@zitadel/components 0.1.0-alpha.9 → 1.0.0-alpha.21

package/dist/index-DFdR16-D.d.mts

@@ -0,0 +1,1599 @@
+import { $ as CreateTeam201, $t as ListUserPasskeysParams, A as CreateFlow201StepChallenge, At as GetReleaseByIdParams, B as CreateGrantParams, Bt as ListBranding200Item, C as CreateBrandingBody, Ct as GetHealthDefault, D as CreateFlow201BrandingLayout, Dt as GetProject200, E as CreateFlow201Branding, Et as GetMyUser200, F as CreateFlowBodyPurpose, Ft as GetUserByID200, G as CreateRelease201, Gt as ListEventsParams, H as CreateProject201, Ht as ListEnvironments200, I as CreateFlowDefinition201, It as GetUserByIDParams, J as CreateSchema201, Jt as ListReleases200, K as CreateReleaseBody, Kt as ListFlowDefinitions200, L as CreateFlowDefinitionBody, Lt as InitClaim201, M as CreateFlow201StepGates, Mt as GetSchemaByIdParams, N as CreateFlow201StepSsoProvidersItem, Nt as GetSession200, O as CreateFlow201Step, Ot as GetReadyDefault, P as CreateFlowBody, Pt as GetTeam200, Q as CreateSessionBody, Qt as ListUserPasskeys200, R as CreateGrant201, Rt as IssueChallenge201, S as CreateBranding201, Sn as VerifyChallengeProofBody, St as GetGrantParams, T as CreateFlow201, Tt as GetMySession200, U as CreateProjectBody, Ut as ListEnvironmentsParams, V as CreateHandoff200, Vt as ListBrandingParams, W as CreateRelease200, Wt as ListEvents200, X as CreateSchemaParams, Xt as ListSchemas200, Y as CreateSchemaBody, Yt as ListReleasesParams, Z as CreateSession201, Zt as ListSchemasParams, _ as BeginUserPasskeyRegistrationBody, _n as UpdateFlowDefinition200, _t as GetEvent200, an as QueryProjectsBody, at as DeleteGrantParams, b as CreateAuthAttempt201, bn as UpdateTeamBody, bt as GetFlowStep200, cn as QuerySessionsParams, ct as ExchangeHandoffParams, dn as QueryTeamsParams, dt as GetAuthAttempt200, en as ListUserTeams200, et as CreateTeamBody, fn as QueryUsers200, ft as GetBrandingById200, g as BeginUserPasskeyRegistration201, gn as SubmitFlowStepBody, gt as GetEnvironmentByNameParams, hn as SubmitFlowStep200, ht as GetEnvironmentByName200, in as QueryProjects200, it as CreateUserParams, j as CreateFlow201StepFieldsItem, jt as GetSchemaById200, k as CreateFlow201StepActionsItem, kt as GetReleaseById200, ln as QueryTeams200, lt as FinishUserPasskeyRegistration201, mn as SetUserPasswordBody, mt as GetClaimStatusParams, nn as PatchProject200, nt as CreateUser201, on as QuerySessions200, ot as ExchangeHandoff200, pn as QueryUsersBody, pt as GetClaimStatus200, q as CreateReleaseParams, qt as ListFlowDefinitionsParams, rn as PatchProjectBody, rt as CreateUserBody, sn as QuerySessionsBody, st as ExchangeHandoffBody, tn as ListUserTeamsParams, tt as CreateTeamParams, un as QueryTeamsBody, ut as FinishUserPasskeyRegistrationBody, v as CompleteClaim200, vn as UpdateFlowDefinitionBody, vt as GetEventParams, w as CreateBrandingParams, wt as GetLiveDefault, x as CreateAuthAttemptBody, xn as VerifyChallengeProof200, xt as GetGrant200, y as CompleteClaimBody, yn as UpdateTeam200, yt as GetFlowDefinition200, z as CreateGrantBody, zt as IssueChallengeBody } from "./index-Dx8rvpNs.mjs";
+import * as _$lit from "lit";
+import { LitElement, PropertyValues, ReactiveController, ReactiveControllerHost, nothing } from "lit";
+import layoutChromeCss from "./templates/layout-chrome.css?inline";
+
+//#region ../api/dist/zitadelNextGen-C8m49W5h.d.mts
+//#region src/generated/endpoints/zitadelNextGen.d.ts
+declare namespace zitadelNextGen_d_exports {
+  export { beginUserPasskeyRegistration, completeClaim, createAuthAttempt, createBranding, createFlow, createFlowDefinition, createGrant, createHandoff, createProject, createRelease, createSchema, createSession, createTeam, createUser, deleteFlowDefinition, deleteGrant, deleteTeam, deleteUserByID, exchangeHandoff, finishUserPasskeyRegistration, getAuthAttempt, getBeginUserPasskeyRegistrationUrl, getBrandingById, getClaimStatus, getCompleteClaimUrl, getCreateAuthAttemptUrl, getCreateBrandingUrl, getCreateFlowDefinitionUrl, getCreateFlowUrl, getCreateGrantUrl, getCreateHandoffUrl, getCreateProjectUrl, getCreateReleaseUrl, getCreateSchemaUrl, getCreateSessionUrl, getCreateTeamUrl, getCreateUserUrl, getDeleteFlowDefinitionUrl, getDeleteGrantUrl, getDeleteTeamUrl, getDeleteUserByIDUrl, getEnvironmentByName, getEvent, getExchangeHandoffUrl, getFinishUserPasskeyRegistrationUrl, getFlowDefinition, getFlowStep, getGetAuthAttemptUrl, getGetBrandingByIdUrl, getGetClaimStatusUrl, getGetEnvironmentByNameUrl, getGetEventUrl, getGetFlowDefinitionUrl, getGetFlowStepUrl, getGetGrantUrl, getGetHealthUrl, getGetLiveUrl, getGetMySessionUrl, getGetMyUserUrl, getGetProjectUrl, getGetReadyUrl, getGetReleaseByIdUrl, getGetSchemaByIdUrl, getGetSessionUrl, getGetTeamUrl, getGetUserByIDUrl, getGrant, getHealth, getInitClaimUrl, getIssueChallengeUrl, getListBrandingUrl, getListEnvironmentsUrl, getListEventsUrl, getListFlowDefinitionsUrl, getListReleasesUrl, getListSchemasUrl, getListUserPasskeysUrl, getListUserTeamsUrl, getLive, getMySession, getMyUser, getPatchProjectUrl, getProject, getQueryProjectsUrl, getQuerySessionsUrl, getQueryTeamsUrl, getQueryUsersUrl, getReady, getReleaseById, getRevokeMySessionUrl, getRevokeSessionUrl, getSchemaById, getSession, getSetUserPasswordUrl, getSubmitFlowStepUrl, getTeam, getUpdateFlowDefinitionUrl, getUpdateTeamUrl, getUserByID, getVerifyChallengeProofUrl, initClaim, issueChallenge, listBranding, listEnvironments, listEvents, listFlowDefinitions, listReleases, listSchemas, listUserPasskeys, listUserTeams, patchProject, queryProjects, querySessions, queryTeams, queryUsers, revokeMySession, revokeSession, setUserPassword, submitFlowStep, updateFlowDefinition, updateTeam, verifyChallengeProof };
+}
+declare const getGetHealthUrl: () => string;
+/**
+ * Check whether the server is healthy
+ * @summary Check server health
+ */
+declare const getHealth: (options?: RequestInit) => Promise<GetHealthDefault>;
+declare const getGetLiveUrl: () => string;
+/**
+ * Check whether the server is started
+ * @summary Check server liveness
+ */
+declare const getLive: (options?: RequestInit) => Promise<GetLiveDefault>;
+declare const getGetReadyUrl: () => string;
+/**
+ * Check whether the server is ready to accept requests
+ * @summary Check server readiness
+ */
+declare const getReady: (options?: RequestInit) => Promise<GetReadyDefault>;
+declare const getCreateUserUrl: (params: CreateUserParams) => string;
+/**
+ * @summary Create user
+ */
+declare const createUser: (createUserBody: CreateUserBody, params: CreateUserParams, options?: RequestInit) => Promise<CreateUser201>;
+declare const getQueryUsersUrl: () => string;
+/**
+ * Returns the users of a project, paginated with a cursor.
+
+The project comes from the credential, not from a parameter: the operation
+is bound to the token's own project by construction. This is why it takes
+no `project_id`, unlike the other query endpoints.
+
+ * @summary Query users
+ */
+declare const queryUsers: (queryUsersBody: QueryUsersBody, options?: RequestInit) => Promise<QueryUsers200>;
+declare const getGetUserByIDUrl: (userId: string, params?: GetUserByIDParams) => string;
+/**
+ * @summary Get user by ID
+ */
+declare const getUserByID: (userId: string, params?: GetUserByIDParams, options?: RequestInit) => Promise<GetUserByID200>;
+declare const getDeleteUserByIDUrl: (userId: string) => string;
+/**
+ * @summary Delete user by ID
+ */
+declare const deleteUserByID: (userId: string, options?: RequestInit) => Promise<void>;
+declare const getListUserPasskeysUrl: (userId: string, params?: ListUserPasskeysParams) => string;
+/**
+ * @summary List user passkeys
+ */
+declare const listUserPasskeys: (userId: string, params?: ListUserPasskeysParams, options?: RequestInit) => Promise<ListUserPasskeys200>;
+declare const getBeginUserPasskeyRegistrationUrl: (userId: string) => string;
+/**
+ * Starts a WebAuthn registration ceremony for the user and returns the
+creation options for `navigator.credentials.create()`. Complete the
+ceremony with `POST /users/{user_id}/passkeys/registrations/{registration_id}` within
+five minutes. Credentials already registered for the user are excluded
+automatically.
