"collect-passkey-email.title": "Create your account",
+	"collect-passkey-email.description": "Enter your email to set up a passkey",
+	"collect-passkey-email.field.email": "Email",
+	"collect-passkey-email.field.email.placeholder": "you@example.com",
+	"collect-passkey-email.action.submit": "Continue",
+	"passkey-enroll.title": "Set up your passkey",
+	"passkey-enroll.description": "Use Face ID, Touch ID, or your device PIN to create a passkey.",
+	"passkey-enroll.action.passkey_register": "Set up passkey",
+	"done.title": "You're signed in as",
+	"done.description": "",
+	"password.title": "Sign in",
+	"password.description": "Enter your password",
+	"password.field.password": "Password",
+	"password.action.signin": "Sign in",
+	"password.action.passkey": "Sign in with a passkey",
+	"password.action.back": "Back",
+	"password.action.register.lead": "Don't have an account? ",
+	"password.action.register.link": "Sign up",
+	"register.title": "Create your account",
+	"register.description": "",
+	"register.field.email": "Email",
+	"register.field.email.placeholder": "you@example.com",
+	"register.field.password": "Password",
+	"register.field.givenName": "Given name",
+	"register.field.familyName": "Family name",
+	"register.field.companyName": "Company name",
+	"register.field.dateOfBirth": "Date of birth",
+	"register.field.country": "Country",
+	"register.field.country.placeholder": "Select your country",
+	"register.field.terms": "I agree to the terms of service",
+	"register.action.password": "Continue with password",
+	"register.action.passkey": "Continue with a passkey",
+	"register.action.submit": "Sign up",
+	"register.action.back": "Back",
+	"register.action.sign_in.lead": "Already have an account? ",
+	"register.action.sign_in.link": "Sign in",
+	"complete.title": "You're signed in as",
+	"signed-in.continue": "Continue",
+	"signed-in.logout": "Sign out",
+	"passkey-login.title": "Sign in with your passkey",
+	"passkey-first.title": "Sign in",
+	"passkey-first.description": "Use your passkey to continue",
+	"passkey-first.action.passkey": "Continue with passkey",
+	"passkey-first.action.email_fallback": "Use email instead",
+	"recover.title": "Check your email",
+	"recover.description": "We sent a password reset link to your email address.",
+	"recover.action.back": "Back to sign in",
+	"submit.continue": "Continue",
+	"submit.signin": "Sign in",
+	"action.forgot_password": "Forgot password?",
+	"action.cancel": "Cancel",
+	"action.back": "Back",
+	"sso.redirect.title": "Redirecting to your provider…",
+	"passkey.pending.status": "Waiting for your passkey…",
+	"error.passkey_cancelled": "The passkey prompt was closed before completing.",
+	"error.passkey_timeout": "The passkey request timed out. Please try again.",
+	"error.passkey_not_registered": "This passkey is not registered. Please sign in with your email and password.",
+	"error.passkey_setup_failed": "Passkey registration did not complete. Please try again.",
+	"error.passkey_unsupported": "This device does not support passkeys",
+	"error.passkey_failed": "Something went wrong. Please try again.",
+	"error.passkey_invalid": "This passkey could not be verified. Please try again.",
+	"error.passkey_registration_invalid": "The new passkey could not be verified. Please try registering it again.",
+	"error.email_required": "Please enter an email address",
+	"error.email_invalid": "Please enter a valid email",
+	"error.password_required": "Please enter a password",
+	"error.password_incorrect": "Wrong email or password.",
+	"error.email_exists": "An account with this email already exists.",
+	/** Figma sign-in error `6602:180268` — inline on password field. */
+	"error.invalid_credentials": "Wrong email or password.",
+	"error.required": "This field is required.",
+	"error.field_required": "{0} is required.",
+	"error.field_format": "Please enter a valid {0}.",
+	"error.field_min_length": "{0} is too short.",
+	"error.field_max_length": "{0} is too long.",
+	"error.field_invalid": "Please check {0}.",
+	"error.sign_in_server.title": "We couldn't complete your sign in.",
+	"error.sign_in_server.body": "Please try again in a few minutes"
+};
+//#endregion
+//#region src/orchestrator/locales/de.ts
+const de = {
+	"identifier.title": "Anmelden",
+	"identifier.description": "Gib deine E-Mail-Adresse ein, um fortzufahren",
+	"identifier.field.email": "E-Mail",
+	"identifier.field.email.placeholder": "du@beispiel.de",
+	"identifier.field.password": "Passwort",
+	"identifier.action.submit": "Anmelden",
+	"identifier.action.continue": "Weiter",
+	"identifier.action.passkey": "Mit Passkey anmelden",
+	"identifier.action.register.lead": "Noch kein Konto? ",
+	"identifier.action.register.link": "Registrieren",
+	"authenticate.title": "Anmelden",
+	"authenticate.description": "Gib dein Passwort ein",
+	"authenticate.field.password": "Passwort",
+	"authenticate.action.submit": "Anmelden",
+	"choose-register.title": "Konto erstellen",
+	"choose-register.description": "Wähle, wie du dich registrieren möchtest",
+	"choose-register.action.register-with-password": "Mit Passwort registrieren",
+	"choose-register.action.register-with-passkey": "Mit Passkey registrieren",
+	"collect-credentials.title": "Konto erstellen",
+	"collect-credentials.description": "Richte E-Mail und Passwort ein",
+	"collect-credentials.field.email": "E-Mail",
+	"collect-credentials.field.email.placeholder": "du@beispiel.de",
+	"collect-credentials.field.password": "Passwort",
+	"collect-credentials.action.submit": "Registrieren",
+	"register-password.title": "Passwort erstellen",
+	"register-password.description": "Wähle ein sicheres Passwort für dein Konto",
+	"register-password.field.password": "Passwort",
+	"register-password.action.submit": "Registrieren",
+	"register-password.action.back": "Zurück",
+	"passkey-upsell.title": "Nächstes Mal schneller anmelden",
+	"passkey-upsell.description": "Kein Passwort mehr nötig.",
+	"passkey-upsell.description.line1": "Kein Passwort mehr nötig.",
+	"passkey-upsell.description.line2": "Melde dich mit Face ID, Touch ID oder PIN an.",
+	"passkey-upsell.action.passkey_register": "Passkey einrichten",
+	"passkey-upsell.action.skip": "Vorerst überspringen",
+	"passkey-upsell.action.setup": "Passkey einrichten",
+	"collect-passkey-email.title": "Konto erstellen",
+	"collect-passkey-email.description": "Gib deine E-Mail-Adresse ein, um einen Passkey einzurichten",
+	"collect-passkey-email.field.email": "E-Mail",
+	"collect-passkey-email.field.email.placeholder": "du@beispiel.de",
+	"collect-passkey-email.action.submit": "Weiter",
+	"passkey-enroll.title": "Passkey einrichten",
+	"passkey-enroll.description": "Verwende Face ID, Touch ID oder die Geräte-PIN, um einen Passkey zu erstellen.",
+	"passkey-enroll.action.passkey_register": "Passkey einrichten",
+	"done.title": "Du bist angemeldet als",
+	"done.description": "",
+	"password.title": "Anmelden",
+	"password.description": "Gib dein Passwort ein",
+	"password.field.password": "Passwort",
+	"password.action.signin": "Anmelden",
+	"password.action.passkey": "Mit Passkey anmelden",
+	"password.action.back": "Zurück",
+	"password.action.register.lead": "Noch kein Konto? ",
+	"password.action.register.link": "Registrieren",
+	"register.title": "Konto erstellen",
+	"register.description": "",
+	"register.field.email": "E-Mail",
+	"register.field.email.placeholder": "du@beispiel.de",
+	"register.field.password": "Passwort",
+	"register.field.givenName": "Vorname",
+	"register.field.familyName": "Nachname",
+	"register.field.companyName": "Firmenname",
+	"register.field.dateOfBirth": "Geburtsdatum",
+	"register.field.country": "Land",
+	"register.field.country.placeholder": "Land auswählen",
+	"register.field.terms": "Ich stimme den Nutzungsbedingungen zu",
+	"register.action.password": "Mit Passwort fortfahren",
+	"register.action.passkey": "Weiter mit Passkey",
+	"register.action.submit": "Registrieren",
+	"register.action.back": "Zurück",
+	"register.action.sign_in.lead": "Bereits ein Konto? ",
+	"register.action.sign_in.link": "Anmelden",
+	"complete.title": "Du bist angemeldet als",
+	"signed-in.continue": "Weiter",
+	"signed-in.logout": "Abmelden",
+	"passkey-login.title": "Mit Passkey anmelden",
+	"passkey-first.title": "Anmelden",
+	"passkey-first.description": "Verwende deinen Passkey, um fortzufahren",
+	"passkey-first.action.passkey": "Weiter mit Passkey",
+	"passkey-first.action.email_fallback": "Stattdessen E-Mail verwenden",
+	"recover.title": "E-Mail prüfen",
+	"recover.description": "Wir haben einen Link zum Zurücksetzen des Passworts an deine E-Mail-Adresse gesendet.",
+	"recover.action.back": "Zurück zur Anmeldung",
+	"submit.continue": "Weiter",
+	"submit.signin": "Anmelden",
+	"action.forgot_password": "Passwort vergessen?",
+	"action.cancel": "Abbrechen",
+	"action.back": "Zurück",
+	"sso.redirect.title": "Weiterleitung zum Anbieter…",
+	"passkey.pending.status": "Warten auf deinen Passkey…",
+	"error.passkey_cancelled": "Die Passkey-Abfrage wurde vorzeitig geschlossen.",
+	"error.passkey_timeout": "Die Passkey-Anfrage hat zu lange gedauert. Bitte versuche es erneut.",
+	"error.passkey_not_registered": "Dieser Passkey ist nicht registriert. Bitte melde dich mit E-Mail und Passwort an.",
+	"error.passkey_setup_failed": "Passkey-Registrierung wurde nicht abgeschlossen. Bitte versuche es erneut.",
+	"error.passkey_unsupported": "Dieses Gerät unterstützt keine Passkeys",
+	"error.passkey_failed": "Etwas ist schiefgelaufen. Bitte versuche es erneut.",
+	"error.passkey_invalid": "Dieser Passkey konnte nicht bestätigt werden. Bitte versuche es erneut.",
+	"error.passkey_registration_invalid": "Der neue Passkey konnte nicht bestätigt werden. Bitte registriere ihn erneut.",
+	"error.email_required": "Bitte gib eine E-Mail-Adresse ein",
+	"error.email_invalid": "Bitte gib eine gültige E-Mail-Adresse ein",
+	"error.password_required": "Bitte gib ein Passwort ein",
+	"error.password_incorrect": "Falsche E-Mail oder falsches Passwort.",
+	"error.email_exists": "Ein Konto mit dieser E-Mail-Adresse existiert bereits.",
+	"error.invalid_credentials": "Falsche E-Mail oder falsches Passwort.",
+	"error.required": "Dieses Feld ist erforderlich.",
+	"error.field_required": "{0} ist erforderlich.",
+	"error.field_format": "Bitte gib einen gültigen Wert für {0} ein.",
+	"error.field_min_length": "{0} ist zu kurz.",
+	"error.field_max_length": "{0} ist zu lang.",
+	"error.field_invalid": "Bitte überprüfe {0}.",
+	"error.sign_in_server.title": "Anmeldung konnte nicht abgeschlossen werden.",
+	"error.sign_in_server.body": "Bitte versuche es in einigen Minuten erneut"
+};
+//#endregion
+//#region src/orchestrator/locales/it.ts
+const it = {
+	"identifier.title": "Accedi",
+	"identifier.description": "Inserisci la tua e-mail per continuare",
+	"identifier.field.email": "E-mail",
+	"identifier.field.email.placeholder": "tu@esempio.com",
+	"identifier.field.password": "Password",
+	"identifier.action.submit": "Accedi",
+	"identifier.action.continue": "Continua",
+	"identifier.action.passkey": "Accedi con passkey",
+	"identifier.action.register.lead": "Non hai un account? ",
+	"identifier.action.register.link": "Registrati",
+	"authenticate.title": "Accedi",
+	"authenticate.description": "Inserisci la tua password",
+	"authenticate.field.password": "Password",
+	"authenticate.action.submit": "Accedi",
+	"choose-register.title": "Crea il tuo account",
+	"choose-register.description": "Scegli come registrarti",
+	"choose-register.action.register-with-password": "Registrati con password",
+	"choose-register.action.register-with-passkey": "Registrati con passkey",
+	"collect-credentials.title": "Crea il tuo account",
+	"collect-credentials.description": "Configura e-mail e password",
+	"collect-credentials.field.email": "E-mail",
+	"collect-credentials.field.email.placeholder": "tu@esempio.com",
+	"collect-credentials.field.password": "Password",
+	"collect-credentials.action.submit": "Registrati",
+	"register-password.title": "Crea la tua password",
+	"register-password.description": "Scegli una password sicura per il tuo account",
+	"register-password.field.password": "Password",
+	"register-password.action.submit": "Registrati",
+	"register-password.action.back": "Indietro",
+	"passkey-upsell.title": "Accedi più velocemente la prossima volta",
+	"passkey-upsell.description": "Nessuna password necessaria.",
+	"passkey-upsell.description.line1": "Nessuna password necessaria.",
+	"passkey-upsell.description.line2": "Accedi con Face ID, Touch ID o PIN.",
+	"passkey-upsell.action.passkey_register": "Configura passkey",
+	"passkey-upsell.action.skip": "Salta per ora",
+	"passkey-upsell.action.setup": "Configura passkey",
+	"collect-passkey-email.title": "Crea il tuo account",
+	"collect-passkey-email.description": "Inserisci la tua e-mail per configurare una passkey",
+	"collect-passkey-email.field.email": "E-mail",
+	"collect-passkey-email.field.email.placeholder": "tu@esempio.com",
+	"collect-passkey-email.action.submit": "Continua",
+	"passkey-enroll.title": "Configura la tua passkey",
+	"passkey-enroll.description": "Usa Face ID, Touch ID o il PIN del dispositivo per creare una passkey.",
+	"passkey-enroll.action.passkey_register": "Configura passkey",
+	"done.title": "Sei connesso come",
+	"done.description": "",
+	"password.title": "Accedi",
+	"password.description": "Inserisci la tua password",
+	"password.field.password": "Password",
+	"password.action.signin": "Accedi",
+	"password.action.passkey": "Accedi con passkey",
+	"password.action.back": "Indietro",
+	"password.action.register.lead": "Non hai un account? ",
+	"password.action.register.link": "Registrati",
+	"register.title": "Crea il tuo account",
+	"register.description": "",
+	"register.field.email": "E-mail",
+	"register.field.email.placeholder": "tu@esempio.com",
+	"register.field.password": "Password",
+	"register.field.givenName": "Nome",
+	"register.field.familyName": "Cognome",
+	"register.field.companyName": "Nome azienda",
+	"register.field.dateOfBirth": "Data di nascita",
+	"register.field.country": "Paese",
+	"register.field.country.placeholder": "Seleziona il tuo paese",
+	"register.field.terms": "Accetto i termini di servizio",
+	"register.action.password": "Continua con password",
+	"register.action.passkey": "Continua con passkey",
+	"register.action.submit": "Registrati",
+	"register.action.back": "Indietro",
+	"register.action.sign_in.lead": "Hai già un account? ",
+	"register.action.sign_in.link": "Accedi",
+	"complete.title": "Sei connesso come",
+	"signed-in.continue": "Continua",
+	"signed-in.logout": "Esci",
+	"passkey-login.title": "Accedi con la tua passkey",
+	"passkey-first.title": "Accedi",
+	"passkey-first.description": "Usa la tua passkey per continuare",
+	"passkey-first.action.passkey": "Continua con passkey",
+	"passkey-first.action.email_fallback": "Usa invece l'email",
+	"recover.title": "Controlla la tua e-mail",
+	"recover.description": "Abbiamo inviato un link per reimpostare la password al tuo indirizzo e-mail.",
+	"recover.action.back": "Torna all'accesso",
+	"submit.continue": "Continua",
+	"submit.signin": "Accedi",
+	"action.forgot_password": "Password dimenticata?",
+	"action.cancel": "Annulla",
+	"action.back": "Indietro",
+	"sso.redirect.title": "Reindirizzamento al provider…",
+	"passkey.pending.status": "In attesa della tua passkey…",
+	"error.passkey_cancelled": "La richiesta della passkey è stata chiusa prima del completamento.",
+	"error.passkey_timeout": "La richiesta della passkey è scaduta. Riprova.",
+	"error.passkey_not_registered": "Questa passkey non è registrata. Accedi con e-mail e password.",
+	"error.passkey_setup_failed": "La registrazione della passkey non è stata completata. Riprova.",
+	"error.passkey_unsupported": "Questo dispositivo non supporta le passkey",
+	"error.passkey_failed": "Qualcosa è andato storto. Riprova.",
+	"error.passkey_invalid": "Non è stato possibile verificare questa passkey. Riprova.",
+	"error.passkey_registration_invalid": "Non è stato possibile verificare la nuova passkey. Riprova a registrarla.",
+	"error.email_required": "Inserisci un indirizzo e-mail",
+	"error.email_invalid": "Inserisci un indirizzo e-mail valido",
+	"error.password_required": "Inserisci una password",
+	"error.password_incorrect": "E-mail o password errata.",
+	"error.email_exists": "Esiste già un account con questo indirizzo e-mail.",
+	"error.invalid_credentials": "E-mail o password errata.",
+	"error.required": "Questo campo è obbligatorio.",
+	"error.field_required": "{0} è obbligatorio.",
+	"error.field_format": "Inserisci un valore valido per {0}.",
+	"error.field_min_length": "{0} è troppo corto.",
+	"error.field_max_length": "{0} è troppo lungo.",
+	"error.field_invalid": "Controlla {0}.",
+	"error.sign_in_server.title": "Non è stato possibile completare l'accesso.",
+	"error.sign_in_server.body": "Riprova tra qualche minuto"
+};
+//#endregion
+//#region src/orchestrator/locales/business.ts
+const businessLocales = {
+	en: {
+		"identifier.field.email": "Work email",
+		"identifier.field.email.placeholder": "you@company.com",
+		"collect-credentials.field.email": "Work email",
+		"collect-credentials.field.email.placeholder": "you@company.com",
+		"collect-passkey-email.field.email": "Work email",
+		"collect-passkey-email.field.email.placeholder": "you@company.com",
+		"register.field.email": "Work email",
+		"register.field.email.placeholder": "you@company.com"
+	},
+	de: {
+		"identifier.field.email": "Geschäftliche E-Mail",
+		"identifier.field.email.placeholder": "du@unternehmen.com",
+		"collect-credentials.field.email": "Geschäftliche E-Mail",
+		"collect-credentials.field.email.placeholder": "du@unternehmen.com",
+		"collect-passkey-email.field.email": "Geschäftliche E-Mail",
+		"collect-passkey-email.field.email.placeholder": "du@unternehmen.com",
+		"register.field.email": "Geschäftliche E-Mail",
+		"register.field.email.placeholder": "du@unternehmen.com"
+	},
+	it: {
+		"identifier.field.email": "E-mail aziendale",
+		"identifier.field.email.placeholder": "tu@azienda.com",
+		"collect-credentials.field.email": "E-mail aziendale",
+		"collect-credentials.field.email.placeholder": "tu@azienda.com",
+		"collect-passkey-email.field.email": "E-mail aziendale",
+		"collect-passkey-email.field.email.placeholder": "tu@azienda.com",
+		"register.field.email": "E-mail aziendale",
+		"register.field.email.placeholder": "tu@azienda.com"
+	}
+};
+//#endregion
+//#region src/orchestrator/locales/index.ts
+const builtinLocales = {
+	en,
+	de,
+	it
+};
+//#endregion
+//#region ../api/dist/runtime/base-url.mjs
+let proxyPath = "";
+function getProxyPath() {
+	return proxyPath;
+}
+function setProxyPath(path) {
+	proxyPath = path;
+}
+//#endregion
+//#region ../api/dist/chunk-CfYAbeIz.mjs
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region ../api/dist/generated/endpoints/zitadelNextGen.mjs
+/**
+* Generated by orval v8.10.0 🍺
+* Do not edit manually.
+* Zitadel NextGen
+* This is the next generation of the Zitadel identity platform.
+* OpenAPI spec version: 0.0.1
+*/
+var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
+	completeClaim: () => completeClaim,
+	createAuthAttempt: () => createAuthAttempt,
+	createBranding: () => createBranding,
+	createFlow: () => createFlow,
+	createFlowDefinition: () => createFlowDefinition,
+	createHandoff: () => createHandoff,
+	createProject: () => createProject,
+	createSchema: () => createSchema,
+	createSession: () => createSession,
+	createTeam: () => createTeam,
+	createUser: () => createUser,
+	deleteFlowDefinition: () => deleteFlowDefinition,
+	deleteTeam: () => deleteTeam,
+	deleteUserByID: () => deleteUserByID,
+	exchangeHandoff: () => exchangeHandoff,
+	getAuthAttempt: () => getAuthAttempt,
+	getBrandingById: () => getBrandingById,
+	getClaimStatus: () => getClaimStatus,
+	getCompleteClaimUrl: () => getCompleteClaimUrl,
+	getCreateAuthAttemptUrl: () => getCreateAuthAttemptUrl,
+	getCreateBrandingUrl: () => getCreateBrandingUrl,
+	getCreateFlowDefinitionUrl: () => getCreateFlowDefinitionUrl,
+	getCreateFlowUrl: () => getCreateFlowUrl,
+	getCreateHandoffUrl: () => getCreateHandoffUrl,
+	getCreateProjectUrl: () => getCreateProjectUrl,
+	getCreateSchemaUrl: () => getCreateSchemaUrl,
+	getCreateSessionUrl: () => getCreateSessionUrl,
+	getCreateTeamUrl: () => getCreateTeamUrl,
+	getCreateUserUrl: () => getCreateUserUrl,
+	getDeleteFlowDefinitionUrl: () => getDeleteFlowDefinitionUrl,
+	getDeleteTeamUrl: () => getDeleteTeamUrl,
+	getDeleteUserByIDUrl: () => getDeleteUserByIDUrl,
+	getEvent: () => getEvent,
+	getExchangeHandoffUrl: () => getExchangeHandoffUrl,
+	getFlowDefinition: () => getFlowDefinition,
+	getFlowStep: () => getFlowStep,
+	getGetAuthAttemptUrl: () => getGetAuthAttemptUrl,
+	getGetBrandingByIdUrl: () => getGetBrandingByIdUrl,
+	getGetClaimStatusUrl: () => getGetClaimStatusUrl,
+	getGetEventUrl: () => getGetEventUrl,
+	getGetFlowDefinitionUrl: () => getGetFlowDefinitionUrl,
+	getGetFlowStepUrl: () => getGetFlowStepUrl,
+	getGetHealthUrl: () => getGetHealthUrl,
+	getGetLiveUrl: () => getGetLiveUrl,
+	getGetMySessionUrl: () => getGetMySessionUrl,
+	getGetMyUserUrl: () => getGetMyUserUrl,
+	getGetProjectUrl: () => getGetProjectUrl,
+	getGetReadyUrl: () => getGetReadyUrl,
+	getGetSchemaByIdUrl: () => getGetSchemaByIdUrl,
+	getGetSessionUrl: () => getGetSessionUrl,
+	getGetTeamUrl: () => getGetTeamUrl,
+	getGetUserByIDUrl: () => getGetUserByIDUrl,
+	getHealth: () => getHealth,
+	getInitClaimUrl: () => getInitClaimUrl,
+	getIssueChallengeUrl: () => getIssueChallengeUrl,
+	getListBrandingUrl: () => getListBrandingUrl,
+	getListEventsUrl: () => getListEventsUrl,
+	getListFlowDefinitionsUrl: () => getListFlowDefinitionsUrl,
+	getListSchemasUrl: () => getListSchemasUrl,
+	getListUserPasskeysUrl: () => getListUserPasskeysUrl,
+	getListUserTeamsUrl: () => getListUserTeamsUrl,
+	getListUsersUrl: () => getListUsersUrl,
+	getLive: () => getLive,
+	getMySession: () => getMySession,
+	getMyUser: () => getMyUser,
+	getPatchProjectUrl: () => getPatchProjectUrl,
+	getProject: () => getProject,
+	getQueryProjectsUrl: () => getQueryProjectsUrl,
+	getQuerySessionsUrl: () => getQuerySessionsUrl,
+	getQueryTeamsUrl: () => getQueryTeamsUrl,
+	getReady: () => getReady,
+	getRevokeMySessionUrl: () => getRevokeMySessionUrl,
+	getRevokeSessionUrl: () => getRevokeSessionUrl,
+	getSchemaById: () => getSchemaById,
+	getSession: () => getSession,
+	getSetUserPasswordUrl: () => getSetUserPasswordUrl,
+	getSubmitFlowStepUrl: () => getSubmitFlowStepUrl,
+	getTeam: () => getTeam,
+	getUpdateFlowDefinitionUrl: () => getUpdateFlowDefinitionUrl,
+	getUpdateTeamUrl: () => getUpdateTeamUrl,
+	getUserByID: () => getUserByID,
+	getVerifyChallengeProofUrl: () => getVerifyChallengeProofUrl,
+	initClaim: () => initClaim,
+	issueChallenge: () => issueChallenge,
+	listBranding: () => listBranding,
+	listEvents: () => listEvents,
+	listFlowDefinitions: () => listFlowDefinitions,
+	listSchemas: () => listSchemas,
+	listUserPasskeys: () => listUserPasskeys,
+	listUserTeams: () => listUserTeams,
+	listUsers: () => listUsers,
+	patchProject: () => patchProject,
+	queryProjects: () => queryProjects,
+	querySessions: () => querySessions,
+	queryTeams: () => queryTeams,
+	revokeMySession: () => revokeMySession,
+	revokeSession: () => revokeSession,
+	setUserPassword: () => setUserPassword,
+	submitFlowStep: () => submitFlowStep,
+	updateFlowDefinition: () => updateFlowDefinition,
+	updateTeam: () => updateTeam,
+	verifyChallengeProof: () => verifyChallengeProof
+});
+const getGetHealthUrl = () => {
+	return `${getProxyPath()}/healthz`;
 };
 /**
-* Polled by the CLI while a browser completes the claim. Authorized by the
-project secret that initiated the challenge. Returns `pending`, or
-`completed` with the owning team, the claim timestamp, and the dashboard
-URL once the browser leg has finished.
-
-* @summary Get claim status
+* Check whether the server is healthy
+* @summary Check server health
 */
-const getClaimStatus = async (projectId, params, options) => {
-	return customFetch(getGetClaimStatusUrl(projectId, params), {
+const getHealth = async (options) => {
+	return customFetch(getGetHealthUrl(), {
 		...options,
 		method: "GET"
 	});
 };
-const getCompleteClaimUrl = (projectId) => {
-	return `${getProxyPath()}/projects/${projectId}/claim/complete`;
+const getGetLiveUrl = () => {
+	return `${getProxyPath()}/livez`;
 };
 /**
-* Called by the browser after the developer authenticates on the claim page.
-Authenticated by the `__nextgen_session` cookie, it attaches the project to
-the developer's personal team using the `challenge_id` from the claim URL as
-its single-use, browser-safe authorization.
-
-* @summary Complete a project claim
+* Check whether the server is started
+* @summary Check server liveness
 */
-const completeClaim = async (projectId, completeClaimBody, options) => {
-	return customFetch(getCompleteClaimUrl(projectId), {
+const getLive = async (options) => {
+	return customFetch(getGetLiveUrl(), {
 		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(completeClaimBody)
+		method: "GET"
 	});
 };
-const getCreateSessionUrl = () => {
-	return `${getProxyPath()}/sessions`;
+const getGetReadyUrl = () => {
+	return `${getProxyPath()}/readyz`;
 };
 /**
-* Creates an anonymous session shell with no user and no factors (`state: building`).
-
-This is optional — an `auth_attempt` will create a session implicitly if none is provided.
-Use this explicitly when you want to:
-- Pre-allocate a `session_id` before the user is known, so device/telemetry signals
-can be correlated with the eventual authenticated session from the start.
-- Track anonymous state (bot detection, device fingerprint) that survives until authentication.
-
-Creating a session is an app-plane operation on the project credential
-(`session.write`). The returned `session_token` is a session credential for the
-end-user client, not a management scope: it is delivered as the
-`__nextgen_session` cookie and authorises the self-service operations
-`GET /sessions/me` and `DELETE /sessions/me` (`nextgenSession` scheme). The
-by-id operations `GET /sessions/{session_id}` and `DELETE /sessions/{session_id}`
-are operator endpoints and require `session.read` / `session.delete` instead.
-
-The `session_token` is superseded when a handoff exchange completes — clients must
-replace it at that point.
-
-Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
-full session TTL when the first authentication factor is written via a completing `auth_attempt`.
-
-* @summary Create an anonymous session shell
+* Check whether the server is ready to accept requests
+* @summary Check server readiness
 */
-const createSession = async (createSessionBody, options) => {
-	return customFetch(getCreateSessionUrl(), {
+const getReady = async (options) => {
+	return customFetch(getGetReadyUrl(), {
 		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(createSessionBody)
+		method: "GET"
 	});
 };
-const getQuerySessionsUrl = (params) => {
+const getCreateUserUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/query?${stringifiedParams}` : `${getProxyPath()}/sessions/query`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users?${stringifiedParams}` : `${getProxyPath()}/users`;
 };
 /**
-* Returns the sessions of a project, paginated with a cursor.
-Sessions of every lifecycle state are returned; each carries its `state`.
-Requires `session.read` permission.
-
-* @summary Query sessions
+* @summary Create user
 */
-const querySessions = async (querySessionsBody, params, options) => {
-	return customFetch(getQuerySessionsUrl(params), {
+const createUser = async (createUserBody, params, options) => {
+	return customFetch(getCreateUserUrl(params), {
 		...options,
 		method: "POST",
 		headers: {
 			"Content-Type": "application/json",
 			...options?.headers
 		},
-		body: JSON.stringify(querySessionsBody)
+		body: JSON.stringify(createUserBody)
 	});
 };
-const getExchangeHandoffUrl = (params) => {
+const getListUsersUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/exchange?${stringifiedParams}` : `${getProxyPath()}/sessions/exchange`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users?${stringifiedParams}` : `${getProxyPath()}/users`;
 };
 /**
-* Consumes a one-time `handoff_token` minted by `POST /auth_attempts/{id}/handoff`
-and returns the resulting session and a `session_token`.
-
-The server resolves the originating `auth_attempt` from the token and then:
-
-| Originating auth_attempt | Outcome |
-|---|---|
-| No `session_id` | A new authenticated session is **created**. |
-| `session_id` points to an anonymous shell | Existing session is **upgraded** — user and factors written in, TTL reset to full session TTL. |
-| `session_id` points to an active session (step-up) | Existing session is **upgraded** — new factors merged, `assurance_levels[]` expanded. |
-
-The response shape is identical in all three cases.
-
-The `session_token` supersedes any previously issued `session_token` for the same session.
-Clients must replace their stored token at this point.
-
-Requires a project service key (OAuth2 client credentials).
-
-* @summary Exchange handoff token for a session
+* @summary List users
 */
-const exchangeHandoff = async (exchangeHandoffBody, params, options) => {
-	return customFetch(getExchangeHandoffUrl(params), {
+const listUsers = async (params, options) => {
+	return customFetch(getListUsersUrl(params), {
 		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(exchangeHandoffBody)
+		method: "GET"
 	});
 };
-const getGetSessionUrl = (sessionId, params) => {
+const getGetUserByIDUrl = (userId, params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}` : `${getProxyPath()}/sessions/${sessionId}`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}?${stringifiedParams}` : `${getProxyPath()}/users/${userId}`;
 };
 /**
-* Returns the current state of a session including its factors and all currently
-satisfied assurance levels.
-
-`assurance_levels[]` may shrink over time as factor freshness windows expire,
-without the session itself expiring. Use step-up authentication (a new `auth_attempt`
-against the same `session_id`) to restore a dropped assurance level.
-
-* @summary Get session state
+* @summary Get user by ID
 */
-const getSession = async (sessionId, params, options) => {
-	return customFetch(getGetSessionUrl(sessionId, params), {
+const getUserByID = async (userId, params, options) => {
+	return customFetch(getGetUserByIDUrl(userId, params), {
 		...options,
 		method: "GET"
 	});
 };
-const getRevokeSessionUrl = (sessionId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}` : `${getProxyPath()}/sessions/${sessionId}`;
+const getDeleteUserByIDUrl = (userId) => {
+	return `${getProxyPath()}/users/${userId}`;
 };
 /**
-* Permanently deletes the session, terminating it immediately.
-
-This is the operator revoke path and requires the `session.delete` scope on a
-project-bound credential. End-user logout with the `__nextgen_session` cookie is
-`DELETE /sessions/me` (`nextgenSession` scheme).
-
-Idempotent: deleting a session that does not exist (or was already deleted)
-still returns 204. After deletion, any tokens derived from the session are
-invalidated.
-
-* @summary Revoke session
+* @summary Delete user by ID
 */
-const revokeSession = async (sessionId, params, options) => {
-	return customFetch(getRevokeSessionUrl(sessionId, params), {
+const deleteUserByID = async (userId, options) => {
+	return customFetch(getDeleteUserByIDUrl(userId), {
 		...options,
 		method: "DELETE"
 	});
 };
-const getGetMySessionUrl = () => {
-	return `${getProxyPath()}/sessions/me`;
-};
-/**
-* Returns the current state of the current session including its factors and all currently
-satisfied assurance levels.
-
-`assurance_levels[]` may shrink over time as factor freshness windows expire,
-without the session itself expiring. Use step-up authentication (a new `auth_attempt`
-against the same `session_id`) to restore a dropped assurance level.
-
-* @summary Get my session state
-*/
-const getMySession = async (options) => {
-	return customFetch(getGetMySessionUrl(), {
-		...options,
-		method: "GET"
+const getListUserPasskeysUrl = (userId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
-};
-const getRevokeMySessionUrl = () => {
-	return `${getProxyPath()}/sessions/me`;
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/passkeys?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/passkeys`;
 };
 /**
-* Logs out by permanently deleting the session.
-
-The `__nextgen_session` cookie issued at creation (or superseded by a handoff
-exchange) is required. Idempotent: if the session is already gone this still
-returns 204. Any tokens derived from the session are invalidated, and the
-cookie itself is cleared in the response.
-
-* @summary Revoke my session
+* @summary List user passkeys
 */
-const revokeMySession = async (options) => {
-	return customFetch(getRevokeMySessionUrl(), {
+const listUserPasskeys = async (userId, params, options) => {
+	return customFetch(getListUserPasskeysUrl(userId, params), {
 		...options,
-		method: "DELETE"
+		method: "GET"
 	});
 };
-const getCreateSchemaUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas?${stringifiedParams}` : `${getProxyPath()}/schemas`;
+const getSetUserPasswordUrl = (userId) => {
+	return `${getProxyPath()}/users/${userId}/password`;
 };
 /**
-* Create a new schema. The optional `$id` field is the JSON Schema document
-URI used to identify the schema in future requests (GitOps-stable identity,
-not a free-form resource primary key). When `$id` is omitted, the server
-generates a `sch_*` URL. When provided, `$id` must be unique within the
-project and should ideally be a valid URI pointing at where the schema can
-be accessed.
-
-The schema can either be a concrete schema, e.g. a user schema, or a
-schema-url which will be resolved by the server.
-
-* @summary Create new schema
+* @summary Set user password
 */
-const createSchema = async (createSchemaBody, params, options) => {
-	return customFetch(getCreateSchemaUrl(params), {
+const setUserPassword = async (userId, setUserPasswordBody, options) => {
+	return customFetch(getSetUserPasswordUrl(userId), {
 		...options,
-		method: "POST",
+		method: "PUT",
 		headers: {
 			"Content-Type": "application/json",
 			...options?.headers
 		},
-		body: JSON.stringify(createSchemaBody)
+		body: JSON.stringify(setUserPasswordBody)
 	});
 };
-const getListSchemasUrl = (params) => {
+const getListUserTeamsUrl = (userId, params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas?${stringifiedParams}` : `${getProxyPath()}/schemas`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/teams?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/teams`;
 };
 /**
-* Retrieve a list of all schemas available in the system. This endpoint
-supports pagination and filtering based on schema attributes.
+* The user's team roster, ordered by team name. Each entry carries the
+team's name, so a client renders a page without resolving ids one by one.
+
+This is the N:N roster and it is not lifecycle ownership: the single team
+that owns the user's lifecycle is reported as `metadata.lifecycle_owner_team_id`
+on the user read endpoints. Memberships the user was removed from are not
+returned.
 
