@zitadel/components 1.0.0-alpha.21 → 1.0.0-alpha.22

package/dist/{index-Dx8rvpNs.d.mts → index-DMPCvLh_.d.mts}

@@ -334,7 +334,7 @@ declare global {
   }
 } //# sourceMappingURL=zl-checkbox.d.ts.map
 //#endregion
-//#region ../api/dist/index-BK4Q468Q.d.mts
+//#region ../api/dist/index-DtExHu2p.d.mts
 //#region src/generated/model/beginUserPasskeyRegistration201Options.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -1862,9 +1862,11 @@ the purpose + audience when a flow is created via POST /flow.
 type CreateFlowDefinition201FlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
-  `switch` and `pivot` transitions. Renaming is not supported — the
-  `name` is part of the public contract another definition may
-  reference. Acts as the human display label as well; no separate slug.
+  `switch` and `pivot` transitions. Every revision of a flow shares its
+  `name`; publishing a definition under an existing `name` adds a
+  revision to that flow. Renaming is not supported — the `name` is part
+  of the public contract another definition may reference. Acts as the
+  human display label as well; no separate slug.
         * @pattern ^[a-z][a-z0-9-]*$
      */
   name: string;
@@ -2361,9 +2363,11 @@ the purpose + audience when a flow is created via POST /flow.
 type CreateFlowDefinitionBodyFlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
-  `switch` and `pivot` transitions. Renaming is not supported — the
-  `name` is part of the public contract another definition may
-  reference. Acts as the human display label as well; no separate slug.
+  `switch` and `pivot` transitions. Every revision of a flow shares its
+  `name`; publishing a definition under an existing `name` adds a
+  revision to that flow. Renaming is not supported — the `name` is part
+  of the public contract another definition may reference. Acts as the
+  human display label as well; no separate slug.
         * @pattern ^[a-z][a-z0-9-]*$
      */
   name: string;
@@ -2449,6 +2453,131 @@ type CreateGrant201ObjectType = (typeof CreateGrant201ObjectType)[keyof typeof C
 declare const CreateGrant201ObjectType: {
   readonly project: "project";
 }; //#endregion
+//#region src/generated/model/createGrant201Principal.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The principal named by `principal_id`, present only when the request
+asked for it with `expand: ["principal"]` (ADR 059). Absent means it
+was not requested; `null` means the principal cannot be loaded
+(deleted or missing). GET and create never set this field.
+
+When present, the body is the same representation `GET /users/{id}`
+serves for `principal_type=user`, or `GET /teams/{id}` for
+`principal_type=team`. Discriminate with the grant's existing
+`principal_type`.
+
+Requires `user.read` and `team.read` in addition to `project.read`.
+Both are checked on the whole request before the list.
+
+ */
+type CreateGrant201Principal = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id: string;
+  /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
+  */
+  schema: string;
+  /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
+  */
+  attributes: {
+    [key: string]: unknown;
+  };
+  metadata: {
+    /** The time when the user was created. */created_at: string; /** The time when the user was last updated. */
+    updated_at: string; /** The status of the user. */
+    status: "active" | "suspended" | "deactivated" | "pending_purge";
+    /** The team that owns this user's identity lifecycle, or `null` when the
+    user is self-owned. This is a single team and a different concept from
+    the user's team memberships: it decides who may deprovision the user, not
+    which teams the user collaborates in. Memberships are their own paginated
+    resource — `GET /users/{user_id}/teams`.
+    */
+    lifecycle_owner_team_id?: string | null;
+    /** The team named by `lifecycle_owner_team_id`, present only when the
+    request asked for it with `expand: ["lifecycle_owner_team"]` (ADR 059).
+    Absent means it was not requested; `null` means the user is self-owned
+    and there is no owner to resolve.
+    Requesting it does not guarantee it is present on every user. Today
+    `team.read` is checked once for the whole request, so it is; once that
+    check is per team, a page may contain a user whose owner the caller may
+    not read, and such a row answers with neither the team nor `null` —
+    `null` already means self-owned. What it answers with instead is decided
+    with the granular scopes (#420); do not read the two cases above as the
+    complete set.
+    This is the same representation `GET /teams/{team_id}` serves. It is a
+    single team, not a collection, so it carries no cap and no truncation
+    flag.
+    */
+    readonly lifecycle_owner_team?: {
+      /** The unique identifier of the team. */id: string; /** The name of the team. */
+      name: string;
+      /** The lifecycle state of a team.
+      active: The team is available for use.
+      deactivated: The team is no longer active but is retained for historical and audit purposes.
+      */
+      status: "active" | "deactivated"; /** The time when the team was created. */
+      created_at: string; /** The time when the team was last updated. */
+      updated_at: string;
+    } | null;
+  };
+  /** The current value of the user schema's designated identifier
+  (`x-identifier`), resolved live at read time. Absent when the schema
+  designates no identifier or the user carries no value for it.
+  */
+  readonly identifier?: string;
+  /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+  */
+  readonly identifier_property?: string;
+  /** The `x-display` rendering — the designated properties' values joined
+  in list order, resolved live at read time. Purely presentational.
+  Absent when the schema designates no display properties or the user
+  carries no values for them. Clients render `display`, falling back
+  to `identifier`, then `id`.
+  */
+  readonly display?: string;
+  /** The user's team memberships, present only when the request asked for them with
+  `expand: ["teams"]` (ADR 059). Absent means it was not requested; `[]`
+  means the user has none.
+  Deliberately outside `metadata`: memberships are a related collection, not
+  part of the server-owned envelope, and it is a different concept from
+  `metadata.lifecycle_owner_team_id` (ADR 024).
+  */
+  readonly teams?: readonly {
+    /** The unique identifier of the team. */id: string; /** The name of the team. */
+    name: string;
+    /** The user's participation state on this team. Memberships the user was
+    removed from are not returned.
+    */
+    membership_status: "pending" | "active" | "inactive"; /** The time when the user joined this team. */
+    created_at: string; /** The time when this membership was last changed. */
+    updated_at: string;
+  }[];
+  /** True when the user is on more teams than the embedded list carries. The
+  embedded list is capped and cannot be paged; read them all at
+  `GET /users/{user_id}/teams`. Present only alongside `teams`.
+  */
+  readonly teams_truncated?: boolean;
+} | {
+  /** The unique identifier of the team. */id: string; /** The name of the team. */
+  name: string;
+  /** The lifecycle state of a team.
+  active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
+  */
+  status: "active" | "deactivated"; /** The time when the team was created. */
+  created_at: string; /** The time when the team was last updated. */
+  updated_at: string;
+} | null; //#endregion
 //#region src/generated/model/createGrant201PrincipalType.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -2482,6 +2611,63 @@ declare const CreateGrant201Relation: {
   readonly editor: "editor";
   readonly admin: "admin";
 }; //#endregion
+//#region src/generated/model/createGrant201Team.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * A resolved reference to a team. Carries the team's id and name so a grant
+list is readable without embedding the full Team body. Id and display ride
+`project.read` (ADR 059 rule 8): a reference field carrying only the
+target's id and display strings needs no gate of its own. Missing or
+deleted teams degrade to `team_id` only.
+
+ */
+type CreateGrant201Team = {
+  /** The referenced team's id (`team_<opaque>`). Always present. */team_id: string; /** The team's name. Absent when the team can no longer be loaded. */
+  name?: string;
+}; //#endregion
+//#region src/generated/model/createGrant201User.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+property-named, so responses can mix users from different schemas.