+
+ * @summary Begin passkey registration
+ */
+declare const beginUserPasskeyRegistration: (userId: string, beginUserPasskeyRegistrationBody: BeginUserPasskeyRegistrationBody, options?: RequestInit) => Promise<BeginUserPasskeyRegistration201>;
+declare const getFinishUserPasskeyRegistrationUrl: (userId: string, registrationId: string) => string;
+/**
+ * Verifies the attestation against the ceremony started by
+`POST /users/{user_id}/passkeys/registrations` and persists the new credential. A
+rejected attestation counts against the ceremony's failure budget and the
+ceremony stays open for a retry. An expired ceremony surfaces as
+`att.stale_challenge`; an unknown or already-consumed registration id
+surfaces as `att.not_found`.
+
+ * @summary Finish passkey registration
+ */
+declare const finishUserPasskeyRegistration: (userId: string, registrationId: string, finishUserPasskeyRegistrationBody: FinishUserPasskeyRegistrationBody, options?: RequestInit) => Promise<FinishUserPasskeyRegistration201>;
+declare const getSetUserPasswordUrl: (userId: string) => string;
+/**
+ * @summary Set user password
+ */
+declare const setUserPassword: (userId: string, setUserPasswordBody: SetUserPasswordBody, options?: RequestInit) => Promise<void>;
+declare const getListUserTeamsUrl: (userId: string, params?: ListUserTeamsParams) => string;
+/**
+ * The user's team roster, ordered by team name. Each entry carries the
+team's name, so a client renders a page without resolving ids one by one.
+
+This is the N:N roster and it is not lifecycle ownership: the single team
+that owns the user's lifecycle is reported as `metadata.lifecycle_owner_team_id`
+on the user read endpoints. Memberships the user was removed from are not
+returned.
+
+ * @summary List the teams a user belongs to
+ */
+declare const listUserTeams: (userId: string, params?: ListUserTeamsParams, options?: RequestInit) => Promise<ListUserTeams200>;
+declare const getGetMyUserUrl: () => string;
+/**
+ * @summary Get my user information
+ */
+declare const getMyUser: (options?: RequestInit) => Promise<GetMyUser200>;
+declare const getCreateFlowUrl: () => string;
+/**
+ * Resolves a flow definition based on purpose + audience context and returns
+the first capability step. Creates a new session implicitly unless
+`session_id` is provided (for step-up / reauth on an existing session).
+
+The response contains an `id` field — the flow handle. Use it as the path
+parameter for all subsequent `/flow/{id}/submit` calls.
+
+The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
+the flow's orchestration state (current step, collected data, history).
+The server is stateless between requests — all flow state lives in this
+cookie. The browser sends it automatically on subsequent requests.
+
+ * @summary Start a new flow
+ */
+declare const createFlow: (createFlowBody: CreateFlowBody, options?: RequestInit) => Promise<CreateFlow201>;
+declare const getGetFlowStepUrl: (id: string) => string;
+/**
+ * Returns the current capability step without advancing the state machine.
+Useful for page reloads or re-rendering after a network error.
+
+ * @summary Get current step (re-render)
+ */
+declare const getFlowStep: (id: string, options?: RequestInit) => Promise<GetFlowStep200>;
+declare const getSubmitFlowStepUrl: (id: string) => string;
+/**
+ * Submits user input for the current step. The server validates,
+processes (e.g., verifies a credential), advances the state machine
+through any invisible steps, and returns the next visible step.
+
+The response sets an updated encrypted `HttpOnly` cookie (`_zflow`)
+with the new flow state. The server is stateless — all orchestration
+state is carried in this cookie between requests.
+
+**Important:** The `id` in the response may differ from the `id` used in
+the request. This happens when a flow pivots (pushes a new flow onto the
+stack) or when a stacked flow completes (auto-pops to the parent flow).
+Always use the `id` from the latest response for the next request.
+
+## Flow completion
+
+When `step.type` is `complete`, the flow is terminal. The `step.behavior`
+field tells the frontend what to do:
+
+| `behavior`   | Action                                                     |
+|------------- |------------------------------------------------------------|
+| `redirect`   | Navigate to `redirect_uri` (OIDC/SAML auth request done). |
+| `show`       | Render the step as a success screen (e.g., registration).  |
+
+A `complete` step is only returned when the **entire flow stack** is done.
+If a stacked flow (e.g., recovery pivoted from login) finishes, the server
+auto-pops to the parent flow and returns the parent's next step — the
+frontend never sees a `complete` for intermediate flows.
+
+ * @summary Submit step data and advance
+ */
+declare const submitFlowStep: (id: string, submitFlowStepBody: SubmitFlowStepBody, options?: RequestInit) => Promise<SubmitFlowStep200>;
+declare const getCreateAuthAttemptUrl: () => string;
+/**
+ * Starts a new authentication attempt. This is the entry point for the auth_attempts state machine.
+
+An attempt is an ephemeral (15-minute TTL) state machine that drives a single authentication round.
+It accepts factor challenges, verifies proofs, and completes into a session or handoff token.
+
+Accepts a project_id and challenge_nonce (from POST /bootstrap/challenge). For step-up re-auth,
+also include session_id to add factors to an existing session.
+
+ * @summary Create a new authentication attempt
+ */
+declare const createAuthAttempt: (createAuthAttemptBody: CreateAuthAttemptBody, options?: RequestInit) => Promise<CreateAuthAttempt201>;
+declare const getGetAuthAttemptUrl: (attemptId: string) => string;
+/**
+ * Polls the current state of an authentication attempt.
+
+Returns the attempt's state, available factors for the next challenge,
+challenges issued so far, and any errors preventing progress.
+
+Use this for polling during long-running factor verifications (e.g., waiting for
+a federated IdP callback or a device flow).
+
+ * @summary Get authentication attempt state
+ */
+declare const getAuthAttempt: (attemptId: string, options?: RequestInit) => Promise<GetAuthAttempt200>;
+declare const getIssueChallengeUrl: (attemptId: string) => string;
+/**
+ * Issues a single-factor verification challenge within an auth attempt.
+
+This advances the authentication state machine by requesting a specific factor method
+(password, passkey, TOTP, OTP via SMS, etc.). The server responds with challenge details
+including method, metadata, and any UI hints. The client then verifies the proof
+by calling POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.
+
+ * @summary Issue a factor challenge
+ */
+declare const issueChallenge: (attemptId: string, issueChallengeBody: IssueChallengeBody, options?: RequestInit) => Promise<IssueChallenge201>;
+declare const getVerifyChallengeProofUrl: (attemptId: string, challengeId: string) => string;
+/**
+ * Submits a proof (credential, code, assertion) to verify a factor challenge.
+
+The proof format depends on the challenge method. For example:
+- `password` method: { password: "…" }
+- `totp` method: { totp: { code: "123456" } }
+- `passkey` method: { passkey: { assertion: "…" } }
+- `recovery_code` method: { recovery_code: "…" }
+
+On successful verification, the factor is written to the auth attempt.
+The attempt moves to the next pending challenge or completes if all required factors are verified.
+
+ * @summary Verify a factor proof
+ */
+declare const verifyChallengeProof: (attemptId: string, challengeId: string, verifyChallengeProofBody: VerifyChallengeProofBody, options?: RequestInit) => Promise<VerifyChallengeProof200>;
+declare const getCreateHandoffUrl: (attemptId: string) => string;
+/**
+ * Completes the authentication attempt and mints a `handoff_token`.
+
+Call this after all required factors have been verified and the attempt is in `completed` state.
+The handoff token is short-lived (≤60 seconds) and must be exchanged at
+POST /sessions/exchange to receive the final session and session_token.
+
+The handoff token is:
+- Single-use (atomic exchange, no retry)
+- Audience-bound (requires matching project key for exchange)
+- Idempotency-safe within a 5-minute window (see conventions)
+
+ * @summary Complete authentication and create handoff token
+ */
+declare const createHandoff: (attemptId: string, options?: RequestInit) => Promise<CreateHandoff200>;
+declare const getCreateProjectUrl: () => string;
+/**
+ * @summary Create project
+ */
+declare const createProject: (createProjectBody: CreateProjectBody, options?: RequestInit) => Promise<CreateProject201>;
+declare const getQueryProjectsUrl: () => string;
+/**
+ * @summary Query projects
+ */
+declare const queryProjects: (queryProjectsBody: QueryProjectsBody, options?: RequestInit) => Promise<QueryProjects200>;
+declare const getGetProjectUrl: (projectId: string) => string;
+/**
+ * Returns the current state of a project.
+
+ * @summary Get project
+ */
+declare const getProject: (projectId: string, options?: RequestInit) => Promise<GetProject200>;
+declare const getPatchProjectUrl: (projectId: string) => string;
+/**
+ * Updates the state of a project.
+
+ * @summary Update project
+ */
+declare const patchProject: (projectId: string, patchProjectBody: PatchProjectBody, options?: RequestInit) => Promise<PatchProject200>;
+declare const getInitClaimUrl: (projectId: string) => string;
+/**
+ * Starts a claim challenge for an unclaimed project. Authenticated by the
+project secret, this mints a single-use, short-lived challenge and returns
+the `claim_url` the developer opens in a browser to complete the claim,
+together with the `challenge_id` the CLI polls with. The exact expiry is
+carried by `expires_at` on the response.
+
+ * @summary Initialize a project claim
+ */
+declare const initClaim: (projectId: string, options?: RequestInit) => Promise<InitClaim201>;
+declare const getGetClaimStatusUrl: (projectId: string, params: GetClaimStatusParams) => string;
+/**
+ * Polled by the CLI while a browser completes the claim. Authorized by the
+project secret that initiated the challenge. Returns `pending`, or
+`completed` with the owning team, the claim timestamp, and the dashboard
+URL once the browser leg has finished.
+
+ * @summary Get claim status
+ */
+declare const getClaimStatus: (projectId: string, params: GetClaimStatusParams, options?: RequestInit) => Promise<GetClaimStatus200>;
+declare const getCompleteClaimUrl: (projectId: string) => string;
+/**
+ * Called by the browser after the developer authenticates on the claim page.
+Authenticated by the `__nextgen_session` cookie, it attaches the project to
+the developer's personal team using the `challenge_id` from the claim URL as
+its single-use, browser-safe authorization.