-* @summary List all schemas
+* @summary List the teams a user belongs to
 */
-const listSchemas = async (params, options) => {
-	return customFetch(getListSchemasUrl(params), {
+const listUserTeams = async (userId, params, options) => {
+	return customFetch(getListUserTeamsUrl(userId, params), {
 		...options,
 		method: "GET"
 	});
 };
-const getGetSchemaByIdUrl = (id, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas/${id}?${stringifiedParams}` : `${getProxyPath()}/schemas/${id}`;
+const getGetMyUserUrl = () => {
+	return `${getProxyPath()}/users/me`;
 };
 /**
-* Get a schema by its ID. This will return the default revision of the schema.
-* @summary Get schema by ID
+* @summary Get my user information
 */
-const getSchemaById = async (id, params, options) => {
-	return customFetch(getGetSchemaByIdUrl(id, params), {
+const getMyUser = async (options) => {
+	return customFetch(getGetMyUserUrl(), {
 		...options,
 		method: "GET"
 	});
 };
-const getCreateFlowDefinitionUrl = () => {
-	return `${getProxyPath()}/flow_definitions`;
+const getCreateFlowUrl = () => {
+	return `${getProxyPath()}/flow`;
 };
 /**
-* Creates a new flow definition.
-Flow definitions are templates that define the sequence of steps (capabilities)
-for a particular user journey (e.g., registration, login, password reset).
+* Resolves a flow definition based on purpose + audience context and returns
+the first capability step. Creates a new session implicitly unless
+`session_id` is provided (for step-up / reauth on an existing session).
 
-Flow definitions are created based on the flow definition schema, which includes the flow's purpose, audience, and the steps involved.
+The response contains an `id` field — the flow handle. Use it as the path
+parameter for all subsequent `/flow/{id}/submit` calls.
 
-* @summary Create a new flow definition
+The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
+the flow's orchestration state (current step, collected data, history).
+The server is stateless between requests — all flow state lives in this
+cookie. The browser sends it automatically on subsequent requests.
+
+* @summary Start a new flow
 */
-const createFlowDefinition = async (createFlowDefinitionBody, options) => {
-	return customFetch(getCreateFlowDefinitionUrl(), {
+const createFlow = async (createFlowBody, options) => {
+	return customFetch(getCreateFlowUrl(), {
 		...options,
 		method: "POST",
 		headers: {
 			"Content-Type": "application/json",
 			...options?.headers
 		},
-		body: JSON.stringify(createFlowDefinitionBody)
+		body: JSON.stringify(createFlowBody)
 	});
 };
-const getListFlowDefinitionsUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions?${stringifiedParams}` : `${getProxyPath()}/flow_definitions`;
+const getGetFlowStepUrl = (id) => {
+	return `${getProxyPath()}/flow/${id}`;
 };
 /**
-* Retrieves a list of all flow definitions.
-This endpoint can be used to view existing flow definitions and their configurations.
+* Returns the current capability step without advancing the state machine.
+Useful for page reloads or re-rendering after a network error.
 
-* @summary List flow definitions
+* @summary Get current step (re-render)
 */
-const listFlowDefinitions = async (params, options) => {
-	return customFetch(getListFlowDefinitionsUrl(params), {
+const getFlowStep = async (id, options) => {
+	return customFetch(getGetFlowStepUrl(id), {
 		...options,
 		method: "GET"
 	});
 };
-const getGetFlowDefinitionUrl = (id, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+const getSubmitFlowStepUrl = (id) => {
+	return `${getProxyPath()}/flow/${id}/submit`;
 };
 /**
-* Get a flow definition by id
-* @summary Get a flow definition by id
+* Submits user input for the current step. The server validates,
+processes (e.g., verifies a credential), advances the state machine
+through any invisible steps, and returns the next visible step.
+
+The response sets an updated encrypted `HttpOnly` cookie (`_zflow`)
+with the new flow state. The server is stateless — all orchestration
+state is carried in this cookie between requests.
+
+**Important:** The `id` in the response may differ from the `id` used in
+the request. This happens when a flow pivots (pushes a new flow onto the
+stack) or when a stacked flow completes (auto-pops to the parent flow).
+Always use the `id` from the latest response for the next request.
+
+## Flow completion
+
+When `step.type` is `complete`, the flow is terminal. The `step.behavior`
+field tells the frontend what to do:
+
+| `behavior`   | Action                                                     |
+|------------- |------------------------------------------------------------|
+| `redirect`   | Navigate to `redirect_uri` (OIDC/SAML auth request done). |
+| `show`       | Render the step as a success screen (e.g., registration).  |
+
+A `complete` step is only returned when the **entire flow stack** is done.
+If a stacked flow (e.g., recovery pivoted from login) finishes, the server
+auto-pops to the parent flow and returns the parent's next step — the
+frontend never sees a `complete` for intermediate flows.
+
+* @summary Submit step data and advance
 */
-const getFlowDefinition = async (id, params, options) => {
-	return customFetch(getGetFlowDefinitionUrl(id, params), {
+const submitFlowStep = async (id, submitFlowStepBody, options) => {
+	return customFetch(getSubmitFlowStepUrl(id), {
 		...options,
-		method: "GET"
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(submitFlowStepBody)
 	});
 };
-const getUpdateFlowDefinitionUrl = (id, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+const getCreateAuthAttemptUrl = () => {
+	return `${getProxyPath()}/auth_attempts`;
 };
 /**
-* Update a flow definition by id. This endpoint replaces the existing flow definition.
-If `flow_definition.status` is omitted, the current status is preserved
+* Starts a new authentication attempt. This is the entry point for the auth_attempts state machine.
 