+`identifier` and `display` are resolved independently from the user
+schema's `x-identifier` and `x-display` designations, live at read time.
+Clients render `display`, falling back to `identifier`, then `user_id`.
+Missing or deleted users degrade to `user_id` only.
+
+ */
+type CreateGrant201User = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */user_id: string;
+  /** The current value of the schema's designated identifier
+  (`x-identifier`). Absent when the schema designates no identifier or
+  the user carries no value for it.
+   */
+  identifier?: string;
+  /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+   */
+  identifier_property?: string;
+  /** The `x-display` rendering — the designated properties' values joined
+  in list order. Purely presentational, with no source attribution.
+  Absent when the schema designates no display properties or the user
+  carries no values for them.
+   */
+  display?: string;
+}; //#endregion
 //#region src/generated/model/createGrant201.d.ts
 /**
  * A collaboration grant binding a principal to a project relation.
@@ -2498,6 +2684,33 @@ type CreateGrant201 = {
   returns expired unrevoked grants; authorization ignores them.
    */
   expires_at?: string | null;
+  /** A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+  property-named, so responses can mix users from different schemas.
+  `identifier` and `display` are resolved independently from the user
+  schema's `x-identifier` and `x-display` designations, live at read time.
+  Clients render `display`, falling back to `identifier`, then `user_id`.
+  Missing or deleted users degrade to `user_id` only.
+   */
+  user?: CreateGrant201User;
+  /** A resolved reference to a team. Carries the team's id and name so a grant
+  list is readable without embedding the full Team body. Id and display ride
+  `project.read` (ADR 059 rule 8): a reference field carrying only the
+  target's id and display strings needs no gate of its own. Missing or
+  deleted teams degrade to `team_id` only.
+   */
+  team?: CreateGrant201Team;
+  /** The principal named by `principal_id`, present only when the request
+  asked for it with `expand: ["principal"]` (ADR 059). Absent means it
+  was not requested; `null` means the principal cannot be loaded
+  (deleted or missing). GET and create never set this field.
+     When present, the body is the same representation `GET /users/{id}`
+  serves for `principal_type=user`, or `GET /teams/{id}` for
+  `principal_type=team`. Discriminate with the grant's existing
+  `principal_type`.
+     Requires `user.read` and `team.read` in addition to `project.read`.
+  Both are checked on the whole request before the list.
+   */
+  readonly principal?: CreateGrant201Principal;
 }; //#endregion
 //#region src/generated/model/createGrant400Details.d.ts
 /**
@@ -3310,6 +3523,7 @@ property-named, so responses can mix users from different schemas.
 `identifier` and `display` are resolved independently from the user
 schema's `x-identifier` and `x-display` designations, live at read time.
 Clients render `display`, falling back to `identifier`, then `user_id`.
+Missing or deleted users degrade to `user_id` only.
 
  */
 type CreateSession201SessionUser = {
@@ -3380,6 +3594,7 @@ type CreateSession201Session = {
   `identifier` and `display` are resolved independently from the user
   schema's `x-identifier` and `x-display` designations, live at read time.
   Clients render `display`, falling back to `identifier`, then `user_id`.
+  Missing or deleted users degrade to `user_id` only.
    */
   user?: CreateSession201SessionUser;
   /** Verified authentication factors accumulated by this session.
@@ -4004,6 +4219,7 @@ property-named, so responses can mix users from different schemas.
 `identifier` and `display` are resolved independently from the user
 schema's `x-identifier` and `x-display` designations, live at read time.
 Clients render `display`, falling back to `identifier`, then `user_id`.
+Missing or deleted users degrade to `user_id` only.
 
  */
 type ExchangeHandoff200SessionUser = {
@@ -4074,6 +4290,7 @@ type ExchangeHandoff200Session = {
   `identifier` and `display` are resolved independently from the user
   schema's `x-identifier` and `x-display` designations, live at read time.
   Clients render `display`, falling back to `identifier`, then `user_id`.
+  Missing or deleted users degrade to `user_id` only.
    */
   user?: ExchangeHandoff200SessionUser;
   /** Verified authentication factors accumulated by this session.
@@ -4637,6 +4854,55 @@ type GetClaimStatusParams = {
    */
   challenge_id: string;
 }; //#endregion
+//#region src/generated/model/getClaimWindow200.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * How long the project can still be claimed. Derived from the project's
+creation time and the fixed 14-day claim window (ADR 046); it does not
+depend on the challenge, which has its own much shorter expiry.
+
+ */
+type GetClaimWindow200 = {
+  /** The time when the project's claim window closes. */expires_at: string;
+  /** Whether the window has already closed. Reported alongside `expires_at`
+  rather than left to the client so a skewed browser clock cannot show a
+  claimable project as expired, or the reverse.
+   */
+  expired: boolean;
+}; //#endregion
+//#region src/generated/model/getClaimWindow404Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/getClaimWindowParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type GetClaimWindowParams = {
+  /**
+   * Unique identifier for this challenge (dialect-minted prefixed opaque string).
+   * @pattern ^ch_[a-zA-Z0-9_-]+$
+   */
+  challenge_id: string;
+}; //#endregion
 //#region src/generated/model/getEnvironmentByName200.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -5551,6 +5817,59 @@ type GetEvent200 = ({
     };
     [key: string]: unknown;
   };
+} & {
+  event_type: "release.created";
+  /** Allowlisted fields for `release.created`. The release id is already the
+  event's `entity_id`; the pinned set is repeated here so the audit stream
+  answers what a release contained without reading the release itself.
+  */
+  payload: {
+    content_hash?: string;
+    message?: string;
+    git_sha?: string;
+    git_dirty?: boolean;
+    pointers?: {
+      kind?: string;
+      handle?: string;
+      revision_id?: string;
+    }[];
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null;
+  /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+  */
+  metadata?: {
+    /** Observed HTTP requestor context on Path A request.api only. */client?: {
+      /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */ip?: string; /** Observed User-Agent header. */
+      user_agent?: string; /** Origin header when present. */
+      origin?: string;
+    };
+    [key: string]: unknown;
+  };
 } & {
   event_type: "request.api"; /** Payload for `request.api` events. */
   payload: {
@@ -6326,9 +6645,11 @@ the purpose + audience when a flow is created via POST /flow.
 type GetFlowDefinition200FlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
-  `switch` and `pivot` transitions. Renaming is not supported — the
-  `name` is part of the public contract another definition may
-  reference. Acts as the human display label as well; no separate slug.
+  `switch` and `pivot` transitions. Every revision of a flow shares its
+  `name`; publishing a definition under an existing `name` adds a
+  revision to that flow. Renaming is not supported — the `name` is part
+  of the public contract another definition may reference. Acts as the
+  human display label as well; no separate slug.
         * @pattern ^[a-z][a-z0-9-]*$
      */
   name: string;
@@ -7018,57 +7339,7 @@ type GetGrant200ObjectType = (typeof GetGrant200ObjectType)[keyof typeof GetGran
 declare const GetGrant200ObjectType: {
   readonly project: "project";
 }; //#endregion
-//#region src/generated/model/getGrant200PrincipalType.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Kind of principal bound by this grant.
- */
-type GetGrant200PrincipalType = (typeof GetGrant200PrincipalType)[keyof typeof GetGrant200PrincipalType];
-declare const GetGrant200PrincipalType: {
-  readonly user: "user";
-  readonly team: "team";
-}; //#endregion
-//#region src/generated/model/getGrant200Relation.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Catalog relation on the project.