+
+ * @summary Complete a project claim
+ */
+declare const completeClaim: (projectId: string, completeClaimBody: CompleteClaimBody, options?: RequestInit) => Promise<CompleteClaim200>;
+declare const getCreateSessionUrl: () => string;
+/**
+ * Creates an anonymous session shell with no user and no factors (`state: building`).
+
+This is optional — an `auth_attempt` will create a session implicitly if none is provided.
+Use this explicitly when you want to:
+- Pre-allocate a `session_id` before the user is known, so device/telemetry signals
+  can be correlated with the eventual authenticated session from the start.
+- Track anonymous state (bot detection, device fingerprint) that survives until authentication.
+
+Creating a session is an app-plane operation on the project credential
+(`session.write`). The returned `session_token` is a session credential for the
+end-user client, not a management scope: it is delivered as the
+`__nextgen_session` cookie and authorises the self-service operations
+`GET /sessions/me` and `DELETE /sessions/me` (`nextgenSession` scheme). The
+by-id operations `GET /sessions/{session_id}` and `DELETE /sessions/{session_id}`
+are operator endpoints and require `session.read` / `session.delete` instead.
+
+The `session_token` is superseded when a handoff exchange completes — clients must
+replace it at that point.
+
+Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
+full session TTL when the first authentication factor is written via a completing `auth_attempt`.
+
+ * @summary Create an anonymous session shell
+ */
+declare const createSession: (createSessionBody: CreateSessionBody, options?: RequestInit) => Promise<CreateSession201>;
+declare const getQuerySessionsUrl: (params: QuerySessionsParams) => string;
+/**
+ * Returns the sessions of a project, paginated with a cursor.
+Sessions of every lifecycle state are returned; each carries its `state`.
+Requires `session.read` permission.
+
+ * @summary Query sessions
+ */
+declare const querySessions: (querySessionsBody: QuerySessionsBody, params: QuerySessionsParams, options?: RequestInit) => Promise<QuerySessions200>;
+declare const getExchangeHandoffUrl: (params: ExchangeHandoffParams) => string;
+/**
+ * Consumes a one-time `handoff_token` minted by `POST /auth_attempts/{id}/handoff`
+and returns the resulting session and a `session_token`.
+
+The server resolves the originating `auth_attempt` from the token and then:
+
+| Originating auth_attempt | Outcome |
+|---|---|
+| No `session_id` | A new authenticated session is **created**. |
+| `session_id` points to an anonymous shell | Existing session is **upgraded** — user and factors written in, TTL reset to full session TTL. |
+| `session_id` points to an active session (step-up) | Existing session is **upgraded** — new factors merged, `assurance_levels[]` expanded. |
+
+The response shape is identical in all three cases.
+
+The `session_token` supersedes any previously issued `session_token` for the same session.
+Clients must replace their stored token at this point.
+
+Requires a project service key (OAuth2 client credentials).
+
+ * @summary Exchange handoff token for a session
+ */
+declare const exchangeHandoff: (exchangeHandoffBody: ExchangeHandoffBody, params: ExchangeHandoffParams, options?: RequestInit) => Promise<ExchangeHandoff200>;
+declare const getGetSessionUrl: (sessionId: string) => string;
+/**
+ * Returns the current state of a session including its factors and all currently
+satisfied assurance levels.
+
+`assurance_levels[]` may shrink over time as factor freshness windows expire,
+without the session itself expiring. Use step-up authentication (a new `auth_attempt`
+against the same `session_id`) to restore a dropped assurance level.
+
+ * @summary Get session state
+ */
+declare const getSession: (sessionId: string, options?: RequestInit) => Promise<GetSession200>;
+declare const getRevokeSessionUrl: (sessionId: string) => string;
+/**
+ * Permanently deletes the session, terminating it immediately.
+
+This is the operator revoke path and requires the `session.delete` scope on a
+project-bound credential. End-user logout with the `__nextgen_session` cookie is
+`DELETE /sessions/me` (`nextgenSession` scheme).
+
+Idempotent: deleting a session that does not exist (or was already deleted)
+still returns 204. After deletion, any tokens derived from the session are
+invalidated.
+
+ * @summary Revoke session
+ */
+declare const revokeSession: (sessionId: string, options?: RequestInit) => Promise<void>;
+declare const getGetMySessionUrl: () => string;
+/**
+ * Returns the current state of the current session including its factors and all currently
+satisfied assurance levels.
+
+`assurance_levels[]` may shrink over time as factor freshness windows expire,
+without the session itself expiring. Use step-up authentication (a new `auth_attempt`
+against the same `session_id`) to restore a dropped assurance level.
+
+ * @summary Get my session state
+ */
+declare const getMySession: (options?: RequestInit) => Promise<GetMySession200>;
+declare const getRevokeMySessionUrl: () => string;
+/**
+ * Logs out by permanently deleting the session.
+
+The `__nextgen_session` cookie issued at creation (or superseded by a handoff
+exchange) is required. Idempotent: if the session is already gone this still
+returns 204. Any tokens derived from the session are invalidated, and the
+cookie itself is cleared in the response.
+
+ * @summary Revoke my session
+ */
+declare const revokeMySession: (options?: RequestInit) => Promise<void>;
+declare const getCreateSchemaUrl: (params: CreateSchemaParams) => string;
+/**
+ * Create a new schema. The optional `$id` field is the JSON Schema document
+URI used to identify the schema in future requests (GitOps-stable identity,
+not a free-form resource primary key). When `$id` is omitted, the server
+generates a `sch_*` URL. When provided, `$id` must be unique within the
+project and should ideally be a valid URI pointing at where the schema can
+be accessed.
+
+The schema can either be a concrete schema, e.g. a user schema, or a
+schema-url which will be resolved by the server.
+
+ * @summary Create new schema
+ */
+declare const createSchema: (createSchemaBody: CreateSchemaBody, params: CreateSchemaParams, options?: RequestInit) => Promise<CreateSchema201>;
+declare const getListSchemasUrl: (params: ListSchemasParams) => string;
+/**
+ * Retrieve a list of all schemas available in the system. This endpoint
+supports pagination and filtering based on schema attributes.
+
+ * @summary List all schemas
+ */
+declare const listSchemas: (params: ListSchemasParams, options?: RequestInit) => Promise<ListSchemas200>;
+declare const getGetSchemaByIdUrl: (id: string, params?: GetSchemaByIdParams) => string;
+/**
+ * Get a schema by its ID. A schema ID identifies one immutable revision, so
+this returns exactly that revision. To find the current revision of an
+object type, list with `revisions=latest`.
+
+ * @summary Get schema by ID
+ */
+declare const getSchemaById: (id: string, params?: GetSchemaByIdParams, options?: RequestInit) => Promise<GetSchemaById200>;
+declare const getCreateFlowDefinitionUrl: () => string;
+/**
+ * Creates a new flow definition.
+Flow definitions are templates that define the sequence of steps (capabilities)
+for a particular user journey (e.g., registration, login, password reset).
+
+Flow definitions are created based on the flow definition schema, which includes the flow's purpose, audience, and the steps involved.
+
+ * @summary Create a new flow definition
+ */
+declare const createFlowDefinition: (createFlowDefinitionBody: CreateFlowDefinitionBody, options?: RequestInit) => Promise<CreateFlowDefinition201>;
+declare const getListFlowDefinitionsUrl: (params: ListFlowDefinitionsParams) => string;
+/**
+ * Retrieves a list of all flow definitions.
+This endpoint can be used to view existing flow definitions and their configurations.
+
+ * @summary List flow definitions
+ */
+declare const listFlowDefinitions: (params: ListFlowDefinitionsParams, options?: RequestInit) => Promise<ListFlowDefinitions200>;
+declare const getGetFlowDefinitionUrl: (id: string) => string;
+/**
+ * Get a flow definition by id
+ * @summary Get a flow definition by id
+ */
+declare const getFlowDefinition: (id: string, options?: RequestInit) => Promise<GetFlowDefinition200>;
+declare const getUpdateFlowDefinitionUrl: (id: string) => string;
+/**
+ * Update a flow definition by id. This endpoint replaces the existing flow definition.
+If `flow_definition.status` is omitted, the current status is preserved
+
+ * @summary Update a flow definition by id
+ */
+declare const updateFlowDefinition: (id: string, updateFlowDefinitionBody: UpdateFlowDefinitionBody, options?: RequestInit) => Promise<UpdateFlowDefinition200>;
+declare const getDeleteFlowDefinitionUrl: (id: string) => string;
+/**
+ * Delete a flow definition by id.
+If the flow definition is currently being used by a flow, the deletion will fail.
+If the flow definition is the last active flow definition for a given purpose, the deletion will fail to prevent disruption of new flows being started for that purpose.
+
+ * @summary Delete a flow definition by id
+ */
+declare const deleteFlowDefinition: (id: string, options?: RequestInit) => Promise<void>;
+declare const getCreateTeamUrl: (params: CreateTeamParams) => string;
+/**
+ * @summary Create team
+ */
+declare const createTeam: (createTeamBody: CreateTeamBody, params: CreateTeamParams, options?: RequestInit) => Promise<CreateTeam201>;
+declare const getQueryTeamsUrl: (params: QueryTeamsParams) => string;
+/**
+ * Returns the teams of a project, paginated with a cursor.
+
+ * @summary Query teams
+ */
+declare const queryTeams: (queryTeamsBody: QueryTeamsBody, params: QueryTeamsParams, options?: RequestInit) => Promise<QueryTeams200>;
+declare const getGetTeamUrl: (teamId: string) => string;
+/**
+ * Returns a Team by its id.
+
+ * @summary Get team
+ */
+declare const getTeam: (teamId: string, options?: RequestInit) => Promise<GetTeam200>;
+declare const getDeleteTeamUrl: (teamId: string) => string;
+/**
+ * Deactivates the team.
+
+The team is tombstoned rather than erased: it stays readable through
+getTeam with status `deactivated`. Its memberships are removed and the
+users whose lifecycle it owns are deactivated with it.
+
+The request is idempotent. Deleting a team that is already deactivated
+or doesn't exist succeeds without changing anything.