-* @summary Update a flow definition by id
+An attempt is an ephemeral (15-minute TTL) state machine that drives a single authentication round.
+It accepts factor challenges, verifies proofs, and completes into a session or handoff token.
+
+Accepts a project_id and challenge_nonce (from POST /bootstrap/challenge). For step-up re-auth,
+also include session_id to add factors to an existing session.
+
+* @summary Create a new authentication attempt
 */
-const updateFlowDefinition = async (id, updateFlowDefinitionBody, params, options) => {
-	return customFetch(getUpdateFlowDefinitionUrl(id, params), {
+const createAuthAttempt = async (createAuthAttemptBody, options) => {
+	return customFetch(getCreateAuthAttemptUrl(), {
 		...options,
-		method: "PUT",
+		method: "POST",
 		headers: {
 			"Content-Type": "application/json",
 			...options?.headers
 		},
-		body: JSON.stringify(updateFlowDefinitionBody)
+		body: JSON.stringify(createAuthAttemptBody)
 	});
 };
-const getDeleteFlowDefinitionUrl = (id, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+const getGetAuthAttemptUrl = (attemptId) => {
+	return `${getProxyPath()}/auth_attempts/${attemptId}`;
 };
 /**
-* Delete a flow definition by id.
-If the flow definition is currently being used by a flow, the deletion will fail.
-If the flow definition is the last active flow definition for a given purpose, the deletion will fail to prevent disruption of new flows being started for that purpose.
+* Polls the current state of an authentication attempt.
 
-* @summary Delete a flow definition by id
+Returns the attempt's state, available factors for the next challenge,
+challenges issued so far, and any errors preventing progress.
+
+Use this for polling during long-running factor verifications (e.g., waiting for
+a federated IdP callback or a device flow).
+
+* @summary Get authentication attempt state
 */
-const deleteFlowDefinition = async (id, params, options) => {
-	return customFetch(getDeleteFlowDefinitionUrl(id, params), {
+const getAuthAttempt = async (attemptId, options) => {
+	return customFetch(getGetAuthAttemptUrl(attemptId), {
 		...options,
-		method: "DELETE"
+		method: "GET"
 	});
 };
-const getCreateTeamUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams?${stringifiedParams}` : `${getProxyPath()}/teams`;
+const getIssueChallengeUrl = (attemptId) => {
+	return `${getProxyPath()}/auth_attempts/${attemptId}/challenges`;
 };
 /**
-* @summary Create team
+* Issues a single-factor verification challenge within an auth attempt.
+
+This advances the authentication state machine by requesting a specific factor method
+(password, passkey, TOTP, OTP via SMS, etc.). The server responds with challenge details
+including method, metadata, and any UI hints. The client then verifies the proof
+by calling POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.
+
+* @summary Issue a factor challenge
 */
-const createTeam = async (createTeamBody, params, options) => {
-	return customFetch(getCreateTeamUrl(params), {
+const issueChallenge = async (attemptId, issueChallengeBody, options) => {
+	return customFetch(getIssueChallengeUrl(attemptId), {
 		...options,
 		method: "POST",
 		headers: {
 			"Content-Type": "application/json",
 			...options?.headers
 		},
-		body: JSON.stringify(createTeamBody)
+		body: JSON.stringify(issueChallengeBody)
 	});
 };
-const getQueryTeamsUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/query?${stringifiedParams}` : `${getProxyPath()}/teams/query`;
+const getVerifyChallengeProofUrl = (attemptId, challengeId) => {
+	return `${getProxyPath()}/auth_attempts/${attemptId}/challenges/${challengeId}/verify`;
 };
 /**
-* Returns the teams of a project, paginated with a cursor.
-Teams of every lifecycle status are returned; each carries its `status`.
+* Submits a proof (credential, code, assertion) to verify a factor challenge.
 
-* @summary Query teams
+The proof format depends on the challenge method. For example:
+- `password` method: { password: "…" }
+- `totp` method: { totp: { code: "123456" } }
+- `passkey` method: { passkey: { assertion: "…" } }
+- `recovery_code` method: { recovery_code: "…" }
+
+On successful verification, the factor is written to the auth attempt.
+The attempt moves to the next pending challenge or completes if all required factors are verified.
+
+* @summary Verify a factor proof
 */
-const queryTeams = async (queryTeamsBody, params, options) => {
-	return customFetch(getQueryTeamsUrl(params), {
+const verifyChallengeProof = async (attemptId, challengeId, verifyChallengeProofBody, options) => {
+	return customFetch(getVerifyChallengeProofUrl(attemptId, challengeId), {
 		...options,
 		method: "POST",
 		headers: {
 			"Content-Type": "application/json",
 			...options?.headers
 		},
-		body: JSON.stringify(queryTeamsBody)
-	});
-};
-const getGetTeamUrl = (teamId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}` : `${getProxyPath()}/teams/${teamId}`;
-};
-/**
-* Returns a Team by its id.
-
-* @summary Get team
-*/
-const getTeam = async (teamId, params, options) => {
-	return customFetch(getGetTeamUrl(teamId, params), {
-		...options,
-		method: "GET"
+		body: JSON.stringify(verifyChallengeProofBody)
 	});
 };
-const getDeleteTeamUrl = (teamId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}` : `${getProxyPath()}/teams/${teamId}`;
+const getCreateHandoffUrl = (attemptId) => {
+	return `${getProxyPath()}/auth_attempts/${attemptId}/handoff`;
 };
 /**
-* Deactivates the team.
+* Completes the authentication attempt and mints a `handoff_token`.
 
-The team is tombstoned rather than erased: it stays readable through
-getTeam with status `deactivated`. Its memberships are removed and the
-users whose lifecycle it owns are deactivated with it.
+Call this after all required factors have been verified and the attempt is in `completed` state.
+The handoff token is short-lived (≤60 seconds) and must be exchanged at
+POST /sessions/exchange to receive the final session and session_token.
 
-The request is idempotent. Deleting a team that is already deactivated
-or doesn't exist succeeds without changing anything.
+The handoff token is:
+- Single-use (atomic exchange, no retry)
+- Audience-bound (requires matching project key for exchange)
+- Idempotency-safe within a 5-minute window (see conventions)
 
-* @summary Delete team
+* @summary Complete authentication and create handoff token
 */
-const deleteTeam = async (teamId, params, options) => {
-	return customFetch(getDeleteTeamUrl(teamId, params), {
+const createHandoff = async (attemptId, options) => {
+	return customFetch(getCreateHandoffUrl(attemptId), {
 		...options,
-		method: "DELETE"
+		method: "POST"
 	});
 };
-const getUpdateTeamUrl = (teamId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}` : `${getProxyPath()}/teams/${teamId}`;
+const getCreateProjectUrl = () => {
+	return `${getProxyPath()}/projects`;
 };
 /**
-* Update team. Only active teams can be updated.
-
-* @summary Update team
+* @summary Create project
 */
-const updateTeam = async (teamId, updateTeamBody, params, options) => {
-	return customFetch(getUpdateTeamUrl(teamId, params), {
+const createProject = async (createProjectBody, options) => {
+	return customFetch(getCreateProjectUrl(), {
 		...options,
-		method: "PATCH",
+		method: "POST",
 		headers: {
 			"Content-Type": "application/json",
 			...options?.headers
 		},
-		body: JSON.stringify(updateTeamBody)
+		body: JSON.stringify(createProjectBody)
 	});
 };
-const getCreateBrandingUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+const getQueryProjectsUrl = () => {
+	return `${getProxyPath()}/projects/query`;
+};
+/**
+* @summary Query projects
+*/
+const queryProjects = async (queryProjectsBody, options) => {
+	return customFetch(getQueryProjectsUrl(), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(queryProjectsBody)
 	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/branding?${stringifiedParams}` : `${getProxyPath()}/branding`;
+};
+const getGetProjectUrl = (projectId) => {
+	return `${getProxyPath()}/projects/${projectId}`;
 };
 /**
-* Publishes a new immutable branding revision for the project. Branding
-revisions cannot be updated or deleted; every edit publishes a new
-revision, and flow responses resolve the latest revision per project
-(see ADR 040).
+* Returns the current state of a project.
 
-The `liquid_template` is validated lexically on save (size, encoding,
-banned patterns such as `<script>` tags, inline event handlers, and the
-`| raw` filter). Authoritative LiquidJS validation runs at authoring
-time via `zitadel plan` / `zitadel apply`.
+* @summary Get project
+*/
+const getProject = async (projectId, options) => {
+	return customFetch(getGetProjectUrl(projectId), {
+		...options,
+		method: "GET"
+	});
+};
+const getPatchProjectUrl = (projectId) => {
+	return `${getProxyPath()}/projects/${projectId}`;
+};
+/**
+* Updates the state of a project.
 
-* @summary Publish a new branding revision
+* @summary Update project
 */
-const createBranding = async (createBrandingBody, params, options) => {
-	return customFetch(getCreateBrandingUrl(params), {
+const patchProject = async (projectId, patchProjectBody, options) => {
+	return customFetch(getPatchProjectUrl(projectId), {
 		...options,
-		method: "POST",
+		method: "PATCH",
 		headers: {
 			"Content-Type": "application/json",
 			...options?.headers
 		},
-		body: JSON.stringify(createBrandingBody)
+		body: JSON.stringify(patchProjectBody)
 	});
 };
-const getListBrandingUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/branding?${stringifiedParams}` : `${getProxyPath()}/branding`;
+const getInitClaimUrl = (projectId) => {
+	return `${getProxyPath()}/projects/${projectId}/claim/init`;
 };
 /**
-* Lists branding revisions for the project, newest first, capped at the
-100 most recent. The first entry is the revision flow responses
-currently resolve. Deliberately unpaginated in v1 — list endpoints
-gain a real query mechanism together (ADR 031); advertising pagination
-parameters the server ignores would be worse than none.
+* Starts a claim challenge for an unclaimed project. Authenticated by the
+project secret, this mints a single-use, short-lived challenge and returns
+the `claim_url` the developer opens in a browser to complete the claim,
+together with the `challenge_id` the CLI polls with. The exact expiry is
+carried by `expires_at` on the response.
 