- */
-type GetGrant200Relation = (typeof GetGrant200Relation)[keyof typeof GetGrant200Relation];
-declare const GetGrant200Relation: {
-  readonly viewer: "viewer";
-  readonly editor: "editor";
-  readonly admin: "admin";
-}; //#endregion
-//#region src/generated/model/getGrant200.d.ts
-/**
- * A collaboration grant binding a principal to a project relation.
- */
-type GetGrant200 = {
-  /** Managed assignment id (`asgn_<opaque>`). */id: string; /** Project this grant is scoped to. */
-  project_id: string; /** Kind of principal bound by this grant. */
-  principal_type: GetGrant200PrincipalType; /** Principal id (`user_<opaque>` or `team_<opaque>`). */
-  principal_id: string; /** Catalog object type. Always `project` for this API. */
-  object_type: GetGrant200ObjectType; /** Catalog relation on the project. */
-  relation: GetGrant200Relation; /** When the grant was created. */
-  created_at: string;
-  /** When the grant expires. Null when it does not expire. GET still
-  returns expired unrevoked grants; authorization ignores them.
-   */
-  expires_at?: string | null;
-}; //#endregion
-//#region src/generated/model/getGrant401Details.d.ts
+//#region src/generated/model/getGrant200Principal.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7077,14 +7348,273 @@ type GetGrant200 = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
+ * The principal named by `principal_id`, present only when the request
+asked for it with `expand: ["principal"]` (ADR 059). Absent means it
+was not requested; `null` means the principal cannot be loaded
+(deleted or missing). GET and create never set this field.
+
+When present, the body is the same representation `GET /users/{id}`
+serves for `principal_type=user`, or `GET /teams/{id}` for
+`principal_type=team`. Discriminate with the grant's existing
+`principal_type`.
+
+Requires `user.read` and `team.read` in addition to `project.read`.
+Both are checked on the whole request before the list.
+
  */
-//#endregion
-//#region src/generated/model/getGrantParams.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
+type GetGrant200Principal = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id: string;
+  /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
+  */
+  schema: string;
+  /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
+  */
+  attributes: {
+    [key: string]: unknown;
+  };
+  metadata: {
+    /** The time when the user was created. */created_at: string; /** The time when the user was last updated. */
+    updated_at: string; /** The status of the user. */
+    status: "active" | "suspended" | "deactivated" | "pending_purge";
+    /** The team that owns this user's identity lifecycle, or `null` when the
+    user is self-owned. This is a single team and a different concept from
+    the user's team memberships: it decides who may deprovision the user, not
+    which teams the user collaborates in. Memberships are their own paginated
+    resource — `GET /users/{user_id}/teams`.
+    */
+    lifecycle_owner_team_id?: string | null;
+    /** The team named by `lifecycle_owner_team_id`, present only when the
+    request asked for it with `expand: ["lifecycle_owner_team"]` (ADR 059).
+    Absent means it was not requested; `null` means the user is self-owned
+    and there is no owner to resolve.
+    Requesting it does not guarantee it is present on every user. Today
+    `team.read` is checked once for the whole request, so it is; once that
+    check is per team, a page may contain a user whose owner the caller may
+    not read, and such a row answers with neither the team nor `null` —
+    `null` already means self-owned. What it answers with instead is decided
+    with the granular scopes (#420); do not read the two cases above as the
+    complete set.
+    This is the same representation `GET /teams/{team_id}` serves. It is a
+    single team, not a collection, so it carries no cap and no truncation
+    flag.
+    */
+    readonly lifecycle_owner_team?: {
+      /** The unique identifier of the team. */id: string; /** The name of the team. */
+      name: string;
+      /** The lifecycle state of a team.
+      active: The team is available for use.
+      deactivated: The team is no longer active but is retained for historical and audit purposes.
+      */
+      status: "active" | "deactivated"; /** The time when the team was created. */
+      created_at: string; /** The time when the team was last updated. */
+      updated_at: string;
+    } | null;
+  };
+  /** The current value of the user schema's designated identifier
+  (`x-identifier`), resolved live at read time. Absent when the schema
+  designates no identifier or the user carries no value for it.
+  */
+  readonly identifier?: string;
+  /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+  */
+  readonly identifier_property?: string;
+  /** The `x-display` rendering — the designated properties' values joined
+  in list order, resolved live at read time. Purely presentational.
+  Absent when the schema designates no display properties or the user
+  carries no values for them. Clients render `display`, falling back
+  to `identifier`, then `id`.
+  */
+  readonly display?: string;
+  /** The user's team memberships, present only when the request asked for them with
+  `expand: ["teams"]` (ADR 059). Absent means it was not requested; `[]`
+  means the user has none.
+  Deliberately outside `metadata`: memberships are a related collection, not
+  part of the server-owned envelope, and it is a different concept from
+  `metadata.lifecycle_owner_team_id` (ADR 024).
+  */
+  readonly teams?: readonly {
+    /** The unique identifier of the team. */id: string; /** The name of the team. */
+    name: string;
+    /** The user's participation state on this team. Memberships the user was
+    removed from are not returned.
+    */
+    membership_status: "pending" | "active" | "inactive"; /** The time when the user joined this team. */
+    created_at: string; /** The time when this membership was last changed. */
+    updated_at: string;
+  }[];
+  /** True when the user is on more teams than the embedded list carries. The
+  embedded list is capped and cannot be paged; read them all at
+  `GET /users/{user_id}/teams`. Present only alongside `teams`.
+  */
+  readonly teams_truncated?: boolean;
+} | {
+  /** The unique identifier of the team. */id: string; /** The name of the team. */
+  name: string;
+  /** The lifecycle state of a team.
+  active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
+  */
+  status: "active" | "deactivated"; /** The time when the team was created. */
+  created_at: string; /** The time when the team was last updated. */
+  updated_at: string;
+} | null; //#endregion
+//#region src/generated/model/getGrant200PrincipalType.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Kind of principal bound by this grant.
+ */
+type GetGrant200PrincipalType = (typeof GetGrant200PrincipalType)[keyof typeof GetGrant200PrincipalType];
+declare const GetGrant200PrincipalType: {
+  readonly user: "user";
+  readonly team: "team";
+}; //#endregion
+//#region src/generated/model/getGrant200Relation.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Catalog relation on the project.
+ */
+type GetGrant200Relation = (typeof GetGrant200Relation)[keyof typeof GetGrant200Relation];
+declare const GetGrant200Relation: {
+  readonly viewer: "viewer";
+  readonly editor: "editor";
+  readonly admin: "admin";
+}; //#endregion
+//#region src/generated/model/getGrant200Team.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * A resolved reference to a team. Carries the team's id and name so a grant
+list is readable without embedding the full Team body. Id and display ride
+`project.read` (ADR 059 rule 8): a reference field carrying only the
+target's id and display strings needs no gate of its own. Missing or
+deleted teams degrade to `team_id` only.
+
+ */
+type GetGrant200Team = {
+  /** The referenced team's id (`team_<opaque>`). Always present. */team_id: string; /** The team's name. Absent when the team can no longer be loaded. */
+  name?: string;
+}; //#endregion
+//#region src/generated/model/getGrant200User.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+property-named, so responses can mix users from different schemas.
+`identifier` and `display` are resolved independently from the user
+schema's `x-identifier` and `x-display` designations, live at read time.
+Clients render `display`, falling back to `identifier`, then `user_id`.
+Missing or deleted users degrade to `user_id` only.