+
+ * @summary Delete team
+ */
+declare const deleteTeam: (teamId: string, options?: RequestInit) => Promise<void>;
+declare const getUpdateTeamUrl: (teamId: string) => string;
+/**
+ * Update team. Only active teams can be updated.
+
+ * @summary Update team
+ */
+declare const updateTeam: (teamId: string, updateTeamBody: UpdateTeamBody, options?: RequestInit) => Promise<UpdateTeam200>;
+declare const getListEnvironmentsUrl: (params: ListEnvironmentsParams) => string;
+/**
+ * Lists the project's environments ordered by name.
+
+ * @summary List environments
+ */
+declare const listEnvironments: (params: ListEnvironmentsParams, options?: RequestInit) => Promise<ListEnvironments200>;
+declare const getGetEnvironmentByNameUrl: (name: string, params: GetEnvironmentByNameParams) => string;
+/**
+ * Reads one environment of the project by its name.
+
+The lookup is scoped to the project in `project_id`: a name that exists in
+another project answers `env.not_found` exactly as an unused name does.
+
+ * @summary Get an environment by name
+ */
+declare const getEnvironmentByName: (name: string, params: GetEnvironmentByNameParams, options?: RequestInit) => Promise<GetEnvironmentByName200>;
+declare const getCreateBrandingUrl: (params: CreateBrandingParams) => string;
+/**
+ * Publishes a new immutable branding revision for the project. Branding
+revisions cannot be updated or deleted; every edit publishes a new
+revision, and flow responses resolve the latest revision per project
+(see ADR 040).
+
+The `liquid_template` is validated lexically on save (size, encoding,
+banned patterns such as `<script>` tags, inline event handlers, and the
+`| raw` filter). Authoritative LiquidJS validation runs at authoring
+time via `zitadel plan` / `zitadel apply`.
+
+ * @summary Publish a new branding revision
+ */
+declare const createBranding: (createBrandingBody: CreateBrandingBody, params: CreateBrandingParams, options?: RequestInit) => Promise<CreateBranding201>;
+declare const getListBrandingUrl: (params: ListBrandingParams) => string;
+/**
+ * Lists branding revisions for the project, newest first, capped at the
+100 most recent. The first entry is the revision flow responses
+currently resolve. Deliberately unpaginated in v1 — list endpoints
+gain a real query mechanism together (ADR 031); advertising pagination
+parameters the server ignores would be worse than none.
+
+ * @summary List branding revisions
+ */
+declare const listBranding: (params: ListBrandingParams, options?: RequestInit) => Promise<ListBranding200Item[]>;
+declare const getGetBrandingByIdUrl: (id: string) => string;
+/**
+ * Retrieves a single branding revision, including its stored configuration.
+ * @summary Get a branding revision by ID
+ */
+declare const getBrandingById: (id: string, options?: RequestInit) => Promise<GetBrandingById200>;
+declare const getCreateReleaseUrl: (params: CreateReleaseParams) => string;
+/**
+ * Bundles a release from revisions that already exist, supplied as
+`(kind, revision_id)` pairs. No new revisions are allocated — use the
+per-kind create endpoints for that, then pin the ids here.
+
+Every referenced `revision_id` must exist in the project. Each one's handle
+is read from the revision itself and recorded on the release, so a resource
+is always pinned under the identity it declares.
+
+Creating a release does not deploy it. A release is environment-agnostic
+and the same release can later be deployed to any number of environments
+unchanged.
+
+Idempotent on the pinned set: metadata is excluded from the comparison, so
+re-submitting the same revisions with a different `message` returns the
+release that already pins them rather than creating a second one.
+
+ * @summary Create a release
+ */
+declare const createRelease: (createReleaseBody: CreateReleaseBody, params: CreateReleaseParams, options?: RequestInit) => Promise<CreateRelease200 | CreateRelease201>;
+declare const getListReleasesUrl: (params: ListReleasesParams) => string;
+/**
+ * Lists the project's releases, newest first.
+
+Entries carry metadata only — the pinned set is omitted. Read one release
+with `GET /releases/{release_id}` to get its pointers.
+
+ * @summary List releases
+ */
+declare const listReleases: (params: ListReleasesParams, options?: RequestInit) => Promise<ListReleases200>;
+declare const getGetReleaseByIdUrl: (releaseId: string, params: GetReleaseByIdParams) => string;
+/**
+ * Reads one release: its metadata and the `(kind, handle, revision_id)`
+tuples it pins.
+
+Does not embed resource content. Resolve each `revision_id` through the
+per-kind read endpoints when the bytes are needed.
+
+The lookup is scoped to the project in `project_id`: a release id belonging
+to another project answers not found exactly as an unknown id does, so the
+endpoint cannot be used to probe for releases in projects the caller cannot
+read.
+
+ * @summary Get a release by id
+ */
+declare const getReleaseById: (releaseId: string, params: GetReleaseByIdParams, options?: RequestInit) => Promise<GetReleaseById200>;
+declare const getCreateGrantUrl: (params: CreateGrantParams) => string;
+/**
+ * Bind a user or team to `project.viewer`, `project.editor`, or
+`project.admin` on the project identified by the `project-id` header.
+IDs are `asgn_<opaque>`. Owning-team (`project.team`) grants are not
+created here — claim owns that path. An unrevoked grant with the same
+principal and relation occupies the unique key even after `expires_at`;
+DELETE it before re-creating.
+
+ * @summary Create grant
+ */
+declare const createGrant: (createGrantBody: CreateGrantBody, params: CreateGrantParams, options?: RequestInit) => Promise<CreateGrant201>;
+declare const getGetGrantUrl: (id: string, params: GetGrantParams) => string;
+/**
+ * Loads a grant by `(project_id, id)` that this API manages (user or team
+bound to viewer, editor, or admin) and that has not been revoked.
+"Active" here means not revoked: expired grants stay visible so the
+client can DELETE before re-granting the same binding. Authorization
+still ignores expired grants. Grants are not registered in
+`resource_scope_index`; project scope is required on the query (same as
+events). Misses, revoked rows, project-secret setup (`sk_proj`),
+owning-team (`relation=team`) rows, and cross-project ids return 404.
+
+ * @summary Get grant
+ */
+declare const getGrant: (id: string, params: GetGrantParams, options?: RequestInit) => Promise<GetGrant200>;
+declare const getDeleteGrantUrl: (id: string, params: DeleteGrantParams) => string;
+/**
+ * Soft-revokes a grant this API manages and emits `authz.revoked`.
+Already-revoked, missing, project-secret setup, and owning-team grants
+return 404. The row is not un-revoked. Expired grants can still be
+revoked so the unique binding can be reused.
+
+ * @summary Revoke grant
+ */
+declare const deleteGrant: (id: string, params: DeleteGrantParams, options?: RequestInit) => Promise<void>;
+declare const getListEventsUrl: (params: ListEventsParams) => string;
+/**
+ * Returns project-scoped audit events, newest-first by keyset on
+`(created_at, id)` (ADR 027 / ADR 049). Pass `order=asc` for oldest-first.
+Requires `events.read`.
+
+Pre-claim projects return an empty list (events are stored but not
+visible until claim succeeds). Team-scoped credentials see only events
+whose emit-time `team_id` matches the credential team (enforced when
+team-scoped tokens exist).
+
+Clients discriminate each item via `event_type` (OpenAPI Event oneOf) —
+see docs/design/api/events-catalog.md.
+
+ * @summary List events
+ */
+declare const listEvents: (params: ListEventsParams, options?: RequestInit) => Promise<ListEvents200>;
+declare const getGetEventUrl: (id: string, params: GetEventParams) => string;
+/**
+ * Loads a single event by `(project_id, id)`. Requires `events.read`.
+Events are not registered in `resource_scope_index`; project scope is
+required on the query (ADR 049). Misses and cross-project ids return 404.
+
+Pre-claim projects return 404 (stored events stay invisible until claim).
+
+ * @summary Get event by ID
+ */
+declare const getEvent: (id: string, params: GetEventParams, options?: RequestInit) => Promise<GetEvent200>; //#endregion
+//#endregion
+//#region ../api/dist/runtime/api-factory.d.mts
+//#region src/runtime/api-factory.d.ts
+/**
+ * Typed Zitadel client returned by {@link createZitadelClient}.
+ * Mirrors the orval-generated endpoints module 1:1.
+ */
+type ZitadelClient = typeof zitadelNextGen_d_exports;
+/** Re-exported under the legacy name some consumers (`runtime/config.ts`) still import. */
+type ZitadelApi = ZitadelClient;
+/** Options for {@link createZitadelClient}. */
+//#endregion
+//#region ../api/dist/runtime/config.d.mts
+/**
+ * The initialized project handle returned by {@link configureZitadel}.
+ * Pure data — use factory functions like {@link getApi} to derive services.
+ */
+interface ZitadelProject {
+  /** Proxy path for API requests. */
+  readonly proxyPath: string;
+  /** Project ID passed to flow creation. */
+  readonly projectId: string;
+  /** Full URL of the Zitadel auth backend. */
+  readonly url?: string;
+  /** The project's publishable key (ADR 036), sent as the bearer when set. */
+  readonly publishableKey?: string;
+}
+/**
+ * Initializes app-wide SDK configuration and returns the frozen
+ * {@link ZitadelProject} handle.
+ *
+ * Write-once — subsequent calls with the same values return the original
+ * handle; calls with different values log a warning and return the
+ * original. This prevents accidental overwrites while remaining safe
+ * for HMR and framework double-mounts.
+ */
+//#endregion
+//#region src/orchestrator/locales/en.d.ts
+/**
+ * Minimal English locale dictionary.
+ *
+ * The `| t` filter looks up `text_key` strings here. Missing keys fall through
+ * to the raw key (matches the spec in
+ * `docs/design/flowengine/flow-engine-guide.md`).
+ *
+ * Text keys are auto-generated by the server from the flow definition:
+ *   - Step titles:       `<step>.title`
+ *   - Step descriptions: `<step>.description`
+ *   - Field labels:      `<step>.field.<field>`
+ *   - Action labels:     `<step>.action.<action>`
+ *
+ * Copy aligned to Figma screens file `xkvBjkOJ8ENuHdTGZHXezK` (May 2026).
