@zitadel/components 1.0.0-alpha.21 → 1.0.0-alpha.23

package/dist/{index-DFdR16-D.d.mts → index-1PzVwdYA.d.mts}

@@ -1,12 +1,12 @@
-import { $ as CreateTeam201, $t as ListUserPasskeysParams, A as CreateFlow201StepChallenge, At as GetReleaseByIdParams, B as CreateGrantParams, Bt as ListBranding200Item, C as CreateBrandingBody, Ct as GetHealthDefault, D as CreateFlow201BrandingLayout, Dt as GetProject200, E as CreateFlow201Branding, Et as GetMyUser200, F as CreateFlowBodyPurpose, Ft as GetUserByID200, G as CreateRelease201, Gt as ListEventsParams, H as CreateProject201, Ht as ListEnvironments200, I as CreateFlowDefinition201, It as GetUserByIDParams, J as CreateSchema201, Jt as ListReleases200, K as CreateReleaseBody, Kt as ListFlowDefinitions200, L as CreateFlowDefinitionBody, Lt as InitClaim201, M as CreateFlow201StepGates, Mt as GetSchemaByIdParams, N as CreateFlow201StepSsoProvidersItem, Nt as GetSession200, O as CreateFlow201Step, Ot as GetReadyDefault, P as CreateFlowBody, Pt as GetTeam200, Q as CreateSessionBody, Qt as ListUserPasskeys200, R as CreateGrant201, Rt as IssueChallenge201, S as CreateBranding201, Sn as VerifyChallengeProofBody, St as GetGrantParams, T as CreateFlow201, Tt as GetMySession200, U as CreateProjectBody, Ut as ListEnvironmentsParams, V as CreateHandoff200, Vt as ListBrandingParams, W as CreateRelease200, Wt as ListEvents200, X as CreateSchemaParams, Xt as ListSchemas200, Y as CreateSchemaBody, Yt as ListReleasesParams, Z as CreateSession201, Zt as ListSchemasParams, _ as BeginUserPasskeyRegistrationBody, _n as UpdateFlowDefinition200, _t as GetEvent200, an as QueryProjectsBody, at as DeleteGrantParams, b as CreateAuthAttempt201, bn as UpdateTeamBody, bt as GetFlowStep200, cn as QuerySessionsParams, ct as ExchangeHandoffParams, dn as QueryTeamsParams, dt as GetAuthAttempt200, en as ListUserTeams200, et as CreateTeamBody, fn as QueryUsers200, ft as GetBrandingById200, g as BeginUserPasskeyRegistration201, gn as SubmitFlowStepBody, gt as GetEnvironmentByNameParams, hn as SubmitFlowStep200, ht as GetEnvironmentByName200, in as QueryProjects200, it as CreateUserParams, j as CreateFlow201StepFieldsItem, jt as GetSchemaById200, k as CreateFlow201StepActionsItem, kt as GetReleaseById200, ln as QueryTeams200, lt as FinishUserPasskeyRegistration201, mn as SetUserPasswordBody, mt as GetClaimStatusParams, nn as PatchProject200, nt as CreateUser201, on as QuerySessions200, ot as ExchangeHandoff200, pn as QueryUsersBody, pt as GetClaimStatus200, q as CreateReleaseParams, qt as ListFlowDefinitionsParams, rn as PatchProjectBody, rt as CreateUserBody, sn as QuerySessionsBody, st as ExchangeHandoffBody, tn as ListUserTeamsParams, tt as CreateTeamParams, un as QueryTeamsBody, ut as FinishUserPasskeyRegistrationBody, v as CompleteClaim200, vn as UpdateFlowDefinitionBody, vt as GetEventParams, w as CreateBrandingParams, wt as GetLiveDefault, x as CreateAuthAttemptBody, xn as VerifyChallengeProof200, xt as GetGrant200, y as CompleteClaimBody, yn as UpdateTeam200, yt as GetFlowDefinition200, z as CreateGrantBody, zt as IssueChallengeBody } from "./index-Dx8rvpNs.mjs";
+import { $ as CreateRelease200, $n as UpdateVariables200, $t as GetVariable200, A as CreateFlow201BrandingThemeLight, An as PatchUserByID200, At as GetEventParams, B as CreateFlowBodyPurpose, Bn as QuerySessions200, Bt as GetLiveDefault, C as CreateBrandingBody, Cn as ListUserPasskeysParams, Ct as GetClaimStatus200, D as CreateFlow201BrandingLayout, Dn as PatchMyUserBody, Dt as GetEnvironmentByName200, E as CreateFlow201Branding, En as PatchMyUser200, Et as GetClaimWindowParams, F as CreateFlow201StepChallenge, Fn as QueryIdps200, Ft as GetHealthDefault, G as CreateGrantParams, Gn as QueryTeamsParams, Gt as GetReleaseById200, H as CreateFlowDefinitionBody, Hn as QuerySessionsParams, Ht as GetMyUser200, I as