-* @summary List branding revisions
+* @summary Initialize a project claim
 */
-const listBranding = async (params, options) => {
-	return customFetch(getListBrandingUrl(params), {
+const initClaim = async (projectId, options) => {
+	return customFetch(getInitClaimUrl(projectId), {
 		...options,
-		method: "GET"
+		method: "POST"
 	});
 };
-const getGetBrandingByIdUrl = (id, params) => {
+const getGetClaimStatusUrl = (projectId, params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/branding/${id}?${stringifiedParams}` : `${getProxyPath()}/branding/${id}`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/projects/${projectId}/claim/status?${stringifiedParams}` : `${getProxyPath()}/projects/${projectId}/claim/status`;
 };
 /**
-* Retrieves a single branding revision, including its stored configuration.
-* @summary Get a branding revision by ID
+* Polled by the CLI while a browser completes the claim. Authorized by the
+project secret that initiated the challenge. Returns `pending`, or
+`completed` with the owning team, the claim timestamp, and the dashboard
+URL once the browser leg has finished.
+
+* @summary Get claim status
 */
-const getBrandingById = async (id, params, options) => {
-	return customFetch(getGetBrandingByIdUrl(id, params), {
+const getClaimStatus = async (projectId, params, options) => {
+	return customFetch(getGetClaimStatusUrl(projectId, params), {
 		...options,
 		method: "GET"
 	});
 };
-//#endregion
-//#region ../api/dist/runtime/api-factory.mjs
-/**
-* Factory for the typed Zitadel client every consumer reaches for.
-*
-* Wraps the orval-generated endpoints in a {@link Proxy} so each
-* generated function sees the right base URL and (optionally) the
-* right bearer token at call time — without the caller having to
-* thread either through every operation, and without exposing the
-* module-globals (`setProxyPath` / `setApiAuthToken`) as part of the
-* public API.
-*
-* Per-instance isolation: multiple clients can coexist in one process
-* (different servers, different tokens). Their Proxy `get` traps set
-* the globals synchronously before invoking the underlying generated
-* function, which reads them at the top of `customFetch` before any
-* `await`. Two clients running interleaved within a single JS turn
-* are safe; two clients running in parallel across awaits could
-* clobber each other — not a pattern any current consumer uses.
-*/
-/**
-* Build a typed Zitadel client pre-bound to a base URL and (optionally)
-* a bearer token. Every method on the returned object mirrors a
-* generated orval function:
-*
-*     const client = createZitadelClient({ baseUrl, token });
-*     await client.createProject({ preview_origins: [] });
-*     await client.createSchema(body, { project_id });
-*/
-function createZitadelClient(opts) {
-	let baseUrl = opts.baseUrl;
-	while (baseUrl.endsWith("/")) baseUrl = baseUrl.slice(0, -1);
-	return new Proxy(zitadelNextGen_exports, { get(target, prop, receiver) {
-		const value = Reflect.get(target, prop, receiver);
-		if (typeof value !== "function") return value;
-		return (...args) => {
-			setProxyPath(baseUrl);
-			setApiAuthToken(opts.token);
-			return value(...args);
-		};
-	} });
-}
-//#endregion
-//#region ../api/dist/runtime/config.mjs
-/**
-* Slot for the configured project, stored on `globalThis` under a
-* {@link Symbol.for} key. Every copy of this module evaluated in the
-* same JS realm resolves the symbol through the global symbol registry
-* to the same identity, so they all read and write a single slot —
-* needed because the standalone components bundle inlines its own copy
-* of this file, and dual-package hazards / monorepo duplicates can load
-* a second copy alongside the app's. With a module-local `let` each
-* instance kept its own singleton and `configureZitadel()` calls in one
-* were invisible to `getZitadelConfig()` calls in another. Sharing is
-* realm-scoped — separate realms (iframes, Node `vm` contexts, worker
-* threads) have their own registries and are not unified by this.
-*/
-const PROJECT_SLOT = Symbol.for("@zitadel/api/config:currentProject");
-function readSlot() {
-	return globalThis[PROJECT_SLOT] ?? null;
-}
-/**
-* Per-project API client cache. Ensures `getApi(project)` returns the
-* same instance for the same project handle — no re-wrapping on every call.
-* Module-local on purpose: keyed by the shared frozen `ZitadelProject`
-* object identity, so cross-instance reads still resolve through the
-* same key and at worst memoize once per module instance.
-*/
-const apiCache = /* @__PURE__ */ new WeakMap();
-/**
-* Returns a typed API client for the given project, with the base URL
-* pre-bound. Cached per project handle — safe to call multiple times.
-*
-* ```ts
-* const project = configureZitadel({ ... });
-* export const api = getApi(project);
-* ```
-*/
-function getApi(project) {
-	let api = apiCache.get(project);
-	if (!api) {
-		api = createZitadelClient({
-			baseUrl: project.proxyPath,
-			token: project.publishableKey
-		});
-		apiCache.set(project, api);
-	}
-	return api;
-}
-/**
-* Returns the current project handle, or `null` if {@link configureZitadel}
-* has not been called yet.
-*/
-function getZitadelConfig() {
-	return readSlot();
-}
-//#endregion
-//#region src/orchestrator/resolve-api.ts
-/** Matches the `configureZitadel()` default so attribute and JS config agree. */
-const DEFAULT_PROXY_PATH = "/__nextgen";
-/**
-* Cache of project handles synthesized from attributes, keyed by their value
-* tuple. `getApi()` caches its client in a `WeakMap` keyed by the project's
-* identity, so the same attribute values must yield the *same* frozen object
-* across the several `resolveApi()` calls a single flow makes — otherwise
-* every call misses the cache and re-wraps a fresh client. A real page uses a
-* handful of distinct configs at most; the FIFO bound below is just a guard so
-* a pathological page that churns through unique configs can't leak memory.
-*/
-const MAX_SYNTHETIC_PROJECTS = 32;
-const syntheticProjects = /* @__PURE__ */ new Map();
-/**
-* Builds a `ZitadelProject` from declarative attributes, or `undefined` when
-* no `project-id` was given (nothing to configure). Mirrors
-* `configureZitadel()`'s proxy-path defaulting so the two config paths are
-* interchangeable.
-*/
-function projectFromAttrs({ projectId, proxyPath, url }) {
-	if (!projectId) return void 0;
-	const resolvedProxyPath = proxyPath || DEFAULT_PROXY_PATH;
-	const resolvedUrl = url || void 0;
-	const key = JSON.stringify([
-		projectId,
-		resolvedProxyPath,
-		resolvedUrl ?? ""
-	]);
-	let project = syntheticProjects.get(key);
-	if (!project) {
-		project = Object.freeze({
-			projectId,
-			proxyPath: resolvedProxyPath,
-			url: resolvedUrl
-		});
-		if (syntheticProjects.size >= MAX_SYNTHETIC_PROJECTS) {
-			const oldest = syntheticProjects.keys().next().value;
-			if (oldest !== void 0) syntheticProjects.delete(oldest);
-		}
-		syntheticProjects.set(key, project);
-	}
-	return project;
-}
+const getCompleteClaimUrl = (projectId) => {
+	return `${getProxyPath()}/projects/${projectId}/claim/complete`;
+};
 /**
-* Resolves the effective SDK project handle and its typed API client for an
-* orchestrator element. Precedence, highest first:
-*
-* 1. the element's `project` property (an SDK handle set from JS / a framework),
-* 2. the global handle from `configureZitadel()`,
-* 3. the `project-id` / `proxy-path` / `url` attributes set declaratively in HTML.
-*
-* Both JS paths (property and global) win over the declarative attributes, so a
-* deliberate `configureZitadel()` is never silently overridden by fallback or
-* stale HTML attributes; the attributes are the no-JS fallback.
-*
-* Both `<zitadel-login>` and `<zitadel-logout>` need the same resolution and
-* the same "no config" failure, so it lives here rather than being copied
-* into each element. Callers run this inside their try/catch so a missing
-* configuration surfaces through the element's normal error path rather than
-* as an unhandled rejection.
-*
-* @param project Optional per-element override handle.
-* @param attrs Declarative config read from the element's attributes.
-* @param element Tag name used in the thrown error (e.g. `<zitadel-login>`).
+* Called by the browser after the developer authenticates on the claim page.
+Authenticated by the `__nextgen_session` cookie, it attaches the project to
+the developer's personal team using the `challenge_id` from the claim URL as
+its single-use, browser-safe authorization.
+
+* @summary Complete a project claim
 */
-function resolveApi(project, attrs, element) {
-	const cfg = project ?? getZitadelConfig() ?? projectFromAttrs(attrs);
-	if (!cfg) throw new Error(`${element} requires a configured project: set the \`project-id\` attribute, set the \`project\` property, or call configureZitadel().`);
-	return {
-		project: cfg,
-		api: getApi(cfg)
-	};
-}
-//#endregion
-//#region ../api/dist/generated/model/index.mjs
-const CreateFlow201BrandingLayout = {
-	centered: "centered",
-	split: "split"
+const completeClaim = async (projectId, completeClaimBody, options) => {
+	return customFetch(getCompleteClaimUrl(projectId), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(completeClaimBody)
+	});
+};
+const getCreateSessionUrl = () => {
+	return `${getProxyPath()}/sessions`;
 };
-//#endregion
-//#region src/orchestrator/branding-validator.ts
 /**
-* Lightweight paint-time validator for `Branding` payloads.
-*
-* Per `docs/design/branding/schema.md` §Shape invariants:
-*
-* 1. Every referenced URL is https.
-* 2. `layout` is in the documented enum.
-* 3. `liquid_template` shape checks happen elsewhere (security pipeline runs
-*    server-side; structural validator is deferred until the full atom set
-*    lands).
-*
-* Failures are non-fatal: we collect issues, log a dev-build warning, and
-* return a sanitised payload with the offending fields stripped (set to
-* `undefined`) so the orchestrator falls back to the bundled defaults.
+* Creates an anonymous session shell with no user and no factors (`state: building`).
+
+This is optional — an `auth_attempt` will create a session implicitly if none is provided.
+Use this explicitly when you want to:
+- Pre-allocate a `session_id` before the user is known, so device/telemetry signals
+can be correlated with the eventual authenticated session from the start.
+- Track anonymous state (bot detection, device fingerprint) that survives until authentication.
+
+Creating a session is an app-plane operation on the project credential
+(`session.write`). The returned `session_token` is a session credential for the
+end-user client, not a management scope: it is delivered as the
+`__nextgen_session` cookie and authorises the self-service operations
+`GET /sessions/me` and `DELETE /sessions/me` (`nextgenSession` scheme). The
+by-id operations `GET /sessions/{session_id}` and `DELETE /sessions/{session_id}`
+are operator endpoints and require `session.read` / `session.delete` instead.
+
+The `session_token` is superseded when a handoff exchange completes — clients must
+replace it at that point.
+
+Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
+full session TTL when the first authentication factor is written via a completing `auth_attempt`.
+
+* @summary Create an anonymous session shell
 */
-const VALID_LAYOUTS = new Set(Object.values(CreateFlow201BrandingLayout));
-function validateBranding(input) {
-	if (!input) return {
-		branding: void 0,
-		issues: []
-	};
-	const issues = [];
-	const out = { ...input };
-	if (out.layout && !VALID_LAYOUTS.has(out.layout)) {
-		issues.push(`Unknown layout "${out.layout}" — falling back to "centered".`);
-		out.layout = CreateFlow201BrandingLayout.centered;
-	}
-	out.logo_url = sanitiseUrl(out.logo_url, "logo_url", issues);
-	out.font_url = sanitiseUrl(out.font_url, "font_url", issues);
-	out.hero_url = sanitiseUrl(out.hero_url, "hero_url", issues);
-	if (out.assets) out.assets = {
-		logo_dark: sanitiseUrl(out.assets.logo_dark, "assets.logo_dark", issues),
-		favicon: sanitiseUrl(out.assets.favicon, "assets.favicon", issues),
-		background_image: sanitiseUrl(out.assets.background_image, "assets.background_image", issues)
-	};
-	return {
-		branding: out,
-		issues
-	};
-}
-function sanitiseUrl(value, field, issues) {
-	if (value == null || value === "") return;
-	try {
-		const parsed = new URL(value);
-		if (parsed.protocol !== "https:") {
-			issues.push(`${field} must use https (got "${parsed.protocol}") — dropped.`);
-			return;
-		}
-		return parsed.toString();
-	} catch {
-		issues.push(`${field} is not a valid URL — dropped.`);
-		return;
-	}
-}
-//#endregion
-//#region src/orchestrator/exportparts.ts
+const createSession = async (createSessionBody, options) => {
+	return customFetch(getCreateSessionUrl(), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createSessionBody)
+	});
+};
+const getQuerySessionsUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/query?${stringifiedParams}` : `${getProxyPath()}/sessions/query`;
+};
 /**
-* Forwards atom-internal CSS Shadow Parts through the orchestrator boundary.
-*
-* Atoms stamp `part="..."` on their internals and declare the public set in
-* their manifest (`parts`). Those parts are visible one shadow boundary up —
-* inside the orchestrator's shadow root — but not to the embedding page,
-* because `::part()` pierces a single boundary unless each host in the chain
-* re-exports (`exportparts`). Templates never author the forwarding (the
-* sanitiser strips `exportparts`); the orchestrator stamps it after every
-* render commit so the mapping stays canonical for template-rendered and
-* gate-patched atoms alike.
-*
-* Exported names are mechanical, collision-free, and public contract
-* (override-ladder Tier 2, same stability rules as token names):
-* `<atom>-<part>` with the `zl-` prefix dropped — `zl-field`'s `input` part
-* becomes `zitadel-login::part(field-input)` on the host page. Manifests are
-* the canonical part catalogue; this module derives, never curates.
+* Returns the sessions of a project, paginated with a cursor.
+Sessions of every lifecycle state are returned; each carries its `state`.
+Requires `session.read` permission.
+
+* @summary Query sessions
 */
-const exportpartsByTag = new Map(manifestRegistry.filter((manifest) => manifest.parts.length > 0).map((manifest) => {
-	const short = manifest.tag.replace(/^zl-/, "");
-	const value = manifest.parts.map((part) => `${part}: ${short}-${part}`).join(", ");
-	return [manifest.tag, value];
-}));
+const querySessions = async (querySessionsBody, params, options) => {
+	return customFetch(getQuerySessionsUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(querySessionsBody)
+	});
+};
+const getExchangeHandoffUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/exchange?${stringifiedParams}` : `${getProxyPath()}/sessions/exchange`;
+};
 /**
-* Stamps `exportparts` onto every known atom in `scope`. Idempotent — call
-* after each render commit: `unsafeHTML` re-parses replace previously
-* stamped nodes, and the mandatory-gates patcher appends atoms after
-* sanitisation.
+* Consumes a one-time `handoff_token` minted by `POST /auth_attempts/{id}/handoff`
+and returns the resulting session and a `session_token`.
+
+The server resolves the originating `auth_attempt` from the token and then:
+
+| Originating auth_attempt | Outcome |
+|---|---|
+| No `session_id` | A new authenticated session is **created**. |
+| `session_id` points to an anonymous shell | Existing session is **upgraded** — user and factors written in, TTL reset to full session TTL. |
+| `session_id` points to an active session (step-up) | Existing session is **upgraded** — new factors merged, `assurance_levels[]` expanded. |
+
+The response shape is identical in all three cases.
+
+The `session_token` supersedes any previously issued `session_token` for the same session.
+Clients must replace their stored token at this point.
+
+Requires a project service key (OAuth2 client credentials).
+
+* @summary Exchange handoff token for a session
 */
-function stampExportparts(scope) {
-	for (const [tag, value] of exportpartsByTag) for (const el of scope.querySelectorAll(tag)) if (el.getAttribute("exportparts") !== value) el.setAttribute("exportparts", value);
-}
-//#endregion
-//#region src/internal/escape-html.ts
+const exchangeHandoff = async (exchangeHandoffBody, params, options) => {
+	return customFetch(getExchangeHandoffUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(exchangeHandoffBody)
+	});
+};
+const getGetSessionUrl = (sessionId) => {
+	return `${getProxyPath()}/sessions/${sessionId}`;
+};
 /**
-* Escapes the five HTML-significant characters so a string is safe to
-* interpolate into either element text or a double-quoted attribute value.
-*
-* Used for the orchestrator-owned attribution markup, which is appended after
-* the Liquid output has already been sanitised — so it can't rely on the
-* DOMPurify pass and must escape its own (tenant-supplied) values.
+* Returns the current state of a session including its factors and all currently
+satisfied assurance levels.
+
+`assurance_levels[]` may shrink over time as factor freshness windows expire,
+without the session itself expiring. Use step-up authentication (a new `auth_attempt`
+against the same `session_id`) to restore a dropped assurance level.
+
+* @summary Get session state
+*/
+const getSession = async (sessionId, options) => {
+	return customFetch(getGetSessionUrl(sessionId), {
+		...options,
+		method: "GET"
+	});
+};
+const getRevokeSessionUrl = (sessionId) => {
+	return `${getProxyPath()}/sessions/${sessionId}`;
+};
+/**
+* Permanently deletes the session, terminating it immediately.
+
+This is the operator revoke path and requires the `session.delete` scope on a
+project-bound credential. End-user logout with the `__nextgen_session` cookie is
+`DELETE /sessions/me` (`nextgenSession` scheme).
+
+Idempotent: deleting a session that does not exist (or was already deleted)
+still returns 204. After deletion, any tokens derived from the session are
+invalidated.
+
+* @summary Revoke session
 */
-function escapeHtml(value) {
-	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-//#endregion
-//#region src/orchestrator/mandatory-gates.ts
-const MANDATORY_GATES_MARKER = "ZL_MANDATORY_GATES";
-/** Every atom tag that participates as a named form field. */
-const FIELD_ATOM_TAGS = "zl-field, zl-select, zl-checkbox";
-const mandatoryGatesMarkerComment = `<!--${MANDATORY_GATES_MARKER}-->`;
-function patchMandatoryGates(html, step, locale) {
-	const template = document.createElement("template");
-	template.innerHTML = html;
-	const fragment = template.content;
-	const additions = collectMissingAtoms(fragment, step, locale);
-	const marker = findMarkerComment(fragment);
-	if (marker?.parentNode) {
-		for (const node of additions) marker.parentNode.insertBefore(node, marker);
-		marker.remove();
-	} else for (const node of additions) fragment.appendChild(node);
-	return template.innerHTML;
-}
-function collectMissingAtoms(fragment, step, locale) {
-	const additions = [];
-	if (step.fields) for (const field of step.fields) {
-		if (!field.required) continue;
-		if (hasFieldFor(fragment, field.name)) continue;
-		additions.push(buildField(field.name, field.text_key, field.type, locale, field.required));
-	}
-	if (step.actions && !hasPrimaryButton(fragment)) {
-		const primary = step.actions.find((action) => action.primary);
-		if (primary) additions.push(buildSubmit(primary.name, primary.text_key, locale));
-	}
-	return additions;
-}
-function hasPrimaryButton(fragment) {
-	return Boolean(fragment.querySelector("zl-button[hierarchy=\"primary\"]"));
-}
-function hasFieldFor(fragment, name) {
-	for (const field of fragment.querySelectorAll(FIELD_ATOM_TAGS)) if (field.getAttribute("name") === name) return true;
-	return false;
-}
-function findMarkerComment(fragment) {
-	const walker = (fragment.ownerDocument ?? document).createTreeWalker(fragment, NodeFilter.SHOW_COMMENT);
-	let node = walker.nextNode();
-	while (node) {
-		if (node.nodeValue?.trim() === "ZL_MANDATORY_GATES") return node;
-		node = walker.nextNode();
-	}
-	return null;
-}
-function buildField(name, textKey, type, locale, required) {
-	const el = document.createElement("zl-field");
-	el.setAttribute("name", name);
-	el.setAttribute("label", lookup(locale, textKey ?? name));
-	el.setAttribute("type", type);
-	if (required) el.setAttribute("required", "");
-	return el;
-}
-function buildSubmit(name, textKey, locale) {
-	const el = document.createElement("zl-button");
-	el.setAttribute("hierarchy", "primary");
-	el.setAttribute("size", "medium");
-	el.setAttribute("type", "submit");
-	el.setAttribute("block", "");
-	el.setAttribute("action", name);
-	el.setAttribute("label", lookup(locale, textKey ?? "submit.continue"));
-	return el;
-}
-function lookup(locale, key) {
-	return locale[key] ?? key;
-}
-//#endregion
-//#region src/orchestrator/liquid.ts
+const revokeSession = async (sessionId, options) => {
+	return customFetch(getRevokeSessionUrl(sessionId), {
+		...options,
+		method: "DELETE"
+	});
+};
+const getGetMySessionUrl = () => {
+	return `${getProxyPath()}/sessions/me`;
+};
 /**
-* LiquidJS engine factory for the `<zitadel-login>` orchestrator.
-*
-* Configures the engine per the security pipeline in
-* `docs/design/flowengine/template-security.md` and registers the
-* `| t` filter and `{% mandatory_gates %}` tag from
-* `docs/design/branding/templates.md`.
-*
-* Hard rules:
-*
-* - `{{ }}` output is HTML-escaped (LiquidJS default since v10).
-* - The `| raw` filter is overridden to a no-op string passthrough that still
-*   escapes (Layer 1 of the security pipeline).
-* - Partials are loaded from an in-memory map; no filesystem access.
+* Returns the current state of the current session including its factors and all currently
+satisfied assurance levels.
+
+`assurance_levels[]` may shrink over time as factor freshness windows expire,
+without the session itself expiring. Use step-up authentication (a new `auth_attempt`
+against the same `session_id`) to restore a dropped assurance level.
+
+* @summary Get my session state
 */
-const TEMPLATE_NAMES$1 = { default: "default" };
+const getMySession = async (options) => {
+	return customFetch(getGetMySessionUrl(), {
+		...options,
+		method: "GET"
+	});
+};
+const getRevokeMySessionUrl = () => {
+	return `${getProxyPath()}/sessions/me`;
+};
 /**
-* Maps catalog `error.*` keys with no `_<rule>` suffix (so
-* {@link localiseFlowErrorKeys} can't derive the field from the key itself)
-* to their field name — the credential errors with bespoke catalog copy
-* (`error.email_exists`, `error.invalid_credentials`, …). Rule-suffixed keys
-* (`error.<field>_<rule>`) derive their field from the key. Consumed only by
-* {@link localiseFlowErrorKeys}, which stamps the resolved `field` onto the
-* error; the template filters (`fieldError` / `formLevelError`) then route by
-* that `field`, and an error whose field the step omits is downgraded to a
-* fieldless banner message.
+* Logs out by permanently deleting the session.
+
+The `__nextgen_session` cookie issued at creation (or superseded by a handoff
+exchange) is required. Idempotent: if the session is already gone this still
+returns 204. Any tokens derived from the session are invalidated, and the
+cookie itself is cleared in the response.
+
+* @summary Revoke my session
 */
-const fieldErrorKeys = {
-	"error.email_required": "email",
-	"error.email_invalid": "email",
-	"error.email_exists": "email",
-	"error.password_required": "password",
-	"error.password_incorrect": "password",
-	"error.invalid_credentials": "password"
+const revokeMySession = async (options) => {
+	return customFetch(getRevokeMySessionUrl(), {
+		...options,
+		method: "DELETE"
+	});
 };
-function createLiquidEngine(options) {
-	const engine = new Liquid({
-		templates: {
-			[TEMPLATE_NAMES$1.default]: default_default,
-			...options.templates ?? {}
-		},
-		cache: true,
-		jsTruthy: true,
-		relativeReference: false,
-		strictFilters: false,
-		strictVariables: false,
-		outputEscape: "escape"
+const getCreateSchemaUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
-	engine.registerFilter("raw", (value) => stringify(value));
-	const warnedMissingKeys = /* @__PURE__ */ new Set();
-	engine.registerFilter("t", function tFilter(key, ...args) {
-		const lookupKey = stringify(key);
-		let template = options.locale[lookupKey] ?? injectedKeyFallback(options.locale, lookupKey) ?? fieldLabelFallback(lookupKey);
-		if (template === void 0) {
-			template = lookupKey;
-			if (lookupKey !== "" && !warnedMissingKeys.has(lookupKey)) {
-				warnedMissingKeys.add(lookupKey);
-				console.warn(`[zitadel-login] missing text key "${lookupKey}" — rendering the raw key`);
-			}
-		}
-		return interpolate(template, args.map(stringify));
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas?${stringifiedParams}` : `${getProxyPath()}/schemas`;
+};
+/**
+* Create a new schema. The optional `$id` field is the JSON Schema document
+URI used to identify the schema in future requests (GitOps-stable identity,
+not a free-form resource primary key). When `$id` is omitted, the server
+generates a `sch_*` URL. When provided, `$id` must be unique within the
+project and should ideally be a valid URI pointing at where the schema can
+be accessed.
+
+The schema can either be a concrete schema, e.g. a user schema, or a
+schema-url which will be resolved by the server.
+
+* @summary Create new schema
+*/
+const createSchema = async (createSchemaBody, params, options) => {
+	return customFetch(getCreateSchemaUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createSchemaBody)
 	});
-	/** Resolves `{text_key}.placeholder` — empty when undefined (not the raw key). */
-	engine.registerFilter("fieldPlaceholder", (textKey) => {
-		const lookupKey = `${stringify(textKey)}.placeholder`;
-		return options.locale[lookupKey] ?? "";