+ * MVP only — multi-locale support is deferred.
+ */
+declare const en: Record<string, string>;
+type Locale = Record<string, string>;
+//#endregion
+//#region src/orchestrator/locales/de.d.ts
+declare const de: Locale;
+//#endregion
+//#region src/orchestrator/locales/it.d.ts
+declare const it: Locale;
+//#endregion
+//#region src/orchestrator/locales/business.d.ts
+declare const businessLocales: Readonly<Record<string, Partial<Locale>>>;
+//#endregion
+//#region src/orchestrator/locales/index.d.ts
+declare const builtinLocales: Readonly<Record<string, Locale>>;
+//#endregion
+//#region src/orchestrator/branding.d.ts
+type FlowLayout = CreateFlow201BrandingLayout;
+type BrandingPalette = {
+  primary?: string;
+  on_primary?: string;
+  background?: string;
+  surface?: string;
+  muted?: string;
+  border?: string;
+  text?: string;
+  text_muted?: string;
+  link?: string;
+  success?: string;
+  warning?: string;
+  error?: string;
+};
+type BrandingTypography = {
+  font_family?: string;
+  /**
+   * Display face for card titles and labels. Optional: without it a tenant's
+   * `font_family` sets the headings too, which is the single-font look most
+   * brands want. Naming it is how a brand keeps a separate display face.
+   */
+  font_family_heading?: string;
+  font_family_mono?: string;
+  scale?: number;
+};
+type BrandingShape = {
+  radius?: "none" | "sm" | "md" | "lg" | "full";
+  density?: "compact" | "regular" | "comfortable";
+};
+type BrandingTheme = {
+  mode?: "light" | "dark" | "auto";
+  dark?: {
+    palette?: BrandingPalette;
+  };
+};
+type BrandingAssets = {
+  logo_dark?: string;
+  favicon?: string;
+  background_image?: string;
+};
+/**
+ * Wire shape (`CreateFlow201Branding`) plus the v2 client-only extension.
+ * Structurally a superset, so any `CreateFlow201Branding` payload from the
+ * wire is assignable to `Branding` without a cast.
+ *
+ * `attribution.show_zitadel` controls the "Secured with Zitadel" pill in
+ * the orchestrator footer. Tenants set it to `false` only when they have a
+ * licence that permits removing attribution (community / OSS deployments
+ * always show it). The flag intentionally lives on `Branding` so it can
+ * be overridden per-flow alongside the rest of the visual surface.
+ */
+type Branding = CreateFlow201Branding & {
+  palette?: BrandingPalette;
+  typography?: BrandingTypography;
+  shape?: BrandingShape;
+  assets?: BrandingAssets;
+  theme?: BrandingTheme;
+  attribution?: BrandingAttribution;
+};
+type BrandingAttribution = {
+  show_zitadel?: boolean;
+  custom_link?: {
+    label: string;
+    href: string;
+  };
+};
+//#endregion
+//#region src/orchestrator/theme-controller.d.ts
+type ResolvedTheme = "light" | "dark";
+/** Theme inputs a caller may express, before resolution. */
+type ThemeMode = "light" | "dark" | "auto";
+declare class ThemeController implements ReactiveController {
+  private readonly host;
+  private branding;
+  /** Element-level `theme` property — the embedding developer's explicit call. */
+  private explicitMode;
+  /** Used when neither the element nor the branding payload names a mode. */
+  private fallbackMode;
+  private mediaQuery;
+  private _theme;
+  constructor(host: ReactiveControllerHost);
+  get theme(): ResolvedTheme;
+  setBranding(branding: Branding | undefined): void;
+  /**
+   * Sets the element-level preference and the fallback used when neither the
+   * element nor the branding payload names a mode. Precedence, strongest
+   * first: element `theme` property → `branding.theme.mode` → fallback. The
+   * element wins because the page embedding the widget knows its own surface
+   * better than the tenant's stored branding does.
+   */
+  setModePreference(explicit: ThemeMode | undefined, fallback: ThemeMode): void;
+  hostConnected(): void;
+  hostDisconnected(): void;
+  private refresh;
+  private attach;
+  private detach;
+  private onMediaChange;
+  private update;
+}
+//#endregion
+//#region src/orchestrator/surface.d.ts
+/**
+ * Shared base for the orchestrator host elements (`<zitadel-login>`,
+ * `<zitadel-session>`) that render a themable page/widget surface.
+ *
+ * Owns the `variant` / `theme` public properties, the {@link ThemeController},
+ * and the per-update surface application (base tokens, branding overrides,
+ * font links, and the `data-theme` host stamp). Subclasses call
+ * {@link applySurfaceTheme} from their `willUpdate` so the resolved theme is
+ * committed in the same update cycle that reads it.
+ *
+ * Not a registered custom element — purely an implementation-sharing base.
+ */
+declare class ZitadelSurface extends LitElement {
+  /**
+   * Sizing/chrome mode. Components size to content; pages compose them —
+   * so the default is `widget`: content-sized, transparent host, no
+   * document-level default-font injection. Dedicated routes — the hosted
+   * shell and the scaffolded pages — opt into `page`, which claims the
+   * viewport, paints the surface background, and ships the brand font.
+   * Fine-grained height override in both modes: `--zl-page-min-height`.
+   */
+  accessor variant: "widget" | "page";
+  /**
+   * Colour mode: `light`, `dark`, or `auto` (follow `prefers-color-scheme`).
+   * Empty means "not stated", and resolution falls through to the tenant's
+   * `branding.theme.mode`, then to a variant-derived default — `dark` for
+   * `page` (the hosted design system surface) and `auto` for `widget`, so an
+   * embedded widget matches the visitor's preference instead of forcing a
+   * dark card onto a light page. Set it explicitly when your app's surface
+   * is fixed: `<zitadel-login theme="light">`.
+   */
+  accessor theme: "" | ThemeMode;
+  /**
+   * Visually hide the surface's own heading block (the step title and
+   * subtitle on `<zitadel-login>`, the heading line on
+   * `<zitadel-session>`) while keeping it in the accessibility tree. For
+   * embedders whose page already carries the heading — a brand-voice
+   * "Welcome back" above the card — so the widget doesn't repeat it.
+   * Reflected so host-page CSS and DOM assertions can key off the
+   * attribute, like `variant`.
+   */
+  accessor suppressHeader: boolean;
+  protected readonly themeController: ThemeController;
+  /**
+   * Resolve the active theme and commit it to this element's surface: adopt
+   * the base token sheet, layer the branding overrides, manage the
+   * document-level font links, and stamp `data-theme` / `data-theme-dark` on
+   * the host so token lookups (and host-page selectors) flip with the mode.
+   * `branding` is `undefined` for surfaces without a tenant payload — the
+   * theme then resolves through the element preference and variant fallback.
+   */
+  protected applySurfaceTheme(branding: Branding | undefined): void;
+}
+//#endregion
+//#region src/orchestrator/zitadel-login.d.ts
+/**
+ * `<zitadel-login>` — the auth-UI orchestrator.
+ *
+ * Drives the typed `@zitadel/api` Flow API directly: `POST /flow`
+ * starts a flow, `POST /flow/{id}/submit` advances it. Renders each step
+ * through LiquidJS, sanitises the output via DOMPurify, and mounts the
+ * result inside a real `<form>` element in its Shadow DOM via Lit's
+ * `unsafeHTML` directive. Atom CustomEvents (`zl-input` / `zl-submit`)
+ * and the form's native `submit` event feed back into the
+ * submit cycle.
+ *
+ * Form participation: the orchestrator owns the `<form>` so Enter submits,
+ * browsers offer "save password" prompts, and password managers / autofill
+ * see a real form. Each `<zl-field>` is form-associated (see
+ * `docs/design/branding/form-participation.md`) so its value participates in
+ * the form even though it lives inside its own shadow root. The shadow root
+ * also delegates focus, and after each step swap focus moves to the first
+ * field so screen-reader and keyboard users land in a sensible spot.
+ *
+ * Session/state: the server is stateless between requests — a `_zflow`
+ * HttpOnly cookie carries orchestration state. We always run with
+ * `credentials: "include"` (set in `api-client.ts`). The flow handle (`id`)
+ * may rotate on pivots/pops; we re-read it from every response.
+ *
+ * Spec sources:
+ * - `docs/design/flowengine/flow-engine-guide.md`
+ * - `docs/design/branding/templates.md`
+ * - `docs/design/branding/tokens.md`
+ * - `docs/design/branding/schema.md`
+ * - `docs/design/branding/form-participation.md`
+ * - `docs/design/flowengine/template-security.md`
+ */
+declare class ZitadelLogin extends ZitadelSurface {
+  static shadowRootOptions: ShadowRootInit;
+  static styles: _$lit.CSSResult;
+  accessor purpose: CreateFlowBodyPurpose;
+  /**
+   * Name of the flow definition to run, matching the `name` in its flow
+   * file. When set, the server resolves that definition directly instead
+   * of picking one by audience. Omit to run the project's default flow.
+   */
+  accessor flowName: string;
+  /**
+   * SDK project handle returned by `configureZitadel()`. Set from JS (or a
+   * framework binding). When set, takes precedence over both the
+   * `project-id`/`proxy-path`/`url` attributes and the global singleton from
+   * `getZitadelConfig()`.
+   */
+  accessor project: ZitadelProject | undefined;
+  /**
+   * Project ID, set declaratively in HTML. Lets the component be configured on
+   * a plain page without JS or `configureZitadel()`. Ignored when the `project`
+   * property or a `configureZitadel()` global is set. See {@link projectAttrs}.
+   */
+  accessor projectId: string;
+  /**
+   * Proxy path for API requests (e.g. `/__nextgen`), set declaratively in HTML.
+   * Defaults to `/__nextgen` when omitted, matching `configureZitadel()`.
+   */
+  accessor proxyPath: string;
+  /**
+   * Full URL of the Zitadel auth backend, set declaratively in HTML. Optional —
+   * not needed in client-only setups.