+
+ */
+type GetGrant200User = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */user_id: string;
+  /** The current value of the schema's designated identifier
+  (`x-identifier`). Absent when the schema designates no identifier or
+  the user carries no value for it.
+   */
+  identifier?: string;
+  /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+   */
+  identifier_property?: string;
+  /** The `x-display` rendering — the designated properties' values joined
+  in list order. Purely presentational, with no source attribution.
+  Absent when the schema designates no display properties or the user
+  carries no values for them.
+   */
+  display?: string;
+}; //#endregion
+//#region src/generated/model/getGrant200.d.ts
+/**
+ * A collaboration grant binding a principal to a project relation.
+ */
+type GetGrant200 = {
+  /** Managed assignment id (`asgn_<opaque>`). */id: string; /** Project this grant is scoped to. */
+  project_id: string; /** Kind of principal bound by this grant. */
+  principal_type: GetGrant200PrincipalType; /** Principal id (`user_<opaque>` or `team_<opaque>`). */
+  principal_id: string; /** Catalog object type. Always `project` for this API. */
+  object_type: GetGrant200ObjectType; /** Catalog relation on the project. */
+  relation: GetGrant200Relation; /** When the grant was created. */
+  created_at: string;
+  /** When the grant expires. Null when it does not expire. GET still
+  returns expired unrevoked grants; authorization ignores them.
+   */
+  expires_at?: string | null;
+  /** A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+  property-named, so responses can mix users from different schemas.
+  `identifier` and `display` are resolved independently from the user
+  schema's `x-identifier` and `x-display` designations, live at read time.
+  Clients render `display`, falling back to `identifier`, then `user_id`.
+  Missing or deleted users degrade to `user_id` only.
+   */
+  user?: GetGrant200User;
+  /** A resolved reference to a team. Carries the team's id and name so a grant
+  list is readable without embedding the full Team body. Id and display ride
+  `project.read` (ADR 059 rule 8): a reference field carrying only the
+  target's id and display strings needs no gate of its own. Missing or
+  deleted teams degrade to `team_id` only.
+   */
+  team?: GetGrant200Team;
+  /** The principal named by `principal_id`, present only when the request
+  asked for it with `expand: ["principal"]` (ADR 059). Absent means it
+  was not requested; `null` means the principal cannot be loaded
+  (deleted or missing). GET and create never set this field.
+     When present, the body is the same representation `GET /users/{id}`
+  serves for `principal_type=user`, or `GET /teams/{id}` for
+  `principal_type=team`. Discriminate with the grant's existing
+  `principal_type`.
+     Requires `user.read` and `team.read` in addition to `project.read`.
+  Both are checked on the whole request before the list.
+   */
+  readonly principal?: GetGrant200Principal;
+}; //#endregion
+//#region src/generated/model/getGrant401Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/getGrantParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
@@ -7273,6 +7803,7 @@ property-named, so responses can mix users from different schemas.
 `identifier` and `display` are resolved independently from the user
 schema's `x-identifier` and `x-display` designations, live at read time.
 Clients render `display`, falling back to `identifier`, then `user_id`.
+Missing or deleted users degrade to `user_id` only.
 
  */
 type GetMySession200User = {
@@ -7343,6 +7874,7 @@ type GetMySession200 = {
   `identifier` and `display` are resolved independently from the user
   schema's `x-identifier` and `x-display` designations, live at read time.
   Clients render `display`, falling back to `identifier`, then `user_id`.
+  Missing or deleted users degrade to `user_id` only.
    */
   user?: GetMySession200User;
   /** Verified authentication factors accumulated by this session.
@@ -8052,6 +8584,7 @@ property-named, so responses can mix users from different schemas.
 `identifier` and `display` are resolved independently from the user
 schema's `x-identifier` and `x-display` designations, live at read time.
 Clients render `display`, falling back to `identifier`, then `user_id`.
+Missing or deleted users degrade to `user_id` only.
 
  */
 type GetSession200User = {
@@ -8122,6 +8655,7 @@ type GetSession200 = {
   `identifier` and `display` are resolved independently from the user
   schema's `x-identifier` and `x-display` designations, live at read time.
   Clients render `display`, falling back to `identifier`, then `user_id`.
+  Missing or deleted users degrade to `user_id` only.
    */
   user?: GetSession200User;
   /** Verified authentication factors accumulated by this session.
@@ -9613,6 +10147,59 @@ type ListEvents200DataItem = ({
     };
     [key: string]: unknown;
   };
+} & {
+  event_type: "release.created";
+  /** Allowlisted fields for `release.created`. The release id is already the
+  event's `entity_id`; the pinned set is repeated here so the audit stream
+  answers what a release contained without reading the release itself.
+  */
+  payload: {
+    content_hash?: string;
+    message?: string;
+    git_sha?: string;
+    git_dirty?: boolean;
+    pointers?: {
+      kind?: string;
+      handle?: string;
+      revision_id?: string;
+    }[];
+  };
+}) | ({
+  /** Managed event id (`evt_<opaque>`). */id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string; /** Emit-time team scope, when the actor operated under a team. */
+  team_id?: string | null;
+  /** Semantic event name (dot-separated). Discriminator for the Event union —
+  see docs/design/api/events-catalog.md.
+  */
+  event_type: string; /** Wide-event category. */
+  category: "request" | "auth" | "session" | "admin" | "entity" | "signal"; /** When the action happened (server/storage clock, dialect-owned). */
+  occurred_at: string; /** When the row was inserted (server/storage clock, dialect-owned). */
+  created_at: string; /** Who triggered the event. */
+  actor_id?: string | null; /** Actor kind. */
+  actor_type?: "human" | "service" | "system" | "agent" | null; /** Resource type affected. */
+  entity_type?: string | null; /** Resource id affected. */
+  entity_id?: string | null; /** Application or agent that produced the event. */
+  client_id: string; /** Token id present at emit time, when any. */
+  token_id?: string; /** Delegation kind (omit when unset). */
+  delegation_type?: "direct" | "delegated" | "pat_shared" | "exchanged";
+  delegation_id?: string;
+  grantor?: string; /** Device fingerprint correlation id. */
+  fingerprint?: string; /** HTTP request correlation id. */
+  request_id?: string | null; /** Session correlation id. */
+  session_id?: string | null; /** Login flow correlation id. */
+  flow_id?: string | null;
+  /** Emit-time metadata, already redacted at write. Path A request.api may
+  set client (ip, user_agent, origin) for SIEM join on request_id. Not a
+  live risk-evaluator input.
+  */
+  metadata?: {
+    /** Observed HTTP requestor context on Path A request.api only. */client?: {
+      /** Client IP from the first X-Forwarded-For hop or RemoteAddr. */ip?: string; /** Observed User-Agent header. */
+      user_agent?: string; /** Origin header when present. */
+      origin?: string;
+    };
+    [key: string]: unknown;
+  };
 } & {
   event_type: "request.api"; /** Payload for `request.api` events. */
   payload: {
@@ -10480,9 +11067,11 @@ the purpose + audience when a flow is created via POST /flow.
 type ListFlowDefinitions200FlowDefinitionsItemFlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
-  `switch` and `pivot` transitions. Renaming is not supported — the
-  `name` is part of the public contract another definition may
-  reference. Acts as the human display label as well; no separate slug.
+  `switch` and `pivot` transitions. Every revision of a flow shares its
+  `name`; publishing a definition under an existing `name` adds a
+  revision to that flow. Renaming is not supported — the `name` is part
+  of the public contract another definition may reference. Acts as the
+  human display label as well; no separate slug.