+};
+const getListSchemasUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
-	/** Resolves `{text_key}.help` — empty when undefined. */
-	engine.registerFilter("fieldHelp", (textKey) => {
-		const lookupKey = `${stringify(textKey)}.help`;
-		return options.locale[lookupKey] ?? "";
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas?${stringifiedParams}` : `${getProxyPath()}/schemas`;
+};
+/**
+* Retrieve a list of all schemas available in the system. This endpoint
+supports pagination and filtering based on schema attributes.
+
+* @summary List all schemas
+*/
+const listSchemas = async (params, options) => {
+	return customFetch(getListSchemasUrl(params), {
+		...options,
+		method: "GET"
 	});
-	/**
-	* Builds `<zl-select>` options from a field's closed `validation.enum`. The
-	* wire only carries the allowed values (strings), so the label defaults to the
-	* value — author the enum with display-ready text. Piped through `| json` into
-	* the element's `options` attribute.
-	*/
-	engine.registerFilter("selectOptions", (values) => {
-		if (!Array.isArray(values)) return [];
-		return values.map((value) => {
-			const v = stringify(value);
-			return {
-				value: v,
-				label: v
-			};
-		});
+};
+const getGetSchemaByIdUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
-	/** Resolves `{text_key}.title` for form-level `<zl-alert heading>`. */
-	engine.registerFilter("alertHeading", (textKey) => {
-		const lookupKey = `${stringify(textKey)}.title`;
-		return options.locale[lookupKey] ?? "";
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas/${id}?${stringifiedParams}` : `${getProxyPath()}/schemas/${id}`;
+};
+/**
+* Get a schema by its ID. This will return the default revision of the schema.
+* @summary Get schema by ID
+*/
+const getSchemaById = async (id, params, options) => {
+	return customFetch(getGetSchemaByIdUrl(id, params), {
+		...options,
+		method: "GET"
 	});
-	/** Resolves `{text_key}.body` for form-level `<zl-alert>` message slot. */
-	engine.registerFilter("alertBody", (textKey) => {
-		const lookupKey = `${stringify(textKey)}.body`;
-		return options.locale[lookupKey] ?? "";
+};
+const getCreateFlowDefinitionUrl = () => {
+	return `${getProxyPath()}/flow_definitions`;
+};
+/**
+* Creates a new flow definition.
+Flow definitions are templates that define the sequence of steps (capabilities)
+for a particular user journey (e.g., registration, login, password reset).
+
+Flow definitions are created based on the flow definition schema, which includes the flow's purpose, audience, and the steps involved.
+
+* @summary Create a new flow definition
+*/
+const createFlowDefinition = async (createFlowDefinitionBody, options) => {
+	return customFetch(getCreateFlowDefinitionUrl(), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createFlowDefinitionBody)
 	});
-	/** Localized inline error for `fieldName`, or empty when none applies. */
-	engine.registerFilter("fieldError", (fieldName, errors) => {
-		const name = stringify(fieldName);
-		if (!Array.isArray(errors)) return "";
-		for (const item of errors) {
-			const err = item;
-			if (err.field !== name) continue;
-			return err.text_key ? options.locale[err.text_key] ?? err.text_key : err.message ?? "";
-		}
-		return "";
+};
+const getListFlowDefinitionsUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
-	/**
-	* Automation-hook token for a field name: strips the
-	* `x-auth-methods#` credential prefix so testids stay method-named
-	* (`zitadel-field-password`), while the `name` attribute keeps the
-	* raw wire key. See hookName for the contract.
-	*/
-	engine.registerFilter("testid", (fieldName) => hookName(stringify(fieldName)));
-	/**
-	* True when the error should render as `<zl-alert>`, not on a field. A
-	* field-scoped error (`field` set by {@link localiseFlowErrorKeys} when the
-	* step renders that field) routes inline instead; everything else — engine
-	* errors, and orphaned field errors already downgraded to a fieldless
-	* message — falls to the banner.
-	*/
-	engine.registerFilter("formLevelError", (err) => {
-		return !err?.field;
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions?${stringifiedParams}` : `${getProxyPath()}/flow_definitions`;
+};
+/**
+* Retrieves a list of all flow definitions.
+This endpoint can be used to view existing flow definitions and their configurations.
+
+* @summary List flow definitions
+*/
+const listFlowDefinitions = async (params, options) => {
+	return customFetch(getListFlowDefinitionsUrl(params), {
+		...options,
+		method: "GET"
 	});
-	engine.registerTag(MANDATORY_GATES_TAG, {
-		parse() {},
-		render() {
-			return mandatoryGatesMarkerComment;
-		}
+};
+const getGetFlowDefinitionUrl = (id) => {
+	return `${getProxyPath()}/flow_definitions/${id}`;
+};
+/**
+* Get a flow definition by id
+* @summary Get a flow definition by id
+*/
+const getFlowDefinition = async (id, options) => {
+	return customFetch(getGetFlowDefinitionUrl(id), {
+		...options,
+		method: "GET"
 	});
-	return engine;
-}
+};
+const getUpdateFlowDefinitionUrl = (id) => {
+	return `${getProxyPath()}/flow_definitions/${id}`;
+};
 /**
-* Fallbacks for text keys the flow engine derives from tenant-chosen step
-* names (`<step>.action.back` for the injected back action — see
-* `internal/domain/flow_state_machine.go` `buildStep`). Step names are open,
-* so no dictionary can enumerate them; a missing step-specific key falls back
-* to its generic entry instead of leaking the raw key into the UI.
+* Update a flow definition by id. This endpoint replaces the existing flow definition.
+If `flow_definition.status` is omitted, the current status is preserved
+
+* @summary Update a flow definition by id
 */
-const INJECTED_KEY_FALLBACKS = [{
-	suffix: ".action.back",
-	fallback: "action.back"
-}];
-function injectedKeyFallback(locale, key) {
-	for (const { suffix, fallback } of INJECTED_KEY_FALLBACKS) if (key.endsWith(suffix)) return locale[fallback];
-}
+const updateFlowDefinition = async (id, updateFlowDefinitionBody, options) => {
+	return customFetch(getUpdateFlowDefinitionUrl(id), {
+		...options,
+		method: "PUT",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(updateFlowDefinitionBody)
+	});
+};
+const getDeleteFlowDefinitionUrl = (id) => {
+	return `${getProxyPath()}/flow_definitions/${id}`;
+};
 /**
-* Fallback for field-label keys (`<step>.field.<name>` — see
-* `FlowField.TextKey` in `internal/domain/flow_field_resolver.go`). Both
-* halves are tenant-chosen (step names and schema property names), so no
-* catalog can enumerate the keys; a miss renders a humanised property name
-* ("dateOfBirth" → "Date of birth") instead of leaking the raw key into the
-* form. Sub-keys like `.placeholder`/`.help` are excluded — they resolve
-* through their own filters, which stay empty on a miss.
+* Delete a flow definition by id.
+If the flow definition is currently being used by a flow, the deletion will fail.
+If the flow definition is the last active flow definition for a given purpose, the deletion will fail to prevent disruption of new flows being started for that purpose.
+
+* @summary Delete a flow definition by id
 */
-function fieldLabelFallback(key) {
-	const index = key.lastIndexOf(".field.");
-	if (index === -1) return void 0;
-	const field = key.slice(index + 7);
-	if (field === "" || field.includes(".")) return void 0;
-	return capitaliseFirst(humaniseFieldName(field));
-}
+const deleteFlowDefinition = async (id, options) => {
+	return customFetch(getDeleteFlowDefinitionUrl(id), {
+		...options,
+		method: "DELETE"
+	});
+};
+const getCreateTeamUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams?${stringifiedParams}` : `${getProxyPath()}/teams`;
+};
 /**
-* Rule-suffix fallbacks for the server's field-validation keys
-* (`error.<field>_<rule>` — see `FlowFieldValidationError.TextKey` in
-* `internal/domain/flow_field_resolver.go`). Field names come from the
-* tenant's user schema, so no catalog can enumerate the specific keys;
-* a miss resolves to the rule's generic entry, interpolated with the
-* field's label (`{0}`). The server spells the format rule `_invalid`
-* (the catalog's existing convention, e.g. `error.email_invalid`), so
-* that suffix takes the format wording; `_unknown_field` (a submitted
-* name that is not a step field) takes the catch-all.
+* @summary Create team
 */
-const FLOW_ERROR_RULE_FALLBACKS = [
-	{
-		suffix: "_required",
-		generic: "error.field_required"
-	},
-	{
-		suffix: "_min_length",
-		generic: "error.field_min_length"
-	},
-	{
-		suffix: "_max_length",
-		generic: "error.field_max_length"
-	},
-	{
-		suffix: "_format",
-		generic: "error.field_format"
-	},
-	{
-		suffix: "_invalid",
-		generic: "error.field_format"
-	},
-	{
-		suffix: "_unknown_field",
-		generic: "error.field_invalid"
-	}
-];
-const FLOW_ERROR_CATCH_ALL_KEY = "error.field_invalid";
+const createTeam = async (createTeamBody, params, options) => {
+	return customFetch(getCreateTeamUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createTeamBody)
+	});
+};
+const getQueryTeamsUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/query?${stringifiedParams}` : `${getProxyPath()}/teams/query`;
+};
 /**
-* Localises a `step.error` payload of `error.*` catalog keys —
-* field-validation violations and general engine failures (e.g.
-* `error.invalid_credentials`, `error.passkey_invalid`) alike.
-* Returns `null` unless EVERY `"; "`-joined segment is an `error.*` key
-* — the caller keeps other payloads (outcome tokens such as
-* `user_not_found`) verbatim.
-*
-* Keys the locale knows pass through as `text_key` entries: the template
-* localises them via `| t`, and `fieldErrorKeys` routes the known ones
-* inline to their field. Unknown keys with a recognised rule suffix are
-* pre-localised here from their generic {@link FLOW_ERROR_RULE_FALLBACKS}
-* entry; unknown keys without one pass through as `text_key` (matching
-* `| t`'s behaviour for non-validation keys such as
-* `error.sign_in_server`, which localises via `.title`/`.body`).
+* Returns the teams of a project, paginated with a cursor.
+
+* @summary Query teams
 */
-function localiseFlowErrorKeys(raw, ctx) {
-	const segments = raw.split("; ");
-	if (!segments.every((segment) => segment.startsWith("error."))) return null;
-	return segments.map((key) => localiseFlowErrorKey(key, ctx));
-}
-function localiseFlowErrorKey(key, ctx) {
-	const inlineField = fieldErrorKeys[key];
-	const orphanedInline = inlineField !== void 0 && ctx.fields !== void 0 && !ctx.fields.includes(inlineField);
-	if (!orphanedInline && ctx.locale[key] !== void 0) return inlineField !== void 0 ? {
-		field: inlineField,
-		text_key: key
-	} : { text_key: key };
-	for (const { suffix, generic } of FLOW_ERROR_RULE_FALLBACKS) {
-		if (!key.endsWith(suffix)) continue;
-		const field = key.slice(6, key.length - suffix.length);
-		if (field === "") break;
-		const message = capitaliseFirst(interpolate(ctx.locale[generic] ?? ctx.locale[FLOW_ERROR_CATCH_ALL_KEY] ?? "Please check {0}.", [fieldLabel(ctx, field)]));
-		return ctx.fields !== void 0 && ctx.fields.includes(field) ? {
-			field,
-			message
-		} : { message };
-	}
-	if (orphanedInline && ctx.locale[key] !== void 0) return { message: ctx.locale[key] };
-	return { text_key: key };
-}
-/** `<step>.field.<name>` from the locale, else a humanised field name. */
-function fieldLabel(ctx, field) {
-	return ctx.locale[`${ctx.stepName}.field.${field}`] ?? humaniseFieldName(field);
-}
+const queryTeams = async (queryTeamsBody, params, options) => {
+	return customFetch(getQueryTeamsUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(queryTeamsBody)
+	});
+};
+const getGetTeamUrl = (teamId) => {
+	return `${getProxyPath()}/teams/${teamId}`;
+};
 /**
-* `x-auth-methods#password` → "password", `givenName` → "given name",
-* `date_of_birth` → "date of birth".
+* Returns a Team by its id.
+
+* @summary Get team
 */
-function humaniseFieldName(field) {
-	return (field.includes("#") ? field.split("#").pop() : field).replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_.-]+/g, " ").trim().toLowerCase();
-}
-/** Messages may open with a lowercase field label; sentence-case them. */
-function capitaliseFirst(text) {
-	return text.length > 0 ? text[0]?.toUpperCase() + text.slice(1) : text;
-}
-function stringify(value) {
-	if (value == null) return "";
-	if (typeof value === "string") return value;
-	if (typeof value === "number" || typeof value === "boolean") return String(value);
-	try {
-		return JSON.stringify(value);
-	} catch {
-		return String(value);
-	}
-}
+const getTeam = async (teamId, options) => {
+	return customFetch(getGetTeamUrl(teamId), {
+		...options,
+		method: "GET"
+	});
+};
+const getDeleteTeamUrl = (teamId) => {
+	return `${getProxyPath()}/teams/${teamId}`;
+};
 /**
-* Positional `{n}` substitution shared by the `| t` filter and the
-* pre-localising fallback in {@link localiseFlowErrorKeys}, so both
-* produce byte-identical output for the same template and args.
+* Deactivates the team.
+
+The team is tombstoned rather than erased: it stays readable through
+getTeam with status `deactivated`. Its memberships are removed and the
+users whose lifecycle it owns are deactivated with it.
+
+The request is idempotent. Deleting a team that is already deactivated
+or doesn't exist succeeds without changing anything.
+
+* @summary Delete team
 */
-function interpolate(template, args) {
-	if (args.length === 0) return template;
-	return template.replace(/\{(\d+)\}/g, (match, index) => {
-		return args[Number(index)] ?? match;
+const deleteTeam = async (teamId, options) => {
+	return customFetch(getDeleteTeamUrl(teamId), {
+		...options,
+		method: "DELETE"
 	});
-}
-//#endregion
-//#region src/orchestrator/template-names.ts
+};
+const getUpdateTeamUrl = (teamId) => {
+	return `${getProxyPath()}/teams/${teamId}`;
+};
 /**
-* Names of the bundled Liquid templates the `<zitadel-login>` orchestrator
-* registers.
-*
-* This lives in its own module — separate from `liquid.ts` — so the public
-* barrel can re-export `TEMPLATE_NAMES` without dragging LiquidJS' `Liquid`
-* type (and its Node ambient-type requirements) into the published
-* declaration surface. See `liquid.ts` / the orchestrator barrel.
+* Update team. Only active teams can be updated.
+
+* @summary Update team
 */
-const TEMPLATE_NAMES = {
-	default: "default",
-	authForm: "auth-form",
-	passkeyUpsell: "passkey-upsell",
-	signedIn: "signed-in"
+const updateTeam = async (teamId, updateTeamBody, options) => {
+	return customFetch(getUpdateTeamUrl(teamId), {
+		...options,
+		method: "PATCH",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(updateTeamBody)
+	});
+};
+const getCreateBrandingUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/branding?${stringifiedParams}` : `${getProxyPath()}/branding`;
 };
-//#endregion
-//#region src/orchestrator/locales/en.ts
 /**
-* Minimal English locale dictionary.
-*
-* The `| t` filter looks up `text_key` strings here. Missing keys fall through
-* to the raw key (matches the spec in
-* `docs/design/flowengine/flow-engine-guide.md`).
-*
-* Text keys are auto-generated by the server from the flow definition:
-*   - Step titles:       `<step>.title`
-*   - Step descriptions: `<step>.description`
-*   - Field labels:      `<step>.field.<field>`
-*   - Action labels:     `<step>.action.<action>`
-*
-* Copy aligned to Figma screens file `xkvBjkOJ8ENuHdTGZHXezK` (May 2026).
-* MVP only — multi-locale support is deferred.
+* Publishes a new immutable branding revision for the project. Branding
+revisions cannot be updated or deleted; every edit publishes a new
+revision, and flow responses resolve the latest revision per project
+(see ADR 040).
+
+The `liquid_template` is validated lexically on save (size, encoding,
+banned patterns such as `<script>` tags, inline event handlers, and the
+`| raw` filter). Authoritative LiquidJS validation runs at authoring
+time via `zitadel plan` / `zitadel apply`.
+
+* @summary Publish a new branding revision
 */
-const en = {
-	"identifier.title": "Sign in",
-	"identifier.description": "Enter your email to continue",
-	"identifier.field.email": "Email",
-	"identifier.field.email.placeholder": "you@example.com",
-	"identifier.field.password": "Password",
-	"identifier.action.submit": "Sign in",
-	"identifier.action.continue": "Sign in",
-	"identifier.action.passkey": "Sign in with a passkey",
-	"identifier.action.register.lead": "Don't have an account? ",
-	"identifier.action.register.link": "Sign up",
-	"authenticate.title": "Sign in",
-	"authenticate.description": "Enter your password",
-	"authenticate.field.password": "Password",
-	"authenticate.action.submit": "Sign in",
-	"choose-register.title": "Create your account",
-	"choose-register.description": "Choose how you'd like to sign up",
-	"choose-register.action.register-with-password": "Sign up with password",
-	"choose-register.action.register-with-passkey": "Sign up with passkey",
-	"collect-credentials.title": "Create your account",
-	"collect-credentials.description": "Set up your email and password",
-	"collect-credentials.field.email": "Email",
-	"collect-credentials.field.email.placeholder": "you@example.com",
-	"collect-credentials.field.password": "Password",
-	"collect-credentials.action.submit": "Sign up",
-	"register-password.title": "Create your password",
-	"register-password.description": "Choose a secure password for your account",
-	"register-password.field.password": "Password",
-	"register-password.action.submit": "Sign up",
-	"register-password.action.back": "Back",
-	"passkey-upsell.title": "Sign in faster next time",
-	"passkey-upsell.description": "No password needed ever again.",
-	"passkey-upsell.description.line1": "No password needed ever again.",
-	"passkey-upsell.description.line2": "Sign in with Face ID, Touch ID, or PIN.",
-	"passkey-upsell.action.passkey_register": "Set up passkey",
-	"passkey-upsell.action.skip": "Skip for now",
-	"passkey-upsell.action.setup": "Set up passkey",
-	"collect-passkey-email.title": "Create your account",
-	"collect-passkey-email.description": "Enter your email to set up a passkey",
-	"collect-passkey-email.field.email": "Email",
-	"collect-passkey-email.field.email.placeholder": "you@example.com",
-	"collect-passkey-email.action.submit": "Continue",
-	"passkey-enroll.title": "Set up your passkey",
-	"passkey-enroll.description": "Use Face ID, Touch ID, or your device PIN to create a passkey.",
-	"passkey-enroll.action.passkey_register": "Set up passkey",
-	"done.title": "You're signed in as",
-	"done.description": "",
-	"password.title": "Sign in",
-	"password.description": "Enter your password",
-	"password.field.password": "Password",
-	"password.action.signin": "Sign in",
-	"password.action.passkey": "Sign in with a passkey",
-	"password.action.back": "Back",
-	"password.action.register.lead": "Don't have an account? ",
-	"password.action.register.link": "Sign up",
-	"register.title": "Create your account",
-	"register.description": "",
-	"register.field.email": "Email",
-	"register.field.email.placeholder": "you@example.com",
-	"register.field.password": "Password",
-	"register.field.givenName": "Given name",
-	"register.field.familyName": "Family name",
-	"register.field.companyName": "Company name",
-	"register.field.dateOfBirth": "Date of birth",
-	"register.field.country": "Country",
-	"register.field.country.placeholder": "Select your country",
-	"register.field.terms": "I agree to the terms of service",
-	"register.action.password": "Continue with password",
-	"register.action.passkey": "Continue with a passkey",
-	"register.action.submit": "Sign up",
-	"register.action.back": "Back",
-	"register.action.sign_in.lead": "Already have an account? ",
-	"register.action.sign_in.link": "Sign in",
-	"complete.title": "You're signed in as",
-	"signed-in.continue": "Continue",
-	"signed-in.logout": "Sign out",
-	"passkey-login.title": "Sign in with your passkey",
-	"passkey-first.title": "Sign in",
-	"passkey-first.description": "Use your passkey to continue",
-	"passkey-first.action.passkey": "Continue with passkey",
-	"passkey-first.action.email_fallback": "Use email instead",
-	"recover.title": "Check your email",
-	"recover.description": "We sent a password reset link to your email address.",
-	"recover.action.back": "Back to sign in",
-	"submit.continue": "Continue",
-	"submit.signin": "Sign in",
-	"action.forgot_password": "Forgot password?",
-	"action.cancel": "Cancel",
-	"action.back": "Back",
-	"sso.redirect.title": "Redirecting to your provider…",
-	"passkey.pending.status": "Waiting for your passkey…",
-	"error.passkey_cancelled": "The passkey prompt was closed before completing.",
-	"error.passkey_timeout": "The passkey request timed out. Please try again.",
-	"error.passkey_not_registered": "This passkey is not registered. Please sign in with your email and password.",
-	"error.passkey_setup_failed": "Passkey registration did not complete. Please try again.",
-	"error.passkey_unsupported": "This device does not support passkeys",
-	"error.passkey_failed": "Something went wrong. Please try again.",
-	"error.passkey_invalid": "This passkey could not be verified. Please try again.",
-	"error.passkey_registration_invalid": "The new passkey could not be verified. Please try registering it again.",
-	"error.email_required": "Please enter an email address",
-	"error.email_invalid": "Please enter a valid email",
-	"error.password_required": "Please enter a password",
-	"error.password_incorrect": "Wrong email or password.",
-	"error.email_exists": "An account with this email already exists.",
-	/** Figma sign-in error `6602:180268` — inline on password field. */
-	"error.invalid_credentials": "Wrong email or password.",
-	"error.required": "This field is required.",
-	"error.field_required": "{0} is required.",
-	"error.field_format": "Please enter a valid {0}.",
-	"error.field_min_length": "{0} is too short.",
-	"error.field_max_length": "{0} is too long.",
-	"error.field_invalid": "Please check {0}.",
-	"error.sign_in_server.title": "We couldn't complete your sign in.",
-	"error.sign_in_server.body": "Please try again in a few minutes"
+const createBranding = async (createBrandingBody, params, options) => {
+	return customFetch(getCreateBrandingUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createBrandingBody)
+	});
+};
+const getListBrandingUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/branding?${stringifiedParams}` : `${getProxyPath()}/branding`;
+};
+/**
+* Lists branding revisions for the project, newest first, capped at the
+100 most recent. The first entry is the revision flow responses
+currently resolve. Deliberately unpaginated in v1 — list endpoints
+gain a real query mechanism together (ADR 031); advertising pagination
+parameters the server ignores would be worse than none.
+
+* @summary List branding revisions
+*/
+const listBranding = async (params, options) => {
+	return customFetch(getListBrandingUrl(params), {
+		...options,
+		method: "GET"
+	});
 };
-//#endregion
-//#region src/orchestrator/locales/de.ts
-const de = {
-	"identifier.title": "Anmelden",
-	"identifier.description": "Gib deine E-Mail-Adresse ein, um fortzufahren",
-	"identifier.field.email": "E-Mail",
-	"identifier.field.email.placeholder": "du@beispiel.de",
-	"identifier.field.password": "Passwort",
-	"identifier.action.submit": "Anmelden",
-	"identifier.action.continue": "Anmelden",
-	"identifier.action.passkey": "Mit Passkey anmelden",
-	"identifier.action.register.lead": "Noch kein Konto? ",
-	"identifier.action.register.link": "Registrieren",
-	"authenticate.title": "Anmelden",
-	"authenticate.description": "Gib dein Passwort ein",
-	"authenticate.field.password": "Passwort",
-	"authenticate.action.submit": "Anmelden",
-	"choose-register.title": "Konto erstellen",
-	"choose-register.description": "Wähle, wie du dich registrieren möchtest",
-	"choose-register.action.register-with-password": "Mit Passwort registrieren",
-	"choose-register.action.register-with-passkey": "Mit Passkey registrieren",
-	"collect-credentials.title": "Konto erstellen",
-	"collect-credentials.description": "Richte E-Mail und Passwort ein",
-	"collect-credentials.field.email": "E-Mail",
-	"collect-credentials.field.email.placeholder": "du@beispiel.de",
-	"collect-credentials.field.password": "Passwort",
-	"collect-credentials.action.submit": "Registrieren",
-	"register-password.title": "Passwort erstellen",
-	"register-password.description": "Wähle ein sicheres Passwort für dein Konto",
-	"register-password.field.password": "Passwort",
-	"register-password.action.submit": "Registrieren",
-	"register-password.action.back": "Zurück",
-	"passkey-upsell.title": "Nächstes Mal schneller anmelden",
-	"passkey-upsell.description": "Kein Passwort mehr nötig.",
-	"passkey-upsell.description.line1": "Kein Passwort mehr nötig.",
-	"passkey-upsell.description.line2": "Melde dich mit Face ID, Touch ID oder PIN an.",
-	"passkey-upsell.action.passkey_register": "Passkey einrichten",
-	"passkey-upsell.action.skip": "Vorerst überspringen",
-	"passkey-upsell.action.setup": "Passkey einrichten",
-	"collect-passkey-email.title": "Konto erstellen",
-	"collect-passkey-email.description": "Gib deine E-Mail-Adresse ein, um einen Passkey einzurichten",
-	"collect-passkey-email.field.email": "E-Mail",
-	"collect-passkey-email.field.email.placeholder": "du@beispiel.de",
-	"collect-passkey-email.action.submit": "Weiter",
-	"passkey-enroll.title": "Passkey einrichten",
-	"passkey-enroll.description": "Verwende Face ID, Touch ID oder die Geräte-PIN, um einen Passkey zu erstellen.",
-	"passkey-enroll.action.passkey_register": "Passkey einrichten",
-	"done.title": "Du bist angemeldet als",
-	"done.description": "",
-	"password.title": "Anmelden",
-	"password.description": "Gib dein Passwort ein",
-	"password.field.password": "Passwort",
-	"password.action.signin": "Anmelden",
-	"password.action.passkey": "Mit Passkey anmelden",