+   */
+  accessor url: string;
+  /**
+   * URL to navigate to after a successful embedded sign-in. When set, the
+   * orchestrator exchanges the terminal `handoff_token` via the generated
+   * API client (setting the session cookie) and then performs a full
+   * navigation to this URL so host middleware can observe the cookie.
+   * For `complete: "redirect"` the orchestrator follows `redirect_uri`
+   * instead and does not run the exchange.
+   */
+  accessor postSignInUrl: string;
+  /**
+   * Existing flow handle to resume rather than start a new flow. When set,
+   * the orchestrator hits `GET /flow/{id}` instead of `POST /flow` on
+   * mount, so a page reload after a network blip can re-render the same
+   * step without losing collected state.
+   */
+  accessor resumeFlowId: string;
+  /**
+   * BCP 47 language tag (e.g. `"de"`, `"en-US"`). The widget resolves this
+   * to a built-in locale dictionary. Falls back to auto-detection from
+   * `document.documentElement.lang` or `navigator.language` when empty.
+   */
+  accessor lang: string;
+  /**
+   * Custom locale dictionaries keyed by language code. Entries may be
+   * partial — each is merged over the built-in dictionary for its language,
+   * so a preset like {@link businessLocales} (or a hand-written subset) is
+   * directly assignable:
+   *
+   * ```ts
+   * import { businessLocales } from "@zitadel/components";
+   * loginElement.locales = businessLocales;
+   * // or override individual keys:
+   * loginElement.locales = { en: { "identifier.title": "Welcome" } };
+   * ```
+   */
+  accessor locales: Readonly<Record<string, Partial<Locale>>> | undefined;
+  private accessor response;
+  private accessor branding;
+  private accessor loading;
+  private accessor startupError;
+  private accessor formValues;
+  private engine;
+  private readonly sanitise;
+  /**
+   * Cached compiled tenant template, keyed by source string. Re-rendering on
+   * every `formValues` change otherwise re-parses the same template.
+   */
+  private tenantTemplateCache;
+  /**
+   * Whether the widget currently owns a same-document history entry (the
+   * "sentinel"). The sentinel exists so the browser's back gesture fires
+   * `popstate` instead of leaving the page. Exactly one sentinel is on
+   * the stack at a time: it is pushed when a step with a `kind: "back"`
+   * action renders, re-armed by `onPopState` after the browser consumes
+   * it, and retired by `applyResponse` when a step without a back action
+   * renders. The entry reuses the current URL, so the host page's
+   * location (including any hash-router fragment) is never modified.
+   */
+  private armed;
+  /**
+   * Set immediately before a self-initiated `history.back()` so the
+   * resulting `popstate` is ignored instead of being interpreted as a
+   * user back gesture.
+   */
+  private ignoreNextPop;
+  /** Bound `popstate` handler stored for cleanup in `disconnectedCallback`. */
+  private readonly handlePopState;
+  createRenderRoot(): HTMLElement | DocumentFragment;
+  connectedCallback(): void;
+  disconnectedCallback(): void;
+  /**
+   * Start the flow after the first render rather than in `connectedCallback`.
+   * Frameworks that wrap web components (e.g. `@lit/react` in the console)
+   * attach the element first and then assign object properties (`branding`,
+   * `locale`) via setters. `connectedCallback` runs synchronously on attach
+   * — before any setters from a wrapper's effects/refs — so reading those
+   * properties there sees stale defaults. `firstUpdated` runs after Lit's
+   * first render, by which time setters from the wrapping framework have
+   * fired.
+   */
+  protected firstUpdated(): void;
+  /**
+   * Resolves the effective locale dictionary. The built-in dictionary for the
+   * resolved language is used as the base; entries from the `locales` map (if
+   * set) are spread on top so partial overrides work without importing and
+   * spreading the full base dictionary.
+   *
+   * Priority: explicit `lang` attr → `navigator.language` (user preference)
+   * → `document.documentElement.lang` (page default) → English fallback.
+   */
+  private resolveLocale;
+  willUpdate(changed: PropertyValues<this>): void;
+  updated(changed: PropertyValues<this>): void;
+  /**
+   * Apply captured values and move focus once the new step has fully
+   * rendered. This commit produces the step's field/action atoms, but those
+   * render their own shadow DOM on a later microtask — so await this element's
+   * update *and* the child atoms' first render before touching them, rather
+   * than guessing a frame with `requestAnimationFrame`.
+   *
+   * Focus on the *initial* response is page-mode-only: a dedicated login
+   * route should focus its first field, but a widget embedded further down
+   * an arbitrary page must not steal focus and scroll-jump on load. Step
+   * swaps are user-initiated, so focus moves in both modes.
+   */
+  private hydrateStepAfterRender;
+  render(): _$lit.TemplateResult<1>;
+  /**
+   * Inject the attribution badge into the rendered template's
+   * `<zl-page-shell>` footer slot. The attribution must live INSIDE the
+   * page-shell so it sits within the 100vh viewport rhythm (matching the
+   * Figma sign-in frame where the pill sits 24px below the card, both
+   * centred on the page). It can't be a sibling of the page-shell because
+   * the page-shell already occupies the full viewport height.
+   *
+   * This markup is appended AFTER `renderStep` has sanitised the Liquid
+   * output, so it is not run through DOMPurify. It is orchestrator-owned and
+   * any tenant-supplied values (`custom_link`) are escaped via `escapeHtml`.
+   */
+  private injectAttribution;
+  /**
+   * "Secured with Zitadel" attribution chrome injected into every
+   * template's page-shell footer slot. Controlled by
+   * `branding.attribution.show_zitadel` — defaults to `true` for
+   * community / OSS deployments. Licensed tenants can suppress the badge
+   * entirely or swap it for a `custom_link` value.
+   */
+  private renderAttributionHtml;
+  /** Declarative config read from this element's attributes. */
+  private get projectAttrs();
+  private startFlow;
+  /**
+   * When a `flow-name` lookup fails, the server's envelope only says
+   * "not found" / "purpose mismatch" — it cannot know the name came from
+   * an attribute. Rewrap those two codes with the attribute and the fix;
+   * every other error passes through untouched.
+   */
+  private describeFlowSelectionError;
+  private applyResponse;
+  /**
+   * Acts on terminal flow steps. The wire surfaces two kinds of completion:
+   *
+   * - `step.complete === "redirect"` — navigate the browser to
+   *   `response.redirect_uri` (OIDC/SAML `auth_request_id` resolved). This
+   *   takes precedence over `post-sign-in-url`.
+   * - `step.complete === "show"` — when `post-sign-in-url` is set, exchange
+   *   the `handoff_token` for a session cookie and navigate there.
+   *
+   * `zitadel-flow-complete` is always emitted so hosts with custom post-sign-in
+   * flows can handle the handoff themselves when `post-sign-in-url` is omitted.
+   */
+  private maybeCompleteFlow;
+  private renderStep;
+  /**
+   * Build a `FlowIdentity` from the orchestrator's captured form values so
+   * the signed-in template can greet the user by email without the API
+   * having to round-trip identity claims. Email comes from the
+   * identifier step; display name composes from `given_name` /
+   * `family_name` when the register step ran.
+   */
+  private deriveIdentity;
+  /** All rendered input atoms exposing the `formValue` contract. */
+  private fieldAtoms;
+  private applyValuesToFields;
+  /**
+   * Names of the current step's `required` fields whose captured value is
+   * empty. Reads each atom's live `formValue` (the getter reflects the native
+   * control, so autofill that skipped `input` events is still seen), so this
+   * is browser-independent and does not rely on native constraint validation.
+   */
+  private missingRequiredFields;
+  /**
+   * Surface a client-side required-field error using the server's own
+   * validation dialect (`error.<field>_required`, "; "-joined), so it flows
+   * through the same localisation and inline/banner routing as a real
+   * backend rejection — no native browser bubble. Idempotent: re-running with
+   * the same keys (both submit entry points fire on one click) is a no-op.
+   */
+  private reportRequiredErrors;
+  /**
+   * Snapshot the current step's field values straight from the rendered input
+   * atoms through their uniform `formValue` contract. Tag-agnostic: every
+   * form-participating atom is read the same way, so a new field type needs no
+   * change here. Declared fields default to "" so the backend still runs its
+   * required-checks and challenge dispatch instead of silently advancing on a
+   * field-less payload. Captured values are folded into `formValues` for
+   * cross-step identity (the signed-in greeting) and post-error restoration.
+   */
+  private collectSubmitFields;
+  /**
+   * True once the user retired the current step error by editing a field or
+   * dismissing the alert. Deliberately NON-reactive: consulting reactive
+   * state in `renderStep` would change its output string on the first
+   * post-dismiss keystroke, and `unsafeHTML` would rebuild the whole step
+   * subtree — wiping typed values (`hydrateStepAfterRender` only re-applies
+   * them on response changes) and reconnecting atoms. Reset on every new
+   * response; consulted only by the `loading` re-render, which rebuilds
+   * anyway.
+   */
+  private stepErrorDismissed;
+  private handleAtomInput;
+  /**
+   * `zl-change` from <zl-checkbox>/<zl-select>. Persist the atom's value into
+   * `formValues` — mirroring `handleAtomInput` for text fields — so a later
+   * step re-render (a validation error re-parses the template via `unsafeHTML`
+   * and rebuilds the atoms) restores the selection/checked state through
+   * `applyValuesToFields` instead of dropping back to the template default.
+   * Reads the live `formValue` off the atom rather than the event's `value`
+   * token, because an unchecked checkbox reports "" there but keeps its token
+   * in the detail. Also clears stale errors on the edited field.
+   */
+  private handleAtomEdited;
+  /** Explicit dismiss of the step-error alert (it removes itself). */
+  private handleAlertDismiss;
+  /**
+   * Retire the current step error after the user edits `fieldName`:
+   * remove the form-level alert(s) and clear the edited field's inline
+   * error — other fields' inline errors stay until they are edited.
+   * Imperative on purpose; see {@link stepErrorDismissed}.