         * @pattern ^[a-z][a-z0-9-]*$
      */
   name: string;
@@ -10633,6 +11222,9 @@ type ListFlowDefinitions200FlowDefinitionsItem = {
   updated_at: string;
 }; //#endregion
 //#region src/generated/model/listFlowDefinitions200.d.ts
+/**
+ * List of flow definitions, newest by creation time first.
+ */
 type ListFlowDefinitions200 = {
   flow_definitions: ListFlowDefinitions200FlowDefinitionsItem[]; /** The token to retrieve the next page of results. Absent if there are no more results. */
   next_page_token?: string | null;
@@ -10713,6 +11305,13 @@ type ListFlowDefinitionsParams = {
    * Filter flow definitions by purpose (e.g., registration, login).
    */
   purpose?: ListFlowDefinitionsPurpose;
+  /**
+  * The flow name to filter by. Every revision of a flow shares its
+  `name`, so the result is that flow's revisions, newest by creation
+  time first.
+    * @pattern ^[a-z][a-z0-9-]*$
+  */
+  name?: string;
   /**
    * Related entities to embed on each returned flow definition.
    */
@@ -11226,6 +11825,494 @@ type PatchProjectBody = {
  * OpenAPI spec version: 0.0.1
  */
 //#endregion
+//#region src/generated/model/queryGrants200GrantsItemObjectType.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Catalog object type. Always `project` for this API.
+ */
+type QueryGrants200GrantsItemObjectType = (typeof QueryGrants200GrantsItemObjectType)[keyof typeof QueryGrants200GrantsItemObjectType];
+declare const QueryGrants200GrantsItemObjectType: {
+  readonly project: "project";
+}; //#endregion
+//#region src/generated/model/queryGrants200GrantsItemPrincipal.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The principal named by `principal_id`, present only when the request
+asked for it with `expand: ["principal"]` (ADR 059). Absent means it
+was not requested; `null` means the principal cannot be loaded
+(deleted or missing). GET and create never set this field.
+
+When present, the body is the same representation `GET /users/{id}`
+serves for `principal_type=user`, or `GET /teams/{id}` for
+`principal_type=team`. Discriminate with the grant's existing
+`principal_type`.
+
+Requires `user.read` and `team.read` in addition to `project.read`.
+Both are checked on the whole request before the list.
+
+ */
+type QueryGrants200GrantsItemPrincipal = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */id: string;
+  /** The schema that defines the content of `attributes`. These schemas can be
+  created using the `/schemas` endpoint. A default schema is provided.
+  This schema can be retrieved using the same endpoint.
+  */
+  schema: string;
+  /** The user's content, satisfying the schema named by `schema`. Property
+  names and types are determined entirely by that schema.
+  */
+  attributes: {
+    [key: string]: unknown;
+  };
+  metadata: {
+    /** The time when the user was created. */created_at: string; /** The time when the user was last updated. */
+    updated_at: string; /** The status of the user. */
+    status: "active" | "suspended" | "deactivated" | "pending_purge";
+    /** The team that owns this user's identity lifecycle, or `null` when the
+    user is self-owned. This is a single team and a different concept from
+    the user's team memberships: it decides who may deprovision the user, not
+    which teams the user collaborates in. Memberships are their own paginated
+    resource — `GET /users/{user_id}/teams`.
+    */
+    lifecycle_owner_team_id?: string | null;
+    /** The team named by `lifecycle_owner_team_id`, present only when the
+    request asked for it with `expand: ["lifecycle_owner_team"]` (ADR 059).
+    Absent means it was not requested; `null` means the user is self-owned
+    and there is no owner to resolve.
+    Requesting it does not guarantee it is present on every user. Today
+    `team.read` is checked once for the whole request, so it is; once that
+    check is per team, a page may contain a user whose owner the caller may
+    not read, and such a row answers with neither the team nor `null` —
+    `null` already means self-owned. What it answers with instead is decided
+    with the granular scopes (#420); do not read the two cases above as the
+    complete set.
+    This is the same representation `GET /teams/{team_id}` serves. It is a
+    single team, not a collection, so it carries no cap and no truncation
+    flag.
+    */
+    readonly lifecycle_owner_team?: {
+      /** The unique identifier of the team. */id: string; /** The name of the team. */
+      name: string;
+      /** The lifecycle state of a team.
+      active: The team is available for use.
+      deactivated: The team is no longer active but is retained for historical and audit purposes.
+      */
+      status: "active" | "deactivated"; /** The time when the team was created. */
+      created_at: string; /** The time when the team was last updated. */
+      updated_at: string;
+    } | null;
+  };
+  /** The current value of the user schema's designated identifier
+  (`x-identifier`), resolved live at read time. Absent when the schema
+  designates no identifier or the user carries no value for it.
+  */
+  readonly identifier?: string;
+  /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+  */
+  readonly identifier_property?: string;
+  /** The `x-display` rendering — the designated properties' values joined
+  in list order, resolved live at read time. Purely presentational.
+  Absent when the schema designates no display properties or the user
+  carries no values for them. Clients render `display`, falling back
+  to `identifier`, then `id`.
+  */
+  readonly display?: string;
+  /** The user's team memberships, present only when the request asked for them with
+  `expand: ["teams"]` (ADR 059). Absent means it was not requested; `[]`
+  means the user has none.
+  Deliberately outside `metadata`: memberships are a related collection, not
+  part of the server-owned envelope, and it is a different concept from
+  `metadata.lifecycle_owner_team_id` (ADR 024).
+  */
+  readonly teams?: readonly {
+    /** The unique identifier of the team. */id: string; /** The name of the team. */
+    name: string;
+    /** The user's participation state on this team. Memberships the user was
+    removed from are not returned.
+    */
+    membership_status: "pending" | "active" | "inactive"; /** The time when the user joined this team. */
+    created_at: string; /** The time when this membership was last changed. */
+    updated_at: string;
+  }[];
+  /** True when the user is on more teams than the embedded list carries. The
+  embedded list is capped and cannot be paged; read them all at
+  `GET /users/{user_id}/teams`. Present only alongside `teams`.
+  */
+  readonly teams_truncated?: boolean;
+} | {
+  /** The unique identifier of the team. */id: string; /** The name of the team. */
+  name: string;
+  /** The lifecycle state of a team.
+  active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
+  */
+  status: "active" | "deactivated"; /** The time when the team was created. */
+  created_at: string; /** The time when the team was last updated. */
+  updated_at: string;
+} | null; //#endregion
+//#region src/generated/model/queryGrants200GrantsItemPrincipalType.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Kind of principal bound by this grant.
+ */
+type QueryGrants200GrantsItemPrincipalType = (typeof QueryGrants200GrantsItemPrincipalType)[keyof typeof QueryGrants200GrantsItemPrincipalType];
+declare const QueryGrants200GrantsItemPrincipalType: {
+  readonly user: "user";
+  readonly team: "team";
+}; //#endregion
+//#region src/generated/model/queryGrants200GrantsItemRelation.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Catalog relation on the project.
+ */
+type QueryGrants200GrantsItemRelation = (typeof QueryGrants200GrantsItemRelation)[keyof typeof QueryGrants200GrantsItemRelation];
+declare const QueryGrants200GrantsItemRelation: {
+  readonly viewer: "viewer";
+  readonly editor: "editor";
+  readonly admin: "admin";
+}; //#endregion
+//#region src/generated/model/queryGrants200GrantsItemTeam.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * A resolved reference to a team. Carries the team's id and name so a grant
+list is readable without embedding the full Team body. Id and display ride
+`project.read` (ADR 059 rule 8): a reference field carrying only the
+target's id and display strings needs no gate of its own. Missing or
+deleted teams degrade to `team_id` only.