-	"password.action.back": "Zurück",
-	"password.action.register.lead": "Noch kein Konto? ",
-	"password.action.register.link": "Registrieren",
-	"register.title": "Konto erstellen",
-	"register.description": "",
-	"register.field.email": "E-Mail",
-	"register.field.email.placeholder": "du@beispiel.de",
-	"register.field.password": "Passwort",
-	"register.field.givenName": "Vorname",
-	"register.field.familyName": "Nachname",
-	"register.field.companyName": "Firmenname",
-	"register.field.dateOfBirth": "Geburtsdatum",
-	"register.field.country": "Land",
-	"register.field.country.placeholder": "Land auswählen",
-	"register.field.terms": "Ich stimme den Nutzungsbedingungen zu",
-	"register.action.password": "Mit Passwort fortfahren",
-	"register.action.passkey": "Weiter mit Passkey",
-	"register.action.submit": "Registrieren",
-	"register.action.back": "Zurück",
-	"register.action.sign_in.lead": "Bereits ein Konto? ",
-	"register.action.sign_in.link": "Anmelden",
-	"complete.title": "Du bist angemeldet als",
-	"signed-in.continue": "Weiter",
-	"signed-in.logout": "Abmelden",
-	"passkey-login.title": "Mit Passkey anmelden",
-	"passkey-first.title": "Anmelden",
-	"passkey-first.description": "Verwende deinen Passkey, um fortzufahren",
-	"passkey-first.action.passkey": "Weiter mit Passkey",
-	"passkey-first.action.email_fallback": "Stattdessen E-Mail verwenden",
-	"recover.title": "E-Mail prüfen",
-	"recover.description": "Wir haben einen Link zum Zurücksetzen des Passworts an deine E-Mail-Adresse gesendet.",
-	"recover.action.back": "Zurück zur Anmeldung",
-	"submit.continue": "Weiter",
-	"submit.signin": "Anmelden",
-	"action.forgot_password": "Passwort vergessen?",
-	"action.cancel": "Abbrechen",
-	"action.back": "Zurück",
-	"sso.redirect.title": "Weiterleitung zum Anbieter…",
-	"passkey.pending.status": "Warten auf deinen Passkey…",
-	"error.passkey_cancelled": "Die Passkey-Abfrage wurde vorzeitig geschlossen.",
-	"error.passkey_timeout": "Die Passkey-Anfrage hat zu lange gedauert. Bitte versuche es erneut.",
-	"error.passkey_not_registered": "Dieser Passkey ist nicht registriert. Bitte melde dich mit E-Mail und Passwort an.",
-	"error.passkey_setup_failed": "Passkey-Registrierung wurde nicht abgeschlossen. Bitte versuche es erneut.",
-	"error.passkey_unsupported": "Dieses Gerät unterstützt keine Passkeys",
-	"error.passkey_failed": "Etwas ist schiefgelaufen. Bitte versuche es erneut.",
-	"error.passkey_invalid": "Dieser Passkey konnte nicht bestätigt werden. Bitte versuche es erneut.",
-	"error.passkey_registration_invalid": "Der neue Passkey konnte nicht bestätigt werden. Bitte registriere ihn erneut.",
-	"error.email_required": "Bitte gib eine E-Mail-Adresse ein",
-	"error.email_invalid": "Bitte gib eine gültige E-Mail-Adresse ein",
-	"error.password_required": "Bitte gib ein Passwort ein",
-	"error.password_incorrect": "Falsche E-Mail oder falsches Passwort.",
-	"error.email_exists": "Ein Konto mit dieser E-Mail-Adresse existiert bereits.",
-	"error.invalid_credentials": "Falsche E-Mail oder falsches Passwort.",
-	"error.required": "Dieses Feld ist erforderlich.",
-	"error.field_required": "{0} ist erforderlich.",
-	"error.field_format": "Bitte gib einen gültigen Wert für {0} ein.",
-	"error.field_min_length": "{0} ist zu kurz.",
-	"error.field_max_length": "{0} ist zu lang.",
-	"error.field_invalid": "Bitte überprüfe {0}.",
-	"error.sign_in_server.title": "Anmeldung konnte nicht abgeschlossen werden.",
-	"error.sign_in_server.body": "Bitte versuche es in einigen Minuten erneut"
+const getGetBrandingByIdUrl = (id) => {
+	return `${getProxyPath()}/branding/${id}`;
 };
-//#endregion
-//#region src/orchestrator/locales/it.ts
-const it = {
-	"identifier.title": "Accedi",
-	"identifier.description": "Inserisci la tua e-mail per continuare",
-	"identifier.field.email": "E-mail",
-	"identifier.field.email.placeholder": "tu@esempio.com",
-	"identifier.field.password": "Password",
-	"identifier.action.submit": "Accedi",
-	"identifier.action.continue": "Accedi",
-	"identifier.action.passkey": "Accedi con passkey",
-	"identifier.action.register.lead": "Non hai un account? ",
-	"identifier.action.register.link": "Registrati",
-	"authenticate.title": "Accedi",
-	"authenticate.description": "Inserisci la tua password",
-	"authenticate.field.password": "Password",
-	"authenticate.action.submit": "Accedi",
-	"choose-register.title": "Crea il tuo account",
-	"choose-register.description": "Scegli come registrarti",
-	"choose-register.action.register-with-password": "Registrati con password",
-	"choose-register.action.register-with-passkey": "Registrati con passkey",
-	"collect-credentials.title": "Crea il tuo account",
-	"collect-credentials.description": "Configura e-mail e password",
-	"collect-credentials.field.email": "E-mail",
-	"collect-credentials.field.email.placeholder": "tu@esempio.com",
-	"collect-credentials.field.password": "Password",
-	"collect-credentials.action.submit": "Registrati",
-	"register-password.title": "Crea la tua password",
-	"register-password.description": "Scegli una password sicura per il tuo account",
-	"register-password.field.password": "Password",
-	"register-password.action.submit": "Registrati",
-	"register-password.action.back": "Indietro",
-	"passkey-upsell.title": "Accedi più velocemente la prossima volta",
-	"passkey-upsell.description": "Nessuna password necessaria.",
-	"passkey-upsell.description.line1": "Nessuna password necessaria.",
-	"passkey-upsell.description.line2": "Accedi con Face ID, Touch ID o PIN.",
-	"passkey-upsell.action.passkey_register": "Configura passkey",
-	"passkey-upsell.action.skip": "Salta per ora",
-	"passkey-upsell.action.setup": "Configura passkey",
-	"collect-passkey-email.title": "Crea il tuo account",
-	"collect-passkey-email.description": "Inserisci la tua e-mail per configurare una passkey",
-	"collect-passkey-email.field.email": "E-mail",
-	"collect-passkey-email.field.email.placeholder": "tu@esempio.com",
-	"collect-passkey-email.action.submit": "Continua",
-	"passkey-enroll.title": "Configura la tua passkey",
-	"passkey-enroll.description": "Usa Face ID, Touch ID o il PIN del dispositivo per creare una passkey.",
-	"passkey-enroll.action.passkey_register": "Configura passkey",
-	"done.title": "Sei connesso come",
-	"done.description": "",
-	"password.title": "Accedi",
-	"password.description": "Inserisci la tua password",
-	"password.field.password": "Password",
-	"password.action.signin": "Accedi",
-	"password.action.passkey": "Accedi con passkey",
-	"password.action.back": "Indietro",
-	"password.action.register.lead": "Non hai un account? ",
-	"password.action.register.link": "Registrati",
-	"register.title": "Crea il tuo account",
-	"register.description": "",
-	"register.field.email": "E-mail",
-	"register.field.email.placeholder": "tu@esempio.com",
-	"register.field.password": "Password",
-	"register.field.givenName": "Nome",
-	"register.field.familyName": "Cognome",
-	"register.field.companyName": "Nome azienda",
-	"register.field.dateOfBirth": "Data di nascita",
-	"register.field.country": "Paese",
-	"register.field.country.placeholder": "Seleziona il tuo paese",
-	"register.field.terms": "Accetto i termini di servizio",
-	"register.action.password": "Continua con password",
-	"register.action.passkey": "Continua con passkey",
-	"register.action.submit": "Registrati",
-	"register.action.back": "Indietro",
-	"register.action.sign_in.lead": "Hai già un account? ",
-	"register.action.sign_in.link": "Accedi",
-	"complete.title": "Sei connesso come",
-	"signed-in.continue": "Continua",
-	"signed-in.logout": "Esci",
-	"passkey-login.title": "Accedi con la tua passkey",
-	"passkey-first.title": "Accedi",
-	"passkey-first.description": "Usa la tua passkey per continuare",
-	"passkey-first.action.passkey": "Continua con passkey",
-	"passkey-first.action.email_fallback": "Usa invece l'email",
-	"recover.title": "Controlla la tua e-mail",
-	"recover.description": "Abbiamo inviato un link per reimpostare la password al tuo indirizzo e-mail.",
-	"recover.action.back": "Torna all'accesso",
-	"submit.continue": "Continua",
-	"submit.signin": "Accedi",
-	"action.forgot_password": "Password dimenticata?",
-	"action.cancel": "Annulla",
-	"action.back": "Indietro",
-	"sso.redirect.title": "Reindirizzamento al provider…",
-	"passkey.pending.status": "In attesa della tua passkey…",
-	"error.passkey_cancelled": "La richiesta della passkey è stata chiusa prima del completamento.",
-	"error.passkey_timeout": "La richiesta della passkey è scaduta. Riprova.",
-	"error.passkey_not_registered": "Questa passkey non è registrata. Accedi con e-mail e password.",
-	"error.passkey_setup_failed": "La registrazione della passkey non è stata completata. Riprova.",
-	"error.passkey_unsupported": "Questo dispositivo non supporta le passkey",
-	"error.passkey_failed": "Qualcosa è andato storto. Riprova.",
-	"error.passkey_invalid": "Non è stato possibile verificare questa passkey. Riprova.",
-	"error.passkey_registration_invalid": "Non è stato possibile verificare la nuova passkey. Riprova a registrarla.",
-	"error.email_required": "Inserisci un indirizzo e-mail",
-	"error.email_invalid": "Inserisci un indirizzo e-mail valido",
-	"error.password_required": "Inserisci una password",
-	"error.password_incorrect": "E-mail o password errata.",
-	"error.email_exists": "Esiste già un account con questo indirizzo e-mail.",
-	"error.invalid_credentials": "E-mail o password errata.",
-	"error.required": "Questo campo è obbligatorio.",
-	"error.field_required": "{0} è obbligatorio.",
-	"error.field_format": "Inserisci un valore valido per {0}.",
-	"error.field_min_length": "{0} è troppo corto.",
-	"error.field_max_length": "{0} è troppo lungo.",
-	"error.field_invalid": "Controlla {0}.",
-	"error.sign_in_server.title": "Non è stato possibile completare l'accesso.",
-	"error.sign_in_server.body": "Riprova tra qualche minuto"
+/**
+* Retrieves a single branding revision, including its stored configuration.
+* @summary Get a branding revision by ID
+*/
+const getBrandingById = async (id, options) => {
+	return customFetch(getGetBrandingByIdUrl(id), {
+		...options,
+		method: "GET"
+	});
+};
+const getListEventsUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (Array.isArray(value) && ["category", "event_type"].includes(key)) {
+			value.forEach((v) => {
+				normalizedParams.append(key, v === null ? "null" : v.toString());
+			});
+			return;
+		}
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/events?${stringifiedParams}` : `${getProxyPath()}/events`;
+};
+/**
+* Returns project-scoped audit events, newest-first by keyset on
+`(created_at, id)` (ADR 027 / ADR 049). Pass `order=asc` for oldest-first.
+Requires `events.read`.
+
+Pre-claim projects return an empty list (events are stored but not
+visible until claim succeeds). Team-scoped credentials see only events
+whose emit-time `team_id` matches the credential team (enforced when
+team-scoped tokens exist).
+
+Clients discriminate each item via `event_type` (OpenAPI Event oneOf) —
+see docs/design/api/events-catalog.md.
+
+* @summary List events
+*/
+const listEvents = async (params, options) => {
+	return customFetch(getListEventsUrl(params), {
+		...options,
+		method: "GET"
+	});
 };
-//#endregion
-//#region src/orchestrator/locales/business.ts
-const businessLocales = {
-	en: {
-		"identifier.field.email": "Work email",
-		"identifier.field.email.placeholder": "you@company.com",
-		"collect-credentials.field.email": "Work email",
-		"collect-credentials.field.email.placeholder": "you@company.com",
-		"collect-passkey-email.field.email": "Work email",
-		"collect-passkey-email.field.email.placeholder": "you@company.com",
-		"register.field.email": "Work email",
-		"register.field.email.placeholder": "you@company.com"
-	},
-	de: {
-		"identifier.field.email": "Geschäftliche E-Mail",
-		"identifier.field.email.placeholder": "du@unternehmen.com",
-		"collect-credentials.field.email": "Geschäftliche E-Mail",
-		"collect-credentials.field.email.placeholder": "du@unternehmen.com",
-		"collect-passkey-email.field.email": "Geschäftliche E-Mail",
-		"collect-passkey-email.field.email.placeholder": "du@unternehmen.com",
-		"register.field.email": "Geschäftliche E-Mail",
-		"register.field.email.placeholder": "du@unternehmen.com"
-	},
-	it: {
-		"identifier.field.email": "E-mail aziendale",
-		"identifier.field.email.placeholder": "tu@azienda.com",
-		"collect-credentials.field.email": "E-mail aziendale",
-		"collect-credentials.field.email.placeholder": "tu@azienda.com",
-		"collect-passkey-email.field.email": "E-mail aziendale",
-		"collect-passkey-email.field.email.placeholder": "tu@azienda.com",
-		"register.field.email": "E-mail aziendale",
-		"register.field.email.placeholder": "tu@azienda.com"
-	}
+const getGetEventUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/events/${id}?${stringifiedParams}` : `${getProxyPath()}/events/${id}`;
 };
-//#endregion
-//#region src/orchestrator/locales/index.ts
-const builtinLocales = {
-	en,
-	de,
-	it
+/**
+* Loads a single event by `(project_id, id)`. Requires `events.read`.
+Events are not registered in `resource_scope_index`; project scope is
+required on the query (ADR 049). Misses and cross-project ids return 404.
+
+Pre-claim projects return 404 (stored events stay invisible until claim).
+
+* @summary Get event by ID
+*/
+const getEvent = async (id, params, options) => {
+	return customFetch(getGetEventUrl(id, params), {
+		...options,
+		method: "GET"
+	});
 };
 //#endregion
-//#region ../shared-component-styles/dist/attribution-markup.mjs
+//#region ../api/dist/runtime/api-factory.mjs
 /**
-* Figma sign-in attribution chip (`6593:141767`): "Secured with" + 65×16 logotype.
-* Shared by Lit orchestrator HTML, dev playground, and paired React playgrounds.
+* Factory for the typed Zitadel client every consumer reaches for.
+*
+* Wraps the orval-generated endpoints in a {@link Proxy} so each
+* generated function sees the right base URL and (optionally) the
+* right bearer token at call time — without the caller having to
+* thread either through every operation, and without exposing the
+* module-globals (`setProxyPath` / `setApiAuthToken`) as part of the
+* public API.
+*
+* Per-instance isolation: multiple clients can coexist in one process
+* (different servers, different tokens). Their Proxy `get` traps set
+* the globals synchronously before invoking the underlying generated
+* function, which reads them at the top of `customFetch` before any
+* `await`. Two clients running interleaved within a single JS turn
+* are safe; two clients running in parallel across awaits could
+* clobber each other — not a pattern any current consumer uses.
 */
-const ZITADEL_ATTRIBUTION_LOGOTYPE_SVG = "<svg class=\"zr-pill__logotype-svg\" xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 67.3501 15.1111\" width=\"65\" height=\"16\" fill=\"currentColor\" aria-hidden=\"true\" focusable=\"false\"><path d=\"M2.04839 4.265C2.06224 4.1284 2.1748 3.98591 2.32756 3.91161L8.98593 0.0494262C9.227 -0.0678242 9.45274 0.0334116 9.43089 0.248972V4.52681C9.41705 4.66341 9.30448 4.80589 9.15172 4.88019L2.49335 8.66426C2.25228 8.78151 2.02654 8.68027 2.04839 8.46471V4.265Z\"/><path d=\"M14.0086 5.25359C14.12 5.33388 14.1871 5.50261 14.1751 5.67205V13.2643C14.1561 13.5317 13.9555 13.6766 13.7798 13.5499L10.1005 11.4468C9.98908 11.3666 9.92196 11.1978 9.934 11.0284V3.32695C9.95299 3.05956 10.1535 2.91467 10.3293 3.04138L14.0086 5.25359Z\"/><path d=\"M7.37428 15.0817C7.24906 15.138 7.06938 15.1118 6.92865 15.0167L0.183465 11.1405C-0.038611 10.9903 -0.0638098 10.7442 0.133796 10.6554L3.76278 8.53833C3.888 8.48203 4.06767 8.50827 4.2084 8.60341L10.9046 12.5341C11.1267 12.6843 11.1557 12.9125 10.9543 13.0193L7.37428 15.0817Z\"/><path d=\"M65.6687 13.1043V2.00077H67.3501V13.1043H65.6687Z\"/><path d=\"M60.4255 13.2947C59.6535 13.2947 58.9715 13.1202 58.3793 12.7712C57.7871 12.4222 57.3218 11.9358 56.9834 11.3119C56.6556 10.688 56.4917 9.97418 56.4917 9.1705C56.4917 8.33509 56.6556 7.61073 56.9834 6.99739C57.3112 6.38405 57.7712 5.90819 58.3634 5.56979C58.9662 5.22083 59.6588 5.04634 60.4414 5.04634C61.2027 5.04634 61.869 5.21554 62.44 5.55393C63.011 5.88175 63.4552 6.33118 63.7724 6.90222C64.1002 7.47326 64.2642 8.12359 64.2642 8.85325C64.2642 9.0013 64.2589 9.1282 64.2483 9.23395C64.2483 9.33969 64.2377 9.46659 64.2166 9.61464H58.1731C58.2048 10.0588 58.3158 10.4553 58.5062 10.8043C58.6965 11.1427 58.9556 11.4124 59.2834 11.6133C59.6112 11.8036 59.9866 11.8988 60.4096 11.8988C60.8644 11.8988 61.2503 11.7983 61.5676 11.5974C61.8954 11.3859 62.1386 11.0898 62.2972 10.7091H64.0421C63.9046 11.185 63.672 11.6186 63.3441 12.0098C63.0269 12.4011 62.6251 12.7131 62.1386 12.9457C61.6522 13.1784 61.0811 13.2947 60.4255 13.2947ZM58.1889 8.42497H62.551C62.5299 7.81163 62.3131 7.3305 61.9007 6.98153C61.4883 6.62199 60.986 6.44222 60.3938 6.44222C59.865 6.44222 59.3839 6.60613 58.9503 6.93394C58.5168 7.26176 58.263 7.75876 58.1889 8.42497Z\"/><path d=\"M50.5389 13.2947C49.7563 13.2947 49.0796 13.1096 48.5085 12.7395C47.9481 12.3588 47.5145 11.8565 47.2078 11.2326C46.9117 10.6087 46.7637 9.91073 46.7637 9.13877C46.7637 8.37739 46.9117 7.69004 47.2078 7.0767C47.5145 6.45279 47.9481 5.96106 48.5085 5.60152C49.0796 5.2314 49.7563 5.04634 50.5389 5.04634C51.1205 5.04634 51.6492 5.16795 52.1251 5.41117C52.601 5.64382 52.9869 5.97692 53.283 6.41049V2.00077H54.9803V13.1043H53.3465L53.283 11.8829C53.0292 12.2954 52.6644 12.6337 52.1886 12.8981C51.7127 13.1625 51.1628 13.2947 50.5389 13.2947ZM50.872 11.8195C51.369 11.8195 51.7973 11.7032 52.1568 11.4705C52.5164 11.2379 52.7913 10.9206 52.9817 10.5188C53.172 10.1169 53.2672 9.66751 53.2672 9.1705C53.2672 8.59946 53.1561 8.1183 52.9341 7.72704C52.7226 7.33577 52.4318 7.0344 52.0617 6.82291C51.7021 6.61141 51.3003 6.50567 50.8561 6.50567C50.4014 6.50567 49.9943 6.6167 49.6347 6.83877C49.2752 7.06084 48.9897 7.36749 48.7782 7.75876C48.5773 8.15003 48.4768 8.61532 48.4768 9.15463C48.4768 9.68337 48.5825 10.1487 48.794 10.5505C49.0055 10.9524 49.2911 11.2643 49.6506 11.4864C50.0101 11.7085 50.4173 11.8195 50.872 11.8195Z\"/><path d=\"M40.7882 13.2947C40.2806 13.2947 39.8153 13.2048 39.3923 13.025C38.9693 12.8347 38.6309 12.5597 38.3771 12.2002C38.1233 11.8406 37.9965 11.4071 37.9965 10.8995C37.9965 10.2967 38.1445 9.81556 38.4406 9.45602C38.7473 9.0859 39.1544 8.81624 39.662 8.64704C40.1801 8.46727 40.7459 8.37739 41.3592 8.37739H43.3579C43.3579 7.92267 43.2839 7.55786 43.1358 7.28291C42.9878 6.99739 42.7868 6.79118 42.533 6.66429C42.2792 6.52681 41.9832 6.45808 41.6448 6.45808C41.2006 6.45808 40.8094 6.56383 40.471 6.77532C40.1431 6.97624 39.9369 7.29876 39.8523 7.7429H38.1551C38.2079 7.17186 38.3983 6.68544 38.7261 6.28359C39.0645 5.88175 39.4928 5.57508 40.011 5.36358C40.5291 5.15209 41.079 5.04634 41.6606 5.04634C42.422 5.04634 43.0512 5.1891 43.5482 5.47462C44.0558 5.74957 44.4312 6.13555 44.6744 6.63256C44.9282 7.12958 45.0551 7.69531 45.0551 8.3298V10.7409C45.0657 11.0475 45.1292 11.2749 45.2455 11.4229C45.3724 11.5604 45.5945 11.6397 45.9117 11.6609V13.1043C45.4887 13.1043 45.1186 13.0567 44.8013 12.9616C44.4947 12.8664 44.2409 12.7236 44.04 12.5333C43.839 12.3324 43.6804 12.0786 43.5641 11.7719C43.3103 12.1949 42.9402 12.5544 42.4537 12.8505C41.9673 13.1466 41.4121 13.2947 40.7882 13.2947ZM41.1848 11.9147C41.6183 11.9147 41.999 11.8089 42.3268 11.5974C42.6547 11.3753 42.9084 11.0898 43.0882 10.7409C43.268 10.3813 43.3579 9.99533 43.3579 9.58291V9.55119H41.4861C41.1795 9.55119 40.8887 9.5882 40.6137 9.66223C40.3493 9.73625 40.1326 9.86315 39.9634 10.0429C39.8047 10.2121 39.7254 10.45 39.7254 10.7567C39.7254 11.1586 39.8682 11.4547 40.1537 11.645C40.4392 11.8248 40.7829 11.9147 41.1848 11.9147Z\"/><path d=\"M35.5197 13.1043C34.7372 13.1043 34.1344 12.914 33.7114 12.5333C33.2884 12.1526 33.0769 11.5287 33.0769 10.6615V6.64842H31.8873V5.23669H33.0769V3.3332H34.7583V5.23669H36.757V6.64842H34.7583V10.6615C34.7583 11.0634 34.8482 11.333 35.028 11.4705C35.2078 11.608 35.488 11.6767 35.8687 11.6767H36.757V13.1043H35.5197Z\"/><path d=\"M29.6602 3.85668C29.3536 3.85668 29.0892 3.7509 28.8671 3.53941C28.6556 3.31734 28.5499 3.04768 28.5499 2.73043C28.5499 2.42376 28.6556 2.16468 28.8671 1.95319C29.0892 1.74169 29.3536 1.63594 29.6602 1.63594C29.9775 1.63594 30.2419 1.74169 30.4533 1.95319C30.6754 2.16468 30.7865 2.42376 30.7865 2.73043C30.7865 3.04768 30.6754 3.31734 30.4533 3.53941C30.2419 3.7509 29.9775 3.85668 29.6602 3.85668ZM28.8195 13.1043V5.23669H30.5009V13.1043H28.8195Z\"/><path d=\"M19.8276 13.1043V11.8036L25.1098 3.42837H19.8911V2.00077H27.0608V3.30147L21.7628 11.6609H27.1084V13.1043H19.8276Z\"/></svg>";
-/** Inner markup for the default Zitadel attribution pill (label + logotype). */
-function zitadelAttributionPillInnerHtml() {
-	return `Secured with <span class="zr-pill__logotype">${ZITADEL_ATTRIBUTION_LOGOTYPE_SVG}</span>`;
+/**
+* Build a typed Zitadel client pre-bound to a base URL and (optionally)
+* a bearer token. Every method on the returned object mirrors a
+* generated orval function:
+*
+*     const client = createZitadelClient({ baseUrl, token });
+*     await client.createProject({ preview_origins: [] });
+*     await client.createSchema(body, { project_id });
+*/
+function createZitadelClient(opts) {
+	let baseUrl = opts.baseUrl;
+	while (baseUrl.endsWith("/")) baseUrl = baseUrl.slice(0, -1);
+	return new Proxy(zitadelNextGen_exports, { get(target, prop, receiver) {
+		const value = Reflect.get(target, prop, receiver);
+		if (typeof value !== "function") return value;
+		return (...args) => {
+			setProxyPath(baseUrl);
+			setApiAuthToken(opts.token);
+			return value(...args);
+		};
+	} });
+}
+//#endregion
+//#region ../api/dist/runtime/config.mjs
+/**
+* Slot for the configured project, stored on `globalThis` under a
+* {@link Symbol.for} key. Every copy of this module evaluated in the
+* same JS realm resolves the symbol through the global symbol registry
+* to the same identity, so they all read and write a single slot —
+* needed because the standalone components bundle inlines its own copy
+* of this file, and dual-package hazards / monorepo duplicates can load
+* a second copy alongside the app's. With a module-local `let` each
+* instance kept its own singleton and `configureZitadel()` calls in one
+* were invisible to `getZitadelConfig()` calls in another. Sharing is
+* realm-scoped — separate realms (iframes, Node `vm` contexts, worker
+* threads) have their own registries and are not unified by this.
+*/
+const PROJECT_SLOT = Symbol.for("@zitadel/api/config:currentProject");
+function readSlot() {
+	return globalThis[PROJECT_SLOT] ?? null;
+}
+/**
+* Per-project API client cache. Ensures `getApi(project)` returns the
+* same instance for the same project handle — no re-wrapping on every call.
+* Module-local on purpose: keyed by the shared frozen `ZitadelProject`
+* object identity, so cross-instance reads still resolve through the
+* same key and at worst memoize once per module instance.
+*/
+const apiCache = /* @__PURE__ */ new WeakMap();
+/**
+* Returns a typed API client for the given project, with the base URL
+* pre-bound. Cached per project handle — safe to call multiple times.
+*
+* ```ts
+* const project = configureZitadel({ ... });
+* export const api = getApi(project);
+* ```
+*/
+function getApi(project) {
+	let api = apiCache.get(project);
+	if (!api) {
+		api = createZitadelClient({
+			baseUrl: project.proxyPath,
+			token: project.publishableKey
+		});
+		apiCache.set(project, api);
+	}
+	return api;
+}
+/**
+* Returns the current project handle, or `null` if {@link configureZitadel}
+* has not been called yet.
+*/
+function getZitadelConfig() {
+	return readSlot();
+}
+//#endregion
+//#region src/orchestrator/resolve-api.ts
+/** Matches the `configureZitadel()` default so attribute and JS config agree. */
+const DEFAULT_PROXY_PATH = "/__nextgen";
+/**
+* Cache of project handles synthesized from attributes, keyed by their value
+* tuple. `getApi()` caches its client in a `WeakMap` keyed by the project's
+* identity, so the same attribute values must yield the *same* frozen object
+* across the several `resolveApi()` calls a single flow makes — otherwise
+* every call misses the cache and re-wraps a fresh client. A real page uses a
+* handful of distinct configs at most; the FIFO bound below is just a guard so
+* a pathological page that churns through unique configs can't leak memory.
+*/
+const MAX_SYNTHETIC_PROJECTS = 32;
+const syntheticProjects = /* @__PURE__ */ new Map();
+/**
+* Builds a `ZitadelProject` from declarative attributes, or `undefined` when
+* no `project-id` was given (nothing to configure). Mirrors
+* `configureZitadel()`'s proxy-path defaulting so the two config paths are
+* interchangeable.
+*/
+function projectFromAttrs({ projectId, proxyPath, url }) {
+	if (!projectId) return void 0;
+	const resolvedProxyPath = proxyPath || DEFAULT_PROXY_PATH;
+	const resolvedUrl = url || void 0;
+	const key = JSON.stringify([
+		projectId,
+		resolvedProxyPath,
+		resolvedUrl ?? ""
+	]);
+	let project = syntheticProjects.get(key);
+	if (!project) {
+		project = Object.freeze({
+			projectId,
+			proxyPath: resolvedProxyPath,
+			url: resolvedUrl
+		});
+		if (syntheticProjects.size >= MAX_SYNTHETIC_PROJECTS) {
+			const oldest = syntheticProjects.keys().next().value;
+			if (oldest !== void 0) syntheticProjects.delete(oldest);
+		}
+		syntheticProjects.set(key, project);
+	}
+	return project;
+}
+/**
+* Resolves the effective SDK project handle and its typed API client for an
+* orchestrator element. Precedence, highest first:
+*
+* 1. the element's `project` property (an SDK handle set from JS / a framework),
+* 2. the global handle from `configureZitadel()`,
+* 3. the `project-id` / `proxy-path` / `url` attributes set declaratively in HTML.
+*
+* Both JS paths (property and global) win over the declarative attributes, so a