+   */
+  private clearStaleErrors;
+  /** Mirror a value onto the matching rendered atom (used after atom events). */
+  private syncFieldElementValue;
+  private handleAtomSubmit;
+  /** Secondary navigation rows (`data-action` on `.zl-card-nav__link`). */
+  private handleDelegatedAction;
+  private handleFormSubmit;
+  /**
+   * Handle a successful WebAuthn ceremony. Auto-submit with the proof
+   * as `challenge_response` so the flow advances without extra user
+   * interaction — the ceremony IS the factor verification (ADR 013).
+   */
+  private handlePasskeyResult;
+  /**
+   * Handle a WebAuthn ceremony error. Re-render the current step with
+   * an error message so the user sees feedback and can retry or skip.
+   *
+   * Guard: if the step already carries the same error key, skip the update.
+   * Mutating `this.response` triggers `unsafeHTML` to replace the DOM tree,
+   * which reconnects a fresh `<zl-passkey>` that immediately re-starts the
+   * ceremony — creating an infinite loop. The guard breaks the cycle.
+   *
+   * We also strip the `challenge` from the step so the template does not
+   * render a new `<zl-passkey>` on re-render. Without this, the first
+   * cancel would trigger a second ceremony (the guard prevents a third).
+   */
+  private handlePasskeyError;
+  private findPrimaryAction;
+  /**
+   * On the initial paint, only a field earns focus: script-moved focus with
+   * no prior interaction matches `:focus-visible`, so autofocusing a button
+   * on a field-less step (passkey-first) paints a ring that reads as a
+   * pre-selected state. Step swaps keep button focus — there the browser
+   * derives the modality from the user's actual input.
+   */
+  private moveFocusToFirstField;
+  private submit;
+  /**
+   * Handle the browser's back/forward gesture (ADR 022). When `popstate`
+   * fires:
+   *
+   * - **Self-initiated** (`ignoreNextPop`) → `applyResponse` is retiring
+   *   the sentinel; ignore.
+   * - **Back press while armed** → the browser consumed the sentinel.
+   *   Re-arm it immediately — so the stack shape is identical on every
+   *   step and repeated presses behave the same at any flow depth — then
+   *   submit the step's `kind: "back"` action.
+   * - **Landing on the sentinel while armed** → the host page pushed an
+   *   entry above the sentinel (e.g. an in-page `#anchor` click) and the
+   *   user backed out of it. They are back where the widget expects them
+   *   — not asking the flow to go back; do nothing.
+   * - **Forward press onto a retired sentinel** (it survives as a forward
+   *   entry after `history.back()`) → bounce back: flow state is
+   *   server-authoritative, the browser cannot skip ahead
+   *   (ADR 022 §Edge cases).
+   * - Anything else is host-page traversal — leave the browser alone.
+   */
+  private onPopState;
+  private handleTransportError;
+}
+declare global {
+  interface HTMLElementTagNameMap {
+    "zitadel-login": ZitadelLogin;
+  }
+} //# sourceMappingURL=zitadel-login.d.ts.map
+//#endregion
+//#region src/orchestrator/zitadel-logout.d.ts
+/**
+ * `<zitadel-logout>` — orchestrator-tier element that lets the signed-in user
+ * sign out without touching the flow API.
+ *
+ * Reads the user's identity from the typed `getMySession` operation
+ * (`GET /sessions/me`, credentialed) — the same source as `<zitadel-session>`,
+ * so both signed-in surfaces stay consistent and work against the real backend.
+ * The avatar/preview show `name`, then `email`, then the always-present
+ * `user_id`. NOTE: the current server response includes only the `user_id`, so
+ * the avatar falls back to the id until the backend returns a human-readable
+ * `name`/`email`.
+ *
+ * It renders an avatar trigger with a dropdown that exposes a "Sign out"
+ * action, and calls the typed `revokeMySession` operation in `@zitadel/api`
+ * (`DELETE /sessions/me`). The server clears the session cookie via
+ * `Set-Cookie: Max-Age=0`; on success the element fires `zitadel-signout`
+ * and optionally navigates to `post-sign-out-url`.
+ *
+ * ## Template-slot mode
+ *
+ * When the consumer projects a `<template>` child the element renders the
+ * template's clone into its light DOM with `{{display}}`, `{{identifier}}`,
+ * and `{{initial}}` substituted (`{{name}}` and `{{email}}` fill as legacy
+ * aliases of the first two). Any element with `data-action="logout"` inside
+ * the cloned template triggers the sign-out flow. This mirrors the
+ * placeholder `<nextgen-logout>`'s contract so existing markup keeps working.
+ *
+ * Default styles consume the `--zl-*` design tokens so tenant branding
+ * applies automatically — there is no hardcoded brand colour, radius, or
+ * shadow.
+ */
+declare class ZitadelLogout extends LitElement {
+  static styles: _$lit.CSSResult[];
+  /**
+   * SDK project handle returned by `configureZitadel()`. Set from JS (or a
+   * framework binding). When set, takes precedence over both the
+   * `project-id`/`proxy-path`/`url` attributes and the global singleton from
+   * `getZitadelConfig()`.
+   */
+  accessor project: ZitadelProject | undefined;
+  /**
+   * Project ID, set declaratively in HTML. Lets the component be configured on
+   * a plain page without JS or `configureZitadel()`. Ignored when the `project`
+   * property or a `configureZitadel()` global is set.
+   */
+  accessor projectId: string;
+  /**
+   * Proxy path for API requests (e.g. `/__nextgen`), set declaratively in HTML.
+   * Defaults to `/__nextgen` when omitted, matching `configureZitadel()`.
+   */
+  accessor proxyPath: string;
+  /**
+   * Full URL of the Zitadel auth backend, set declaratively in HTML. Optional —
+   * not needed in client-only setups.
+   */
+  accessor url: string;
+  /** URL to navigate to after a successful sign-out. */
+  accessor postSignOutUrl: string;
+  /**
+   * Colour mode: `light`, `dark`, or `auto` (follow `prefers-color-scheme`).
+   * Empty means "not stated" and defaults to `auto` — the control lives
+   * inside the app's own chrome, so it follows the visitor's preference
+   * rather than forcing the dark login surface. Set it explicitly when the
+   * surrounding app surface is fixed: `<zitadel-logout theme="dark">`.
+   */
+  accessor theme: "" | ThemeMode;
+  private accessor userDisplay;
+  private accessor userIdentifier;
+  private accessor userId;
+  private accessor open;
+  private accessor loading;
+  private accessor errorMessage;
+  private templateMode;
+  private pendingTemplate;
+  private projectedContainer;
+  private identityRequested;
+  private readonly themeController;
+  connectedCallback(): void;
+  disconnectedCallback(): void;
+  willUpdate(): void;
+  updated(): void;
+  /** Declarative config read from this element's attributes. */
+  private get projectAttrs();
+  /**
+   * Fetches the signed-in identity from `GET /sessions/me` once a project is
+   * resolvable. No-ops until then (and on repeat calls) so framework property
+   * timing doesn't matter and we never fire the request twice. A pending
+   * `<template>` is already projected in `connectedCallback`, so when no config
+   * is available yet the logout control still renders; it is re-projected with
+   * the real identity once a later request succeeds.
+   */
+  private maybeLoadIdentity;
+  private loadIdentity;
+  private get initial();
+  /**
+   * Clones the consumer-supplied `<template>` into the light DOM, fills the
+   * `{{display}}`, `{{identifier}}`, and `{{initial}}` tokens (plus the
+   * legacy `{{name}}`/`{{email}}` aliases) via a TreeWalker, and
+   * wires every element with `data-action="logout"` to trigger sign-out.
+   * Light-DOM mounting is deliberate so the consumer's existing CSS applies.
+   *
+   * Re-runnable: each call replaces the previously projected clone, so a late
+   * identity fetch (or a `project` assigned post-mount) updates the rendered
+   * markup instead of leaving the placeholders stuck on their initial values.
+   */
+  private projectTemplate;
+  private readonly handleDocumentClick;
+  private readonly handleDocumentKeydown;
+  private toggleOpen;
+  /**
+   * Calls `DELETE /sessions/me` (`revokeMySession`) with `credentials: "include"`.
+   * The server validates the `__nextgen_session` cookie, deletes the session, and
+   * clears the cookie via `Set-Cookie: Max-Age=0`. On success this element fires
+   * `zitadel-signout` and optionally navigates to `postSignOutUrl`.
+   */
+  private doLogout;
+  private handleSignOutClick;
+  render(): _$lit.TemplateResult<1> | typeof nothing;
+}
+declare global {
+  interface HTMLElementTagNameMap {
+    "zitadel-logout": ZitadelLogout;
+  }
+} //# sourceMappingURL=zitadel-logout.d.ts.map
+//#endregion
+//#region src/orchestrator/zitadel-session.d.ts
+/**
+ * `<zitadel-session>` — the "signed in" card.
+ *
+ * Renders the post-sign-in confirmation surface (Figma `7355:8959`): a
+ * centred auth card reading "Signed in as {identity}" with a **Sign out**
+ * action. Composed from the same `<zl-page-shell>` / `<zl-card>` /
+ * `<zl-button>` atoms as the `<zitadel-login>` orchestrator, so it inherits
+ * tenant branding tokens with no hardcoded colour, radius, or shadow.
+ *
+ * Like `<zitadel-login>` it is widget-first: the default `variant="widget"`
+ * is content-sized and transparent so the card drops into an app's own
+ * page; dedicated signed-in routes opt into `variant="page"`, which claims
+ * the viewport and paints the surface background (the page paint lives on
+ * the internal `<zl-page-shell>`). `theme` resolves through the shared
+ * surface base — explicit value, else `dark` for `page` / `auto` for
+ * `widget`.
+ *
+ * This is the companion surface to `<zitadel-login>` for the "go straight to
+ * /login" flow: the orchestrator signs the user in and redirects here (or to
+ * the consumer's own page); this element proves the session and offers a way
+ * back out. The in-app avatar menu lives in the separate `<zitadel-logout>`.