+
+ */
+type QueryGrants200GrantsItemTeam = {
+  /** The referenced team's id (`team_<opaque>`). Always present. */team_id: string; /** The team's name. Absent when the team can no longer be loaded. */
+  name?: string;
+}; //#endregion
+//#region src/generated/model/queryGrants200GrantsItemUser.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+property-named, so responses can mix users from different schemas.
+`identifier` and `display` are resolved independently from the user
+schema's `x-identifier` and `x-display` designations, live at read time.
+Clients render `display`, falling back to `identifier`, then `user_id`.
+Missing or deleted users degrade to `user_id` only.
+
+ */
+type QueryGrants200GrantsItemUser = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */user_id: string;
+  /** The current value of the schema's designated identifier
+  (`x-identifier`). Absent when the schema designates no identifier or
+  the user carries no value for it.
+   */
+  identifier?: string;
+  /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+   */
+  identifier_property?: string;
+  /** The `x-display` rendering — the designated properties' values joined
+  in list order. Purely presentational, with no source attribution.
+  Absent when the schema designates no display properties or the user
+  carries no values for them.
+   */
+  display?: string;
+}; //#endregion
+//#region src/generated/model/queryGrants200GrantsItem.d.ts
+/**
+ * A collaboration grant binding a principal to a project relation.
+ */
+type QueryGrants200GrantsItem = {
+  /** Managed assignment id (`asgn_<opaque>`). */id: string; /** Project this grant is scoped to. */
+  project_id: string; /** Kind of principal bound by this grant. */
+  principal_type: QueryGrants200GrantsItemPrincipalType; /** Principal id (`user_<opaque>` or `team_<opaque>`). */
+  principal_id: string; /** Catalog object type. Always `project` for this API. */
+  object_type: QueryGrants200GrantsItemObjectType; /** Catalog relation on the project. */
+  relation: QueryGrants200GrantsItemRelation; /** When the grant was created. */
+  created_at: string;
+  /** When the grant expires. Null when it does not expire. GET still
+  returns expired unrevoked grants; authorization ignores them.
+   */
+  expires_at?: string | null;
+  /** A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+  property-named, so responses can mix users from different schemas.
+  `identifier` and `display` are resolved independently from the user
+  schema's `x-identifier` and `x-display` designations, live at read time.
+  Clients render `display`, falling back to `identifier`, then `user_id`.
+  Missing or deleted users degrade to `user_id` only.
+   */
+  user?: QueryGrants200GrantsItemUser;
+  /** A resolved reference to a team. Carries the team's id and name so a grant
+  list is readable without embedding the full Team body. Id and display ride
+  `project.read` (ADR 059 rule 8): a reference field carrying only the
+  target's id and display strings needs no gate of its own. Missing or
+  deleted teams degrade to `team_id` only.
+   */
+  team?: QueryGrants200GrantsItemTeam;
+  /** The principal named by `principal_id`, present only when the request
+  asked for it with `expand: ["principal"]` (ADR 059). Absent means it
+  was not requested; `null` means the principal cannot be loaded
+  (deleted or missing). GET and create never set this field.
+     When present, the body is the same representation `GET /users/{id}`
+  serves for `principal_type=user`, or `GET /teams/{id}` for
+  `principal_type=team`. Discriminate with the grant's existing
+  `principal_type`.
+     Requires `user.read` and `team.read` in addition to `project.read`.
+  Both are checked on the whole request before the list.
+   */
+  readonly principal?: QueryGrants200GrantsItemPrincipal;
+}; //#endregion
+//#region src/generated/model/queryGrants200.d.ts
+/**
+ * Paginated list of grants.
+ */
+type QueryGrants200 = {
+  grants: QueryGrants200GrantsItem[];
+  /** Token to pass as `page_token` in the next request to fetch the following page.
+  Absent when there are no more results. The follow-up request must repeat the
+  same `sorting` that produced this token (omit only when both pages use the default).
+   */
+  next_page_token?: string | null;
+}; //#endregion
+//#region src/generated/model/queryGrants400Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/queryGrantsBodyExpandItem.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * A related object to embed on each returned grant (ADR 059).
+
+- `principal`: the principal named by `principal_id`, as `principal` on
+  each grant. The property is omitted entirely when not requested. When
+  requested, it is the same body `GET /users/{id}` serves for
+  `principal_type=user`, or `GET /teams/{id}` for `principal_type=team`,
+  and `null` when that principal cannot be loaded. Discriminate with the
+  grant's existing `principal_type`.
+
+  Requires `user.read` and `team.read` in addition to `project.read`.
+  Both are checked on the whole request before the list, because a mixed
+  page is the common case. A caller who may not read either resource
+  receives 403 rather than a silently missing `principal`.
+
+ */
+type QueryGrantsBodyExpandItem = (typeof QueryGrantsBodyExpandItem)[keyof typeof QueryGrantsBodyExpandItem];
+declare const QueryGrantsBodyExpandItem: {
+  readonly principal: "principal";
+}; //#endregion
+//#region src/generated/model/queryGrantsBodyFilterItemField.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Field to filter grants by:
+- `created_at`: RFC3339 timestamp
+- `principal_type`: `user` or `team`
+- `principal_id`: principal id (`user_<opaque>` or `team_<opaque>`)
+- `relation`: `viewer`, `editor`, or `admin`
+- `expires_at`: RFC3339 timestamp (null when the grant does not expire)
+
+ */
+type QueryGrantsBodyFilterItemField = (typeof QueryGrantsBodyFilterItemField)[keyof typeof QueryGrantsBodyFilterItemField];
+declare const QueryGrantsBodyFilterItemField: {
+  readonly created_at: "created_at";
+  readonly principal_type: "principal_type";
+  readonly principal_id: "principal_id";
+  readonly relation: "relation";
+  readonly expires_at: "expires_at";
+}; //#endregion
+//#region src/generated/model/queryGrantsBodyFilterItemOperation.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Filter operation defines the operations which can be used when filtering on a
+query endpoint.
+
+On text fields, `contains` is a case-insensitive substring match. `equals`
+compares the whole value and is case-sensitive unless the field documents
+otherwise.
+
+ */
+type QueryGrantsBodyFilterItemOperation = (typeof QueryGrantsBodyFilterItemOperation)[keyof typeof QueryGrantsBodyFilterItemOperation];
+declare const QueryGrantsBodyFilterItemOperation: {
+  readonly equals: "equals";
+  readonly not_equals: "not_equals";
+  readonly contains: "contains";
+  readonly not_contains: "not_contains";
+  readonly less_than: "less_than";
+  readonly less_than_or_equal: "less_than_or_equal";
+  readonly greater_than: "greater_than";
+  readonly greater_than_or_equal: "greater_than_or_equal";
+}; //#endregion
+//#region src/generated/model/queryGrantsBodyFilterItem.d.ts
+type QueryGrantsBodyFilterItem = {
+  /** Field to filter grants by:
+  - `created_at`: RFC3339 timestamp
+  - `principal_type`: `user` or `team`
+  - `principal_id`: principal id (`user_<opaque>` or `team_<opaque>`)
+  - `relation`: `viewer`, `editor`, or `admin`
+  - `expires_at`: RFC3339 timestamp (null when the grant does not expire)
+   */
+  field: QueryGrantsBodyFilterItemField;
+  /** Filter-value specifies which values can be filtered by a query endpoint. This
+  is a union of types. When a value is specified which is not assignable to the
+  field which is being filtered, a 400 error will be returned.