+* deliberate `configureZitadel()` is never silently overridden by fallback or
+* stale HTML attributes; the attributes are the no-JS fallback.
+*
+* Both `<zitadel-login>` and `<zitadel-logout>` need the same resolution and
+* the same "no config" failure, so it lives here rather than being copied
+* into each element. Callers run this inside their try/catch so a missing
+* configuration surfaces through the element's normal error path rather than
+* as an unhandled rejection.
+*
+* @param project Optional per-element override handle.
+* @param attrs Declarative config read from the element's attributes.
+* @param element Tag name used in the thrown error (e.g. `<zitadel-login>`).
+*/
+function resolveApi(project, attrs, element) {
+	const cfg = project ?? getZitadelConfig() ?? projectFromAttrs(attrs);
+	if (!cfg) throw new Error(`${element} requires a configured project: set the \`project-id\` attribute, set the \`project\` property, or call configureZitadel().`);
+	return {
+		project: cfg,
+		api: getApi(cfg)
+	};
 }
 //#endregion
 //#region src/orchestrator/sanitiser.ts
@@ -2626,15 +2710,15 @@ const DENSITY_MAP = {
 	}
 };
 const PALETTE_MAP = {
-	primary: ["--zl-color-surface-default-white"],
-	on_primary: ["--zl-color-text-button-default"],
+	primary: ["--zl-primary", "--zl-color-surface-default-white"],
+	on_primary: ["--zl-primary-foreground", "--zl-color-text-button-default"],
 	background: ["--zl-color-surface-default-black"],
 	surface: ["--zl-color-surface-default-primary-gray"],
 	muted: ["--zl-color-surface-default-secondary-gray"],
 	border: ["--zl-color-border-default-gray-200", "--zl-color-border-default-gray-100"],
 	text: ["--zl-color-text-primary-white"],
 	text_muted: ["--zl-color-text-secondary-gray"],
-	link: ["--zl-color-text-subtitle-pink"],
+	link: ["--zl-color-text-link"],
 	success: [
 		"--zl-color-text-success",
 		"--zl-color-border-success",
@@ -2969,6 +3053,13 @@ var ZitadelSurface = class extends LitElement {
 	set theme(value) {
 		this.#_theme_accessor_storage = value;
 	}
+	#_suppressHeader_accessor_storage = false;
+	get suppressHeader() {
+		return this.#_suppressHeader_accessor_storage;
+	}
+	set suppressHeader(value) {
+		this.#_suppressHeader_accessor_storage = value;
+	}
 	themeController = new ThemeController(this);
 	/**
 	* Resolve the active theme and commit it to this element's surface: adopt
@@ -2997,9 +3088,31 @@ __decorate([property({
 	reflect: true
 })], ZitadelSurface.prototype, "variant", null);
 __decorate([property({ type: String })], ZitadelSurface.prototype, "theme", null);
+__decorate([property({
+	type: Boolean,
+	reflect: true,
+	attribute: "suppress-header"
+})], ZitadelSurface.prototype, "suppressHeader", null);
+//#endregion
+//#region src/orchestrator/template-names.ts
+/**
+* Names of the bundled Liquid templates the `<zitadel-login>` orchestrator
+* registers.
+*
+* This lives in its own module — separate from `liquid.ts` — so the public
+* barrel can re-export `TEMPLATE_NAMES` without dragging LiquidJS' `Liquid`
+* type (and its Node ambient-type requirements) into the published
+* declaration surface. See `liquid.ts` / the orchestrator barrel.
+*/
+const TEMPLATE_NAMES = {
+	default: "default",
+	authForm: "auth-form",
+	passkeyUpsell: "passkey-upsell",
+	signedIn: "signed-in"
+};
 //#endregion
 //#region src/orchestrator/templates/layout-chrome.css?inline
-var layout_chrome_default = ":host {\n  color: var(--zl-color-text-primary-white, #f4f4f6);\n  font-family: var(--zl-font-family-sans, system-ui, sans-serif);\n  background: none;\n  display: block;\n}\n\n:host([variant=\"page\"]) {\n  background: var(--zl-color-surface-default-black, #0f0f11);\n  min-height: 100%;\n}\n\n.zl-mount {\n  min-height: var(--zl-page-min-height, auto);\n  background: inherit;\n  color: inherit;\n  flex-direction: column;\n  display: flex;\n  container-type: inline-size;\n}\n\n:host([variant=\"page\"]) .zl-mount {\n  min-height: var(--zl-page-min-height, 100vh);\n}\n\n.zl-mount > zl-page-shell, .zl-mount > [data-zl-template-root] {\n  flex: auto;\n}\n\n.zl-attribution {\n  background: none;\n  justify-content: center;\n  align-items: center;\n  display: flex;\n}\n\n.zl-attribution[hidden] {\n  display: none;\n}\n\n.zl-card-title {\n  font-family: var(--zl-font-family-heading, var(--zl-font-family-sans, system-ui, sans-serif));\n  letter-spacing: -.02em;\n  color: var(--zl-color-text-primary-white, #f4f4f6);\n  text-align: left;\n  margin: 0;\n  font-size: 2rem;\n  font-weight: 700;\n  line-height: 2.5rem;\n}\n\n.zl-card-subtitle {\n  font-family: var(--zl-font-family-sans, system-ui, sans-serif);\n  color: var(--zl-color-text-primary-white, #f4f4f6);\n  margin: 0;\n  font-size: .875rem;\n  font-weight: 400;\n  line-height: 1.25rem;\n}\n\n.zl-card-nav {\n  font-family: var(--zl-font-family-sans, system-ui, sans-serif);\n  color: var(--zl-color-text-primary-white, #f4f4f6);\n  text-align: left;\n  margin: 0;\n  font-size: 1rem;\n  font-weight: 400;\n  line-height: 1.5rem;\n}\n\n.zl-card-nav__link {\n  font: inherit;\n  line-height: inherit;\n  color: var(--zl-color-icon-default-purple, #bba5e4);\n  cursor: pointer;\n  background: none;\n  border: none;\n  margin: 0;\n  padding: 0;\n  text-decoration: none;\n  display: inline;\n}\n\n.zl-card-nav__link:hover {\n  text-decoration: underline;\n}\n\n.zl-card-nav__link:focus-visible {\n  outline: var(--zl-focus-width, 2px) solid var(--zl-focus-color, #f4f4f6);\n  outline-offset: var(--zl-focus-offset, 2px);\n}\n\n.zl-card-forgot {\n  text-align: left;\n  margin: 0;\n}\n\n.zl-card-forgot__link {\n  font-family: var(--zl-font-family-sans, system-ui, sans-serif);\n  color: var(--zl-color-icon-default-purple, #bba5e4);\n  cursor: pointer;\n  background: none;\n  border: none;\n  margin: 0;\n  padding: 0;\n  font-size: 1rem;\n  font-weight: 400;\n  line-height: 1.5rem;\n  text-decoration: none;\n  display: inline;\n}\n\n.zl-card-forgot__link:hover {\n  text-decoration: underline;\n}\n\n.zl-card-forgot__link:focus-visible {\n  outline: var(--zl-focus-width, 2px) solid var(--zl-focus-color, #f4f4f6);\n  outline-offset: var(--zl-focus-offset, 2px);\n}\n\n.zl-split {\n  grid-template-columns: var(--zl-split-columns, minmax(0, 1fr) minmax(0, 1fr));\n  align-items: var(--zl-split-align, center);\n  gap: var(--zl-spacing-05, 2rem);\n  min-height: 100%;\n  display: grid;\n}\n\n.zl-split__brand {\n  justify-content: center;\n  align-items: center;\n  gap: var(--zl-spacing-04, 1.5rem);\n  flex-direction: column;\n  padding: 52px 16px;\n  display: flex;\n}\n\n.zl-split__logo {\n  max-width: min(16rem, 60%);\n}\n\n.zl-split__hero {\n  border-radius: var(--zl-radius-m, .75rem);\n  object-fit: cover;\n  max-width: 100%;\n}\n\n.zl-split__form {\n  justify-content: center;\n  align-items: center;\n  padding: 16px;\n  display: flex;\n}\n\n.zl-split__compact {\n  max-width: min(12rem, 60%);\n  display: none;\n}\n\nimg.zl-split__compact {\n  max-height: 2.5rem;\n}\n\nimg.zl-split__compact--hero {\n  border-radius: var(--zl-radius-m, .75rem);\n  object-fit: cover;\n  width: 100%;\n  max-width: 100%;\n  max-height: 6rem;\n}\n\n.zl-split--right .zl-split__brand {\n  order: 2;\n}\n\n.zl-split--right .zl-split__form {\n  order: 1;\n}\n\n@container (width <= 48rem) {\n  .zl-split {\n    grid-template-columns: minmax(0, 1fr);\n  }\n\n  .zl-split__brand {\n    display: var(--zl-split-brand-mobile, none);\n  }\n\n  .zl-split__form {\n    gap: var(--zl-spacing-04, 1.5rem);\n    flex-direction: column;\n  }\n\n  .zl-split__compact {\n    display: block;\n  }\n}\n\n.zl-hero {\n  text-align: left;\n  width: 100%;\n  max-width: 34rem;\n  color: var(--zl-color-text-primary-white, #f4f4f6);\n  font-family: var(--zl-font-family-sans, system-ui, sans-serif);\n  flex-direction: column;\n  display: flex;\n}\n\n.zl-hero__nav {\n  margin-bottom: var(--zl-spacing-05, 2rem);\n  justify-content: space-between;\n  align-items: center;\n  display: flex;\n}\n\n.zl-hero__brand {\n  align-items: center;\n  gap: var(--zl-spacing-02, .5rem);\n  letter-spacing: -.01em;\n  font-size: 1.125rem;\n  font-weight: 700;\n  display: inline-flex;\n}\n\n.zl-hero__brand-logo {\n  max-height: 1.75rem;\n}\n\n.zl-hero__brand-mark {\n  border-radius: var(--zl-radius-s, .5rem);\n  background: linear-gradient(135deg,\n    var(--zl-color-icon-default-purple, #bba5e4),\n    var(--zl-color-icon-default-pink, #f48aa0));\n  width: 1.75rem;\n  height: 1.75rem;\n  display: inline-flex;\n}\n\n.zl-hero__compact-brand {\n  overflow-wrap: anywhere;\n  letter-spacing: -.01em;\n  max-width: 100%;\n  color: var(--zl-color-text-primary-white, #f4f4f6);\n  margin: 0;\n  font-size: 1.125rem;\n  font-weight: 700;\n}\n\n.zl-hero__nav-links {\n  gap: var(--zl-spacing-04, 1.5rem);\n  color: var(--zl-color-text-secondary-gray, #bfbfcf);\n  font-size: .9375rem;\n  display: flex;\n}\n\n.zl-hero__nav-links a {\n  color: inherit;\n  text-decoration: none;\n}\n\n.zl-hero__nav-links a:hover {\n  text-decoration: underline;\n}\n\n.zl-hero__eyebrow {\n  margin: 0 0 var(--zl-spacing-03, 1rem);\n  letter-spacing: .08em;\n  text-transform: uppercase;\n  color: var(--zl-color-text-subtitle-purple, #bba5e4);\n  font-size: .8125rem;\n  font-weight: 600;\n}\n\n.zl-hero__headline {\n  margin: 0 0 var(--zl-spacing-03, 1rem);\n  font-family: var(--zl-font-family-heading, var(--zl-font-family-sans, system-ui, sans-serif));\n  letter-spacing: -.02em;\n  font-size: 2.75rem;\n  font-weight: 700;\n  line-height: 1.1;\n}\n\n.zl-hero__sub {\n  margin: 0 0 var(--zl-spacing-05, 2rem);\n  max-width: 30rem;\n  color: var(--zl-color-text-secondary-gray, #bfbfcf);\n  font-size: 1.0625rem;\n  line-height: 1.6;\n}\n\n.zl-hero__bullets {\n  gap: var(--zl-spacing-02, .5rem);\n  margin: 0 0 var(--zl-spacing-05, 2rem);\n  flex-direction: column;\n  padding: 0;\n  list-style: none;\n  display: flex;\n}\n\n.zl-hero__bullets li {\n  align-items: center;\n  gap: var(--zl-spacing-02, .5rem);\n  font-size: 1rem;\n  display: flex;\n}\n\n.zl-hero__bullets li:before {\n  content: \"✓\";\n  color: var(--zl-color-icon-default-purple, #bba5e4);\n  font-weight: 700;\n}\n\n.zl-hero__footnote {\n  padding-top: var(--zl-spacing-04, 1.5rem);\n  border-top: 1px solid var(--zl-color-border-default-black, #252528);\n  color: var(--zl-color-text-disabled, #686883);\n  margin: 0;\n  font-size: .8125rem;\n}\n\n.zl-hero__footnote strong {\n  color: var(--zl-color-text-secondary-gray, #bfbfcf);\n  font-weight: 600;\n}\n\n.zl-minimal {\n  gap: var(--zl-spacing-04, 1.5rem);\n  flex-direction: column;\n  width: min(24rem, 100%);\n  margin-inline: auto;\n  display: flex;\n}\n\n:host([variant=\"page\"]) .zl-minimal {\n  padding: 52px 16px;\n}\n";
+var layout_chrome_default = ":host {\n  color: var(--zl-color-text-primary-white, #f4f4f6);\n  font-family: var(--zl-font-family-sans, system-ui, sans-serif);\n  background: none;\n  display: block;\n}\n\n:host([variant=\"page\"]) {\n  background: var(--zl-color-surface-default-black, #0f0f11);\n  min-height: 100%;\n}\n\nimg[data-zl-asset-broken] {\n  display: none;\n}\n\n.zl-mount {\n  min-height: var(--zl-page-min-height, auto);\n  background: inherit;\n  color: inherit;\n  flex-direction: column;\n  display: flex;\n  container-type: inline-size;\n}\n\n:host([variant=\"page\"]) .zl-mount {\n  min-height: var(--zl-page-min-height, 100vh);\n}\n\n.zl-mount > zl-page-shell, .zl-mount > [data-zl-template-root] {\n  flex: auto;\n}\n\n.zl-attribution {\n  background: none;\n  justify-content: center;\n  align-items: center;\n  display: flex;\n}\n\n.zl-attribution[hidden] {\n  display: none;\n}\n\n.zl-card-title {\n  font-family: var(--zl-font-family-heading, var(--zl-font-family-sans, system-ui, sans-serif));\n  letter-spacing: -.02em;\n  color: var(--zl-color-text-primary-white, #f4f4f6);\n  text-align: left;\n  margin: 0;\n  font-size: 2rem;\n  font-weight: 700;\n  line-height: 2.5rem;\n}\n\n.zl-card-subtitle {\n  font-family: var(--zl-font-family-sans, system-ui, sans-serif);\n  color: var(--zl-color-text-primary-white, #f4f4f6);\n  margin: 0;\n  font-size: .875rem;\n  font-weight: 400;\n  line-height: 1.25rem;\n}\n\n[data-suppress-header] .zl-card-title, [data-suppress-header] .zl-card-subtitle {\n  clip-path: inset(50%);\n  white-space: nowrap;\n  border: 0;\n  width: 1px;\n  height: 1px;\n  margin: -1px;\n  padding: 0;\n  position: absolute;\n  overflow: hidden;\n}\n\n.zl-card-nav {\n  font-family: var(--zl-font-family-sans, system-ui, sans-serif);\n  color: var(--zl-color-text-primary-white, #f4f4f6);\n  text-align: left;\n  margin: 0;\n  font-size: 1rem;\n  font-weight: 400;\n  line-height: 1.5rem;\n}\n\n.zl-card-nav__link {\n  font: inherit;\n  line-height: inherit;\n  color: var(--zl-color-text-link, var(--zl-color-icon-default-purple, #bba5e4));\n  cursor: pointer;\n  background: none;\n  border: none;\n  margin: 0;\n  padding: 0;\n  text-decoration: none;\n  display: inline;\n}\n\n.zl-card-nav__link:hover {\n  text-decoration: underline;\n}\n\n.zl-card-nav__link:focus-visible {\n  outline: var(--zl-focus-width, 2px) solid var(--zl-focus-color, #f4f4f6);\n  outline-offset: var(--zl-focus-offset, 2px);\n}\n\n.zl-card-forgot {\n  text-align: left;\n  margin: 0;\n}\n\n.zl-card-forgot__link {\n  font-family: var(--zl-font-family-sans, system-ui, sans-serif);\n  color: var(--zl-color-text-link, var(--zl-color-icon-default-purple, #bba5e4));\n  cursor: pointer;\n  background: none;\n  border: none;\n  margin: 0;\n  padding: 0;\n  font-size: 1rem;\n  font-weight: 400;\n  line-height: 1.5rem;\n  text-decoration: none;\n  display: inline;\n}\n\n.zl-card-forgot__link:hover {\n  text-decoration: underline;\n}\n\n.zl-card-forgot__link:focus-visible {\n  outline: var(--zl-focus-width, 2px) solid var(--zl-focus-color, #f4f4f6);\n  outline-offset: var(--zl-focus-offset, 2px);\n}\n\n.zl-split {\n  grid-template-columns: var(--zl-split-columns, minmax(0, 1fr) minmax(0, 1fr));\n  align-items: var(--zl-split-align, center);\n  gap: var(--zl-spacing-05, 2rem);\n  width: 100%;\n  min-height: 100%;\n  display: grid;\n}\n\n.zl-split__brand {\n  justify-content: center;\n  align-items: center;\n  gap: var(--zl-spacing-04, 1.5rem);\n  flex-direction: column;\n  padding: 52px 16px;\n  display: flex;\n}\n\n.zl-split__logo {\n  max-width: min(16rem, 60%);\n  max-height: var(--zl-split-logo-max-height, 16rem);\n}\n\n.zl-split__logo:has( + .zl-split__hero) {\n  max-height: var(--zl-split-logo-max-height, 8rem);\n}\n\n.zl-split__logo:has( + .zl-split__hero) + .zl-split__hero {\n  max-height: min(var(--zl-split-hero-max-height, 27.5rem),\n    max(6rem,\n      calc(100vh - 104px - 6.5rem - 2.5rem - var(--zl-spacing-04, 1.5rem) -\n          var(--zl-spacing-04, 1.5rem) - var(--zl-split-logo-max-height, 8rem))));\n}\n\n.zl-split__hero {\n  width: 100%;\n  max-height: var(--zl-split-hero-max-height, min(27.5rem, 60vh));\n  border-radius: var(--zl-radius-m, .75rem);\n  object-fit: cover;\n}\n\n.zl-split__placeholder {\n  aspect-ratio: 4 / 5;\n  border-radius: var(--zl-radius-m, .75rem);\n  background: radial-gradient(120% 120% at 18% 12%,\n      var(--zl-color-icon-default-purple, #bba5e4) 0%,\n      transparent 60%),\n    radial-gradient(130% 130% at 85% 92%,\n      var(--zl-color-icon-default-pink, #f48aa0) 0%,\n      transparent 60%),\n    var(--zl-color-surface-default-primary-gray, #252528);\n  width: min(22rem, 85%);\n}\n\n.zl-split__form {\n  justify-content: center;\n  align-items: center;\n  padding: 16px;\n  display: flex;\n}\n\n.zl-split__compact {\n  max-width: min(12rem, 60%);\n  display: none;\n}\n\nimg.zl-split__compact {\n  max-height: 2.5rem;\n}\n\nimg.zl-split__compact--hero {\n  border-radius: var(--zl-radius-m, .75rem);\n  object-fit: cover;\n  width: 100%;\n  max-width: 100%;\n  max-height: 6rem;\n}\n\n.zl-split--right .zl-split__brand {\n  order: 2;\n}\n\n.zl-split--right .zl-split__form {\n  order: 1;\n}\n\nzl-page-shell:has(.zl-split) .zl-attribution {\n  grid-template-columns: var(--zl-split-columns, minmax(0, 1fr) minmax(0, 1fr));\n  gap: var(--zl-spacing-05, 2rem);\n  width: 100%;\n  display: grid;\n}\n\nzl-page-shell:has(.zl-split) .zl-attribution > * {\n  grid-column: 2;\n  justify-self: center;\n}\n\nzl-page-shell:has(.zl-split--right) .zl-attribution > * {\n  grid-column: 1;\n}\n\n@container (width <= 48rem) {\n  .zl-split {\n    grid-template-columns: minmax(0, 1fr);\n  }\n\n  .zl-split__brand {\n    display: var(--zl-split-brand-mobile, none);\n  }\n\n  .zl-split__form {\n    gap: var(--zl-spacing-04, 1.5rem);\n    flex-direction: column;\n  }\n\n  .zl-split__compact {\n    display: block;\n  }\n\n  zl-page-shell:has(.zl-split) .zl-attribution {\n    grid-template-columns: minmax(0, 1fr);\n  }\n\n  zl-page-shell:has(.zl-split) .zl-attribution > *, zl-page-shell:has(.zl-split--right) .zl-attribution > * {\n    grid-column: 1;\n  }\n}\n\n.zl-hero {\n  text-align: left;\n  width: 100%;\n  max-width: 34rem;\n  color: var(--zl-color-text-primary-white, #f4f4f6);\n  font-family: var(--zl-font-family-sans, system-ui, sans-serif);\n  flex-direction: column;\n  display: flex;\n}\n\n.zl-hero__nav {\n  margin-bottom: var(--zl-spacing-05, 2rem);\n  justify-content: space-between;\n  align-items: center;\n  display: flex;\n}\n\n.zl-hero__brand {\n  align-items: center;\n  gap: var(--zl-spacing-02, .5rem);\n  letter-spacing: -.01em;\n  font-size: 1.125rem;\n  font-weight: 700;\n  display: inline-flex;\n}\n\n.zl-hero__brand-logo {\n  max-height: 1.75rem;\n}\n\n.zl-hero__brand-mark {\n  border-radius: var(--zl-radius-s, .5rem);\n  background: linear-gradient(135deg,\n    var(--zl-color-icon-default-purple, #bba5e4),\n    var(--zl-color-icon-default-pink, #f48aa0));\n  width: 1.75rem;\n  height: 1.75rem;\n  display: inline-flex;\n}\n\n.zl-hero__compact-brand {\n  overflow-wrap: anywhere;\n  letter-spacing: -.01em;\n  max-width: 100%;\n  color: var(--zl-color-text-primary-white, #f4f4f6);\n  margin: 0;\n  font-size: 1.125rem;\n  font-weight: 700;\n}\n\n.zl-hero__nav-links {\n  gap: var(--zl-spacing-04, 1.5rem);\n  color: var(--zl-color-text-secondary-gray, #bfbfcf);\n  font-size: .9375rem;\n  display: flex;\n}\n\n.zl-hero__nav-links a {\n  color: inherit;\n  text-decoration: none;\n}\n\n.zl-hero__nav-links a:hover {\n  text-decoration: underline;\n}\n\n.zl-hero__eyebrow {\n  margin: 0 0 var(--zl-spacing-03, 1rem);\n  letter-spacing: .08em;\n  text-transform: uppercase;\n  color: var(--zl-color-text-subtitle-purple, #bba5e4);\n  font-size: .8125rem;\n  font-weight: 600;\n}\n\n.zl-hero__headline {\n  margin: 0 0 var(--zl-spacing-03, 1rem);\n  font-family: var(--zl-font-family-heading, var(--zl-font-family-sans, system-ui, sans-serif));\n  letter-spacing: -.02em;\n  font-size: 2.75rem;\n  font-weight: 700;\n  line-height: 1.1;\n}\n\n.zl-hero__sub {\n  margin: 0 0 var(--zl-spacing-05, 2rem);\n  max-width: 30rem;\n  color: var(--zl-color-text-secondary-gray, #bfbfcf);\n  font-size: 1.0625rem;\n  line-height: 1.6;\n}\n\n.zl-hero__bullets {\n  gap: var(--zl-spacing-02, .5rem);\n  margin: 0 0 var(--zl-spacing-05, 2rem);\n  flex-direction: column;\n  padding: 0;\n  list-style: none;\n  display: flex;\n}\n\n.zl-hero__bullets li {\n  align-items: center;\n  gap: var(--zl-spacing-02, .5rem);\n  font-size: 1rem;\n  display: flex;\n}\n\n.zl-hero__bullets li:before {\n  content: \"✓\";\n  color: var(--zl-color-icon-default-purple, #bba5e4);\n  font-weight: 700;\n}\n\n.zl-hero__footnote {\n  padding-top: var(--zl-spacing-04, 1.5rem);\n  border-top: 1px solid var(--zl-color-border-default-black, #252528);\n  color: var(--zl-color-text-disabled, #686883);\n  margin: 0;\n  font-size: .8125rem;\n}\n\n.zl-hero__footnote strong {\n  color: var(--zl-color-text-secondary-gray, #bfbfcf);\n  font-weight: 600;\n}\n\n.zl-minimal {\n  gap: var(--zl-spacing-04, 1.5rem);\n  flex-direction: column;\n  width: min(24rem, 100%);\n  margin-inline: auto;\n  display: flex;\n}\n\n:host([variant=\"page\"]) .zl-minimal {\n  padding: 52px 16px;\n}\n";
 //#endregion
 //#region src/orchestrator/zitadel-login.ts
 /** Narrow a rendered named element to the `formValue` field-atom contract. */
@@ -3213,8 +3326,13 @@ let ZitadelLogin = class ZitadelLogin extends ZitadelSurface {
 	updated(changed) {
 		if (this.shadowRoot) {
 			stampExportparts(this.shadowRoot);
+			armAssetFallbacks(this.shadowRoot);
 			const widget = this.variant !== "page";
-			for (const shell of this.shadowRoot.querySelectorAll("zl-page-shell")) shell.toggleAttribute("data-widget", widget);
+			for (const shell of this.shadowRoot.querySelectorAll("zl-page-shell")) {
+				shell.toggleAttribute("data-widget", widget);
+				shell.toggleAttribute("data-suppress-header", this.suppressHeader);
+			}
+			for (const card of this.shadowRoot.querySelectorAll("zl-card")) card.toggleAttribute("data-suppress-header", this.suppressHeader);
 		}
 		const props = changed;
 		if (!props.has("response")) return;
@@ -3222,10 +3340,10 @@ let ZitadelLogin = class ZitadelLogin extends ZitadelSurface {
 	}
 	/**
 	* Apply captured values and move focus once the new step has fully
-	* rendered. This commit produces the step's `zl-field`/`zl-button` atoms,
-	* but those render their own shadow DOM on a later microtask — so await
-	* this element's update *and* the child atoms' first render before touching
-	* them, rather than guessing a frame with `requestAnimationFrame`.
+	* rendered. This commit produces the step's field/action atoms, but those
+	* render their own shadow DOM on a later microtask — so await this element's
+	* update *and* the child atoms' first render before touching them, rather
+	* than guessing a frame with `requestAnimationFrame`.
 	*
 	* Focus on the *initial* response is page-mode-only: a dedicated login
 	* route should focus its first field, but a widget embedded further down
@@ -3234,14 +3352,18 @@ let ZitadelLogin = class ZitadelLogin extends ZitadelSurface {
 	*/
 	async hydrateStepAfterRender(initial = false) {
 		await this.updateComplete;
-		const atoms = this.shadowRoot?.querySelectorAll("zl-field, zl-button");
+		const atoms = this.shadowRoot?.querySelectorAll("zl-field, zl-select, zl-checkbox, zl-button");
 		if (atoms) await Promise.all(Array.from(atoms).map((atom) => atom.updateComplete));
 		this.applyValuesToFields();
-		if (!initial || this.variant === "page") this.moveFocusToFirstField();
+		if (!initial || this.variant === "page") this.moveFocusToFirstField(initial && this.variant === "page");
 	}
 	render() {
 		if (this.startupError) return html`<form class="zl-mount" novalidate>
-        <zl-alert severity="error">${this.startupError}</zl-alert>
+        <zl-page-shell>
+          <zl-card>
+            <zl-alert severity="error">${this.startupError}</zl-alert>
+          </zl-card>
+        </zl-page-shell>
       </form>`;
 		if (!this.response || !this.engine) return html`<slot name="loader"></slot>`;
 		const rendered = this.injectAttribution(this.renderStep(this.response.step, this.engine));
@@ -3334,7 +3456,7 @@ let ZitadelLogin = class ZitadelLogin extends ZitadelSurface {
 	applyResponse(wire) {
 		this.stepErrorDismissed = false;
 		this.response = wire;
-		const { branding, issues } = validateBranding(wire.branding);
+		const { branding, issues } = validateBranding(wire.branding, { renderingOrigin: this.ownerDocument.location.origin });
 		this.branding = branding;
 		this.themeController.setBranding(branding);
 		if (issues.length > 0) console.warn("[zitadel-login] branding payload has issues:", issues);
@@ -3694,11 +3816,17 @@ let ZitadelLogin = class ZitadelLogin extends ZitadelSurface {
 		if (!root) return null;
 		return (root.querySelector("zl-button[hierarchy=\"primary\"][type=\"submit\"]") ?? root.querySelector("zl-button[hierarchy=\"primary\"]"))?.getAttribute("action") || null;
 	}
-	moveFocusToFirstField() {
+	/**
+	* On the initial paint, only a field earns focus: script-moved focus with
+	* no prior interaction matches `:focus-visible`, so autofocusing a button
+	* on a field-less step (passkey-first) paints a ring that reads as a
+	* pre-selected state. Step swaps keep button focus — there the browser
+	* derives the modality from the user's actual input.
+	*/
+	moveFocusToFirstField(fieldsOnly = false) {
 		const root = this.shadowRoot;
 		if (!root) return;
-		const focusables = root.querySelectorAll("zl-field, zl-button");
-		Array.from(focusables).find((el) => !el.hasAttribute("disabled"))?.focus();
+		(fieldsOnly ? this.fieldAtoms() : Array.from(root.querySelectorAll("zl-field, zl-select, zl-checkbox, zl-button"))).find((el) => !el.hasAttribute("disabled") && !el.hasAttribute("hidden") && el.getAttribute("type") !== "hidden")?.focus();
 	}
 	async submit(action, challengeResponse) {
 		if (!this.response || this.loading) return;
@@ -4317,6 +4445,18 @@ let ZitadelSession = class ZitadelSession extends ZitadelSurface {
         line-height: 1.25rem;
         color: ${t.color.text.error};
       }
+      /* suppress-header: visually hidden, kept in the accessibility tree. */
+      .title.sr-only {
+        position: absolute;
+        width: 1px;
+        height: 1px;
+        margin: -1px;
+        padding: 0;
+        border: 0;
+        overflow: hidden;
+        clip-path: inset(50%);
+        white-space: nowrap;
+      }
     `];
 	#_project_accessor_storage;
 	get project() {
@@ -4480,9 +4620,13 @@ let ZitadelSession = class ZitadelSession extends ZitadelSurface {
 	render() {
 		return html`
       <zl-page-shell ?data-widget=${this.variant !== "page"}>
-        <zl-card>
-          <h1 slot="header" class="title">${this.heading}</h1>
-          ${this.identityLabel ? html`<p slot="header" class="identity">${this.identityLabel}</p>` : nothing}
+        <zl-card ?data-suppress-header=${this.suppressHeader}>
+          <h1 slot="header" class="title ${this.suppressHeader ? "sr-only" : ""}">
+            ${this.heading}
+          </h1>
+          ${this.identityLabel ? html`<p slot=${this.suppressHeader ? nothing : "header"} class="identity">
+                ${this.identityLabel}
+              </p>` : nothing}
 