CreateFlow201StepFieldsItem, In as QueryIdpsBody, It as GetIdpById200, J as CreateIdp201, Jn as SetUserPasswordBody, Jt as GetSchemaByIdParams, K as CreateHandoff200, Kn as QueryUsers200, Kt as GetReleaseByIdParams, L as CreateFlow201StepGates, Ln as QueryIdpsParams, Lt as GetIdpByIdParams, M as CreateFlow201BrandingTypography, Mn as QueryGrants200, Mt as GetFlowStep200, N as CreateFlow201Step, Nn as QueryGrantsBody, Nt as GetGrant200, O as CreateFlow201BrandingShape, On as PatchProject200, Ot as GetEnvironmentByNameParams, P as CreateFlow201StepActionsItem, Pn as QueryGrantsParams, Pt as GetGrantParams, Q as CreateProjectBody, Qn as UpdateTeamBody, Qt as GetUserByIDParams, R as CreateFlow201StepSsoProvidersItem, Rn as QueryProjects200, Rt as GetIdpRevisionById200, S as CreateBranding201, Sn as ListUserPasskeys200, St as GetBrandingById200, T as CreateFlow201, Tn as ListUserTeamsParams, Tt as GetClaimWindow200, U as CreateGrant201, Un as QueryTeams200, Ut as GetProject200, V as CreateFlowDefinition201, Vn as QuerySessionsBody, Vt as GetMySession200, W as CreateGrantBody, Wn as QueryTeamsBody, Wt as GetReadyDefault, X as CreateIdpParams, Xn as SubmitFlowStepBody, Xt as GetTeam200, Y as CreateIdpBody, Yn as SubmitFlowStep200, Yt as GetSession200, Z as CreateProject201, Zn as UpdateTeam200, Zt as GetUserByID200, _ as BeginUserPasskeyRegistrationBody, _n as ListMyProjectsParams, _t as ExchangeHandoffBody, an as IssueChallengeBody, at as CreateSchemaParams, b as CreateAuthAttempt201, bn as ListSchemas200, bt as FinishUserPasskeyRegistrationBody, cn as ListEnvironments200, ct as CreateTeam201, dn as ListEventsParams, dt as CreateUser201, en as GetVariableParams, er as UpdateVariablesBody, et as CreateRelease201, fn as ListFlowDefinitions200, ft as CreateUserBody, g as BeginUserPasskeyRegistration201, gn as ListMyProjects200, gt as ExchangeHandoff200, hn as ListIdpRevisionsParams, ht as DeleteVariableParams, in as IssueChallenge201, it as CreateSchemaBody, j as CreateFlow201BrandingThemeLightPalette, jn as PatchUserByIDBody, jt as GetFlowDefinition200, k as CreateFlow201BrandingTheme, kn as PatchProjectBody, kt as GetEvent200, ln as ListEnvironmentsParams, lt as CreateTeamBody, mn as ListIdpRevisions200, mt as DeleteGrantParams, nn as GetVariablesParams, nr as VerifyChallengeProof200, nt as CreateReleaseParams, on as ListBranding200Item, ot as CreateSession201, pn as ListFlowDefinitionsParams, pt as CreateUserParams, q as CreateIdp200, qn as QueryUsersBody, qt as GetSchemaById200, rn as InitClaim201, rr as VerifyChallengeProofBody, rt as CreateSchema201, sn as ListBrandingParams, st as CreateSessionBody, tn as GetVariables200, tr as UpdateVariablesParams, tt as CreateReleaseBody, un as ListEvents200, ut as CreateTeamParams, v as CompleteClaim200, vn as ListReleases200, vt as ExchangeHandoffParams, w as CreateBrandingParams, wn as ListUserTeams200, wt as GetClaimStatusParams, x as CreateAuthAttemptBody, xn as ListSchemasParams, xt as GetAuthAttempt200, y as CompleteClaimBody, yn as ListReleasesParams, yt as FinishUserPasskeyRegistration201, z as CreateFlowBody, zn as QueryProjectsBody, zt as GetIdpRevisionByIdParams } from "./index-BRd9vg2q.mjs";
 import * as _$lit from "lit";
 import { LitElement, PropertyValues, ReactiveController, ReactiveControllerHost, nothing } from "lit";
 import layoutChromeCss from "./templates/layout-chrome.css?inline";
 
-//#region ../api/dist/zitadelNextGen-C8m49W5h.d.mts
+//#region ../api/dist/zitadelNextGen-DPyZep6V.d.mts
 //#region src/generated/endpoints/zitadelNextGen.d.ts
 declare namespace zitadelNextGen_d_exports {