+ *
+ * - Identity is fetched from the typed `getMySession` operation
+ *   (`GET /sessions/me`), sent with credentials so the session cookie
+ *   authenticates it. The card shows `name`, then `email`, then the
+ *   always-present `user_id`. NOTE: the current server response includes only
+ *   the `user_id`, so the card displays the raw id until the backend returns a
+ *   human-readable `name`/`email` on `/sessions/me`. A failed or
+ *   unauthenticated request renders the card without an identity line rather
+ *   than throwing.
+ * - **Sign out** calls the typed `revokeMySession` operation
+ *   (`DELETE /sessions/me`); the server clears the session cookie. On success
+ *   the element fires `zitadel-signout` (detail `{ display, identifier }`, matching the
+ *   shared SPA contract) and optionally navigates to `post-sign-out-url`.
+ *
+ * A "Continue" action is intentionally omitted for now: the post-sign-in
+ * destination contract is still being decided. Consumers redirect after
+ * sign-in via the `<zitadel-login>` `post-sign-in-url`.
+ */
+declare class ZitadelSession extends ZitadelSurface {
+  static styles: _$lit.CSSResult[];
+  /**
+   * SDK project handle returned by `configureZitadel()`. Set from JS (or a
+   * framework binding). Takes precedence over the
+   * `project-id`/`proxy-path`/`url` attributes and the global singleton.
+   */
+  accessor project: ZitadelProject | undefined;
+  /** Project ID, set declaratively in HTML for no-JS configuration. */
+  accessor projectId: string;
+  /** Proxy path for API requests (e.g. `/__nextgen`), set declaratively in HTML. */
+  accessor proxyPath: string;
+  /** Full URL of the Zitadel auth backend, set declaratively in HTML. */
+  accessor url: string;
+  /** URL to navigate to after a successful sign-out. */
+  accessor postSignOutUrl: string;
+  /** Heading text. Defaults to the English label. */
+  accessor heading: string;
+  /** Sign-out action label. */
+  accessor logoutLabel: string;
+  private accessor userDisplay;
+  private accessor userIdentifier;
+  private accessor userId;
+  private accessor loading;
+  private accessor errorMessage;
+  private identityRequested;
+  connectedCallback(): void;
+  /** Single identity line: human-readable name, then email, then user_id. */
+  private get identityLabel();
+  willUpdate(): void;
+  updated(): void;
+  /** Declarative config read from this element's attributes. */
+  private get projectAttrs();
+  /**
+   * Fetches the signed-in identity from `GET /sessions/me` once a project is
+   * resolvable. No-ops until then (and on repeat calls) so framework property
+   * timing doesn't matter and we never fire the request twice.
+   */
+  private maybeLoadIdentity;
+  private fetchIdentity;
+  /**
+   * Calls `DELETE /sessions/me` (`revokeMySession`) with credentials. On
+   * success fires `zitadel-signout` and optionally navigates to
+   * `postSignOutUrl`; on failure surfaces an inline error and stays put.
+   */
+  private doLogout;
+  private handleLogout;
+  render(): _$lit.TemplateResult<1>;
+}
+declare global {
+  interface HTMLElementTagNameMap {
+    "zitadel-session": ZitadelSession;
+  }
+} //# sourceMappingURL=zitadel-session.d.ts.map
+//#endregion
+//#region src/orchestrator/branding-to-tokens.d.ts
+type BrandingToTokensOptions = {
+  resolvedTheme?: ResolvedTheme;
+};
+/**
+ * Build a CSS string of `:host { --zl-* }` declarations from a Branding
+ * payload. Light values land on `:host`; dark overrides land on
+ * `:host([data-theme="dark"])`.
+ */
+declare function buildBrandingStylesheet(branding: Branding | undefined, options?: BrandingToTokensOptions): string;
+/**
+ * Apply a branding payload as a `--zl-*` overrides layer on top of the base
+ * token sheet. Subsequent calls replace the previous override sheet so a new
+ * branding payload paints cleanly without leaking older declarations.
+ *
+ * Callers should run `applyBaseTokens(shadowRoot)` first (once per shadow
+ * root) so the base values exist before branding patches them.
+ */
+declare function applyBrandingTokens(shadowRoot: ShadowRoot, branding: Branding | undefined, resolvedTheme: ResolvedTheme): void;
+/**
+ * Standalone branding→theme resolution for callers outside the orchestrator
+ * (SSR, tests, embedders composing atoms by hand). `<zitadel-login>` itself
+ * uses {@link ThemeController}, which layers the element's `theme` property
+ * and a variant-derived fallback on top of the same branding input.
+ *
+ * Defaults to dark: the design system's primary surface, and the mode a
+ * hosted login page renders when a tenant states no preference.
+ */
+declare function resolveTheme(branding: Branding | undefined): ResolvedTheme;
+//#endregion
+//#region src/orchestrator/font-loader.d.ts
+/**
+ * Inject the tenant's `branding.font_url` stylesheet. Pass `null`/`undefined`
+ * to withdraw this surface's registration (e.g. when a flow resolves with no
+ * tenant font); the link disappears once no surface registers a URL.
+ */
+declare function applyFontUrl(shadowRoot: ShadowRoot, fontUrl: string | null | undefined): void;
+//#endregion
+//#region src/orchestrator/template-names.d.ts
+/**
+ * Names of the bundled Liquid templates the `<zitadel-login>` orchestrator
+ * registers.
+ *
+ * This lives in its own module — separate from `liquid.ts` — so the public
+ * barrel can re-export `TEMPLATE_NAMES` without dragging LiquidJS' `Liquid`
+ * type (and its Node ambient-type requirements) into the published
+ * declaration surface. See `liquid.ts` / the orchestrator barrel.
+ */
+declare const TEMPLATE_NAMES: {
+  readonly default: "default";
+  readonly authForm: "auth-form";
+  readonly passkeyUpsell: "passkey-upsell";
+  readonly signedIn: "signed-in";
+};
+//#endregion
+//#region src/orchestrator/mandatory-gates.d.ts
+declare const MANDATORY_GATES_MARKER = "ZL_MANDATORY_GATES";
+declare const mandatoryGatesMarkerComment = "<!--ZL_MANDATORY_GATES-->";
+declare function patchMandatoryGates(html: string, step: CreateFlow201Step, locale: Locale): string;
+//#endregion
+//#region src/orchestrator/sanitiser.d.ts
+/**
+ * Returns a sanitiser bound to the current manifest registry. Callers should
+ * cache the result; rebuilding is cheap but allocates a fresh DOMPurify config.
+ */
+declare function createSanitiser(): (html: string) => string;
+//#endregion
+//#region src/orchestrator/api-client.d.ts
+declare function startFlow(api: ZitadelApi, input: CreateFlowBody): Promise<CreateFlow201>;
+declare function submitStep(api: ZitadelApi, id: string, body: SubmitFlowStepBody): Promise<CreateFlow201>;
+declare function getCurrentStep(api: ZitadelApi, id: string): Promise<CreateFlow201>;
+//#endregion
+//#region src/orchestrator/branding-validator.d.ts
+type BrandingValidationResult = {
+  branding: Branding | undefined;
+  issues: readonly string[];
+};
+type BrandingValidationContext = {
+  /** Origin of the document that will paint the branding payload. */renderingOrigin?: string;
+};
+declare function validateBranding(input: Branding | undefined, context?: BrandingValidationContext): BrandingValidationResult;
+//#endregion
+//#region src/orchestrator/template-context.d.ts
+type FlowMessage = {
+  level: "info" | "warning";
+  text_key: string;
+};
+type FlowError = {
+  code?: string;
+  text_key?: string;
+  message?: string;
+  /**
+   * Name of the step field this error targets. When set (and the step renders
+   * that field), the template routes the error inline under the control via
+   * the `fieldError` filter; when absent it renders in the form-level banner
+   * (`formLevelError`). See `localiseFlowErrorKeys` in `liquid.ts`.
+   */
+  field?: string;
+};
+type FlowIdentity = {
+  display_name?: string;
+  email_address?: string;
+  avatar_url?: string;
+};
+/**
+ * Liquid render context. The orchestrator builds this from the wire
+ * `CreateFlow201` payload before invoking the engine.
+ *
+ * Capability dictionaries point at the orval wire shapes directly. The only
+ * client-only pieces are `messages`, `identity`, `errors`, the resolved
+ * `branding` (v2 superset), and `loading`.
+ */
+type LiquidContext = {
+  step: Pick<CreateFlow201Step, "name" | "complete" | "texts">;
+  fields: readonly CreateFlow201StepFieldsItem[];
+  actions: readonly CreateFlow201StepActionsItem[];
+  gates: CreateFlow201StepGates;
+  sso_providers: readonly CreateFlow201StepSsoProvidersItem[];
+  challenge: CreateFlow201StepChallenge | null;
+  messages: readonly FlowMessage[];
+  identity: FlowIdentity | null;
+  errors: readonly FlowError[];
+  branding: Branding | Record<string, never>;
+  loading: boolean;
+};
+//#endregion
+export { BrandingPalette as A, en as B, ZitadelLogin as C, Branding as D, ThemeMode as E, builtinLocales as F, businessLocales as I, it as L, BrandingTheme as M, BrandingTypography as N, BrandingAssets as O, FlowLayout as P, de as R, ZitadelLogout as S, ThemeController as T, applyFontUrl as _, LiquidContext as a, resolveTheme as b, validateBranding as c, submitStep as d, createSanitiser as f, TEMPLATE_NAMES as g, patchMandatoryGates as h, FlowMessage as i, BrandingShape as j, BrandingAttribution as k, getCurrentStep as l, mandatoryGatesMarkerComment as m, FlowError as n, BrandingValidationContext as o, MANDATORY_GATES_MARKER as p, FlowIdentity as r, BrandingValidationResult as s, layoutChromeCss as t, startFlow as u, applyBrandingTokens as v, ResolvedTheme as w, ZitadelSession as x, buildBrandingStylesheet as y, Locale as z };
+//# sourceMappingURL=index-DFdR16-D.d.mts.map