           <zl-button
             hierarchy="primary"
@@ -4526,6 +4670,6 @@ __decorate([state()], ZitadelSession.prototype, "loading", null);
 __decorate([state()], ZitadelSession.prototype, "errorMessage", null);
 ZitadelSession = __decorate([customElement("zitadel-session")], ZitadelSession);
 //#endregion
-export { submitStep as C, startFlow as S, MANDATORY_GATES_MARKER as _, ThemeController as a, validateBranding as b, buildBrandingStylesheet as c, builtinLocales as d, businessLocales as f, TEMPLATE_NAMES as g, en as h, layout_chrome_default as i, resolveTheme as l, de as m, ZitadelLogout as n, applyFontUrl as o, it as p, ZitadelLogin as r, applyBrandingTokens as s, ZitadelSession as t, createSanitiser as u, mandatoryGatesMarkerComment as v, getCurrentStep as x, patchMandatoryGates as y };
+export { submitStep as C, startFlow as S, MANDATORY_GATES_MARKER as _, TEMPLATE_NAMES as a, validateBranding as b, applyBrandingTokens as c, createSanitiser as d, builtinLocales as f, en as g, de as h, layout_chrome_default as i, buildBrandingStylesheet as l, it as m, ZitadelLogout as n, ThemeController as o, businessLocales as p, ZitadelLogin as r, applyFontUrl as s, ZitadelSession as t, resolveTheme as u, mandatoryGatesMarkerComment as v, getCurrentStep as x, patchMandatoryGates as y };
 
-//# sourceMappingURL=orchestrator-CctLkpmB.mjs.map
+//# sourceMappingURL=orchestrator-CsHP57zo.mjs.map