+   */
+  value?: string | number | boolean | null;
+  /** Filter operation defines the operations which can be used when filtering on a
+  query endpoint.
+     On text fields, `contains` is a case-insensitive substring match. `equals`
+  compares the whole value and is case-sensitive unless the field documents
+  otherwise.
+   */
+  operation: QueryGrantsBodyFilterItemOperation;
+}; //#endregion
+//#region src/generated/model/queryGrantsBodySortingDirection.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type QueryGrantsBodySortingDirection = (typeof QueryGrantsBodySortingDirection)[keyof typeof QueryGrantsBodySortingDirection];
+declare const QueryGrantsBodySortingDirection: {
+  readonly asc: "asc";
+  readonly desc: "desc";
+}; //#endregion
+//#region src/generated/model/queryGrantsBodySortingField.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Field to sort grants by. Default is `created_at` ascending with `id` as
+the tiebreaker.
+
+ */
+type QueryGrantsBodySortingField = (typeof QueryGrantsBodySortingField)[keyof typeof QueryGrantsBodySortingField];
+declare const QueryGrantsBodySortingField: {
+  readonly created_at: "created_at";
+  readonly expires_at: "expires_at";
+  readonly id: "id";
+}; //#endregion
+//#region src/generated/model/queryGrantsBodySorting.d.ts
+type QueryGrantsBodySorting = {
+  /** Field to sort grants by. Default is `created_at` ascending with `id` as
+  the tiebreaker.
+   */
+  field: QueryGrantsBodySortingField;
+  direction: QueryGrantsBodySortingDirection;
+}; //#endregion
+//#region src/generated/model/queryGrantsBody.d.ts
+/**
+ * Request to query the grants of a project.
+ */
+type QueryGrantsBody = {
+  /**
+   * @minimum 1
+   * @maximum 100
+   */
+  limit?: number;
+  /** Token to retrieve the next page of results. Must be sent with the same
+  `sorting` as the request that issued the token. Omitting `sorting` reuses
+  the default sort and only succeeds when that default matches the token.
+   */
+  page_token?: string | null;
+  /** Related objects to embed on each grant (ADR 059). Omit it and no
+  embedded object is returned. An unrecognised value is rejected.
+   */
+  expand?: QueryGrantsBodyExpandItem[];
+  sorting?: QueryGrantsBodySorting; /** Filter criteria for querying grants. Combined with AND. */
+  filter?: QueryGrantsBodyFilterItem[];
+}; //#endregion
+//#region src/generated/model/queryGrantsDefault.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+//#endregion
+//#region src/generated/model/queryGrantsParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type QueryGrantsParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+}; //#endregion
 //#region src/generated/model/queryProjects200ProjectsItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -11491,6 +12578,7 @@ property-named, so responses can mix users from different schemas.
 `identifier` and `display` are resolved independently from the user
 schema's `x-identifier` and `x-display` designations, live at read time.
 Clients render `display`, falling back to `identifier`, then `user_id`.
+Missing or deleted users degrade to `user_id` only.
 
  */
 type QuerySessions200SessionsItemUser = {
@@ -11561,6 +12649,7 @@ type QuerySessions200SessionsItem = {
   `identifier` and `display` are resolved independently from the user
   schema's `x-identifier` and `x-display` designations, live at read time.
   Clients render `display`, falling back to `identifier`, then `user_id`.
+  Missing or deleted users degrade to `user_id` only.
    */
   user?: QuerySessions200SessionsItemUser;
   /** Verified authentication factors accumulated by this session.
@@ -13429,9 +14518,11 @@ the purpose + audience when a flow is created via POST /flow.
 type UpdateFlowDefinition200FlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
-  `switch` and `pivot` transitions. Renaming is not supported — the
-  `name` is part of the public contract another definition may
-  reference. Acts as the human display label as well; no separate slug.
+  `switch` and `pivot` transitions. Every revision of a flow shares its
+  `name`; publishing a definition under an existing `name` adds a
+  revision to that flow. Renaming is not supported — the `name` is part
+  of the public contract another definition may reference. Acts as the
+  human display label as well; no separate slug.
         * @pattern ^[a-z][a-z0-9-]*$
      */
   name: string;
@@ -13928,9 +15019,11 @@ the purpose + audience when a flow is created via POST /flow.
 type UpdateFlowDefinitionBodyFlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
-  `switch` and `pivot` transitions. Renaming is not supported — the
-  `name` is part of the public contract another definition may
-  reference. Acts as the human display label as well; no separate slug.
+  `switch` and `pivot` transitions. Every revision of a flow shares its
+  `name`; publishing a definition under an existing `name` adds a
+  revision to that flow. Renaming is not supported — the `name` is part
+  of the public contract another definition may reference. Acts as the
+  human display label as well; no separate slug.
         * @pattern ^[a-z][a-z0-9-]*$
      */
   name: string;
@@ -14840,5 +15933,5 @@ declare global {
   }
 } //# sourceMappingURL=zl-select.d.ts.map
 //#endregion
-export { CreateTeam201 as $, ListUserPasskeysParams as $t, CreateFlow201StepChallenge as A, ZlAlert as An, GetReleaseByIdParams as At, CreateGrantParams as B, ListBranding200Item as Bt, CreateBrandingBody as C, ZlCheckbox as Cn, GetHealthDefault as Ct, CreateFlow201BrandingLayout as D, zlCardManifest as Dn, GetProject200 as Dt, CreateFlow201Branding as E, ZlCard as En, GetMyUser200 as Et, CreateFlowBodyPurpose as F, ZlIcon as Fn, GetUserByID200 as Ft, CreateRelease201 as G, ListEventsParams as Gt, CreateProject201 as H, ListEnvironments200 as Ht, CreateFlowDefinition201 as I, zlIconManifest as In, GetUserByIDParams as It, CreateSchema201 as J, ListReleases200 as Jt, CreateReleaseBody as K, ListFlowDefinitions200 as Kt, CreateFlowDefinitionBody as L, InitClaim201 as Lt, CreateFlow201StepGates as M, IconName as Mn, GetSchemaByIdParams as Mt, CreateFlow201StepSsoProvidersItem as N, IconSize as Nn, GetSession200 as Nt, CreateFlow201Step as O, ZlButton as On, GetReadyDefault as Ot, CreateFlowBody as P, IconTone as Pn, GetTeam200 as Pt, CreateSessionBody as Q, ListUserPasskeys200 as Qt, CreateGrant201 as R, IssueChallenge201 as Rt, CreateBranding201 as S, VerifyChallengeProofBody as Sn, GetGrantParams as St, CreateFlow201 as T, zlCheckboxManifest as Tn, GetMySession200 as Tt, CreateProjectBody as U, ListEnvironmentsParams as Ut, CreateHandoff200 as V, ListBrandingParams as Vt, CreateRelease200 as W, ListEvents200 as Wt, CreateSchemaParams as X, ListSchemas200 as Xt, CreateSchemaBody as Y, ListReleasesParams as Yt, CreateSession201 as Z, ListSchemasParams as Zt, BeginUserPasskeyRegistrationBody as _, UpdateFlowDefinition200 as _n, GetEvent200 as _t, ZlPill as a, QueryProjectsBody as an, DeleteGrantParams as at, CreateAuthAttempt201 as b, UpdateTeamBody as bn, GetFlowStep200 as bt, ZlPasskeyErrorDetail as c, QuerySessionsParams as cn, ExchangeHandoffParams as ct, ZlPageShell as d, QueryTeamsParams as dn, GetAuthAttempt200 as dt, ListUserTeams200 as en, CreateTeamBody as et, zlPageShellManifest as f, QueryUsers200 as fn, GetBrandingById200 as ft, BeginUserPasskeyRegistration201 as g, SubmitFlowStepBody as gn, GetEnvironmentByNameParams as gt, zlFieldManifest as h, SubmitFlowStep200 as hn, GetEnvironmentByName200 as ht, zlSelectManifest as i, QueryProjects200 as in, CreateUserParams as it, CreateFlow201StepFieldsItem as j, zlAlertManifest as jn, GetSchemaById200 as jt, CreateFlow201StepActionsItem as k, zlButtonManifest as kn, GetReleaseById200 as kt, ZlPasskeyResultDetail as l, QueryTeams200 as ln, FinishUserPasskeyRegistration201 as lt, ZlFieldType as m, SetUserPasswordBody as mn, GetClaimStatusParams as mt, ZlSelectChangeDetail as n, PatchProject200 as nn, CreateUser201 as nt, zlPillManifest as o, QuerySessions200 as on, ExchangeHandoff200 as ot, ZlField as p, QueryUsersBody as pn, GetClaimStatus200 as pt, CreateReleaseParams as q, ListFlowDefinitionsParams as qt, ZlSelectOption as r, PatchProjectBody as rn, CreateUserBody as rt, ZlPasskey as s, QuerySessionsBody as sn, ExchangeHandoffBody as st, ZlSelect as t, ListUserTeamsParams as tn, CreateTeamParams as tt, zlPasskeyManifest as u, QueryTeamsBody as un, FinishUserPasskeyRegistrationBody as ut, CompleteClaim200 as v, UpdateFlowDefinitionBody as vn, GetEventParams as vt, CreateBrandingParams as w, ZlCheckboxChangeDetail as wn, GetLiveDefault as wt, CreateAuthAttemptBody as x, VerifyChallengeProof200 as xn, GetGrant200 as xt, CompleteClaimBody as y, UpdateTeam200 as yn, GetFlowDefinition200 as yt, CreateGrantBody as z, IssueChallengeBody as zt };
-//# sourceMappingURL=index-Dx8rvpNs.d.mts.map
+export { CreateTeam201 as $, ListSchemasParams as $t, CreateFlow201StepChallenge as A, zlCheckboxManifest as An, GetReadyDefault as At, CreateGrantParams as B, ZlIcon as Bn, IssueChallenge201 as Bt, CreateBrandingBody as C, UpdateFlowDefinitionBody as Cn, GetGrant200 as Ct, CreateFlow201BrandingLayout as D, VerifyChallengeProofBody as Dn, GetMySession200 as Dt, CreateFlow201Branding as E, VerifyChallengeProof200 as En, GetLiveDefault as Et, CreateFlowBodyPurpose as F, ZlAlert as Fn, GetSession200 as Ft, CreateRelease201 as G, ListEnvironmentsParams as Gt, CreateProject201 as H, ListBranding200Item as Ht, CreateFlowDefinition201 as I, zlAlertManifest as In, GetTeam200 as It, CreateSchema201 as J, ListFlowDefinitions200 as Jt, CreateReleaseBody as K, ListEvents200 as Kt, CreateFlowDefinitionBody as L, IconName as Ln, GetUserByID200 as Lt, CreateFlow201StepGates as M, zlCardManifest as Mn, GetReleaseByIdParams as Mt, CreateFlow201StepSsoProvidersItem as N, ZlButton as Nn, GetSchemaById200 as Nt, CreateFlow201Step as O, ZlCheckbox as On, GetMyUser200 as Ot, CreateFlowBody as P, zlButtonManifest as Pn, GetSchemaByIdParams as Pt, CreateSessionBody as Q, ListSchemas200 as Qt, CreateGrant201 as R, IconSize as Rn, GetUserByIDParams as Rt, CreateBranding201 as S, UpdateFlowDefinition200 as Sn, GetFlowStep200 as St, CreateFlow201 as T, UpdateTeamBody as Tn, GetHealthDefault as Tt, CreateProjectBody as U, ListBrandingParams as Ut, CreateHandoff200 as V, zlIconManifest as Vn, IssueChallengeBody as Vt, CreateRelease200 as W, ListEnvironments200 as Wt, CreateSchemaParams as X, ListReleases200 as Xt, CreateSchemaBody as Y, ListFlowDefinitionsParams as Yt, CreateSession201 as Z, ListReleasesParams as Zt, BeginUserPasskeyRegistrationBody as _, QueryUsers200 as _n, GetEnvironmentByName200 as _t, ZlPill as a, PatchProjectBody as an, DeleteGrantParams as at, CreateAuthAttempt201 as b, SubmitFlowStep200 as bn, GetEventParams as bt, ZlPasskeyErrorDetail as c, QueryGrantsParams as cn, ExchangeHandoffParams as ct, ZlPageShell as d, QuerySessions200 as dn, GetAuthAttempt200 as dt, ListUserPasskeys200 as en, CreateTeamBody as et, zlPageShellManifest as f, QuerySessionsBody as fn, GetBrandingById200 as ft, BeginUserPasskeyRegistration201 as g, QueryTeamsParams as gn, GetClaimWindowParams as gt, zlFieldManifest as h, QueryTeamsBody as hn, GetClaimWindow200 as ht, zlSelectManifest as i, PatchProject200 as in, CreateUserParams as it, CreateFlow201StepFieldsItem as j, ZlCard as jn, GetReleaseById200 as jt, CreateFlow201StepActionsItem as k, ZlCheckboxChangeDetail as kn, GetProject200 as kt, ZlPasskeyResultDetail as l, QueryProjects200 as ln, FinishUserPasskeyRegistration201 as lt, ZlFieldType as m, QueryTeams200 as mn, GetClaimStatusParams as mt, ZlSelectChangeDetail as n, ListUserTeams200 as nn, CreateUser201 as nt, zlPillManifest as o, QueryGrants200 as on, ExchangeHandoff200 as ot, ZlField as p, QuerySessionsParams as pn, GetClaimStatus200 as pt, CreateReleaseParams as q, ListEventsParams as qt, ZlSelectOption as r, ListUserTeamsParams as rn, CreateUserBody as rt, ZlPasskey as s, QueryGrantsBody as sn, ExchangeHandoffBody as st, ZlSelect as t, ListUserPasskeysParams as tn, CreateTeamParams as tt, zlPasskeyManifest as u, QueryProjectsBody as un, FinishUserPasskeyRegistrationBody as ut, CompleteClaim200 as v, QueryUsersBody as vn, GetEnvironmentByNameParams as vt, CreateBrandingParams as w, UpdateTeam200 as wn, GetGrantParams as wt, CreateAuthAttemptBody as x, SubmitFlowStepBody as xn, GetFlowDefinition200 as xt, CompleteClaimBody as y, SetUserPasswordBody as yn, GetEvent200 as yt, CreateGrantBody as z, IconTone as zn, InitClaim201 as zt };
+//# sourceMappingURL=index-DMPCvLh_.d.mts.map