-  export { beginUserPasskeyRegistration, completeClaim, createAuthAttempt, createBranding, createFlow, createFlowDefinition, createGrant, createHandoff, createProject, createRelease, createSchema, createSession, createTeam, createUser, deleteFlowDefinition, deleteGrant, deleteTeam, deleteUserByID, exchangeHandoff, finishUserPasskeyRegistration, getAuthAttempt, getBeginUserPasskeyRegistrationUrl, getBrandingById, getClaimStatus, getCompleteClaimUrl, getCreateAuthAttemptUrl, getCreateBrandingUrl, getCreateFlowDefinitionUrl, getCreateFlowUrl, getCreateGrantUrl, getCreateHandoffUrl, getCreateProjectUrl, getCreateReleaseUrl, getCreateSchemaUrl, getCreateSessionUrl, getCreateTeamUrl, getCreateUserUrl, getDeleteFlowDefinitionUrl, getDeleteGrantUrl, getDeleteTeamUrl, getDeleteUserByIDUrl, getEnvironmentByName, getEvent, getExchangeHandoffUrl, getFinishUserPasskeyRegistrationUrl, getFlowDefinition, getFlowStep, getGetAuthAttemptUrl, getGetBrandingByIdUrl, getGetClaimStatusUrl, getGetEnvironmentByNameUrl, getGetEventUrl, getGetFlowDefinitionUrl, getGetFlowStepUrl, getGetGrantUrl, getGetHealthUrl, getGetLiveUrl, getGetMySessionUrl, getGetMyUserUrl, getGetProjectUrl, getGetReadyUrl, getGetReleaseByIdUrl, getGetSchemaByIdUrl, getGetSessionUrl, getGetTeamUrl, getGetUserByIDUrl, getGrant, getHealth, getInitClaimUrl, getIssueChallengeUrl, getListBrandingUrl, getListEnvironmentsUrl, getListEventsUrl, getListFlowDefinitionsUrl, getListReleasesUrl, getListSchemasUrl, getListUserPasskeysUrl, getListUserTeamsUrl, getLive, getMySession, getMyUser, getPatchProjectUrl, getProject, getQueryProjectsUrl, getQuerySessionsUrl, getQueryTeamsUrl, getQueryUsersUrl, getReady, getReleaseById, getRevokeMySessionUrl, getRevokeSessionUrl, getSchemaById, getSession, getSetUserPasswordUrl, getSubmitFlowStepUrl, getTeam, getUpdateFlowDefinitionUrl, getUpdateTeamUrl, getUserByID, getVerifyChallengeProofUrl, initClaim, issueChallenge, listBranding, listEnvironments, listEvents, listFlowDefinitions, listReleases, listSchemas, listUserPasskeys, listUserTeams, patchProject, queryProjects, querySessions, queryTeams, queryUsers, revokeMySession, revokeSession, setUserPassword, submitFlowStep, updateFlowDefinition, updateTeam, verifyChallengeProof };
+  export { beginUserPasskeyRegistration, completeClaim, createAuthAttempt, createBranding, createFlow, createFlowDefinition, createGrant, createHandoff, createIdp, createProject, createRelease, createSchema, createSession, createTeam, createUser, deleteGrant, deleteTeam, deleteUserByID, deleteVariable, exchangeHandoff, finishUserPasskeyRegistration, getAuthAttempt, getBeginUserPasskeyRegistrationUrl, getBrandingById, getClaimStatus, getClaimWindow, getCompleteClaimUrl, getCreateAuthAttemptUrl, getCreateBrandingUrl, getCreateFlowDefinitionUrl, getCreateFlowUrl, getCreateGrantUrl, getCreateHandoffUrl, getCreateIdpUrl, getCreateProjectUrl, getCreateReleaseUrl, getCreateSchemaUrl, getCreateSessionUrl, getCreateTeamUrl, getCreateUserUrl, getDeleteGrantUrl, getDeleteTeamUrl, getDeleteUserByIDUrl, getDeleteVariableUrl, getEnvironmentByName, getEvent, getExchangeHandoffUrl, getFinishUserPasskeyRegistrationUrl, getFlowDefinition, getFlowStep, getGetAuthAttemptUrl, getGetBrandingByIdUrl, getGetClaimStatusUrl, getGetClaimWindowUrl, getGetEnvironmentByNameUrl, getGetEventUrl, getGetFlowDefinitionUrl, getGetFlowStepUrl, getGetGrantUrl, getGetHealthUrl, getGetIdpByIdUrl, getGetIdpRevisionByIdUrl, getGetLiveUrl, getGetMySessionUrl, getGetMyUserUrl, getGetProjectUrl, getGetReadyUrl, getGetReleaseByIdUrl, getGetSchemaByIdUrl, getGetSessionUrl, getGetTeamUrl, getGetUserByIDUrl, getGetVariableUrl, getGetVariablesUrl, getGrant, getHealth, getIdpById, getIdpRevisionById, getInitClaimUrl, getIssueChallengeUrl, getListBrandingUrl, getListEnvironmentsUrl, getListEventsUrl, getListFlowDefinitionsUrl, getListIdpRevisionsUrl, getListMyProjectsUrl, getListReleasesUrl, getListSchemasUrl, getListUserPasskeysUrl, getListUserTeamsUrl, getLive, getMySession, getMyUser, getPatchMyUserUrl, getPatchProjectUrl, getPatchUserByIDUrl, getProject, getQueryGrantsUrl, getQueryIdpsUrl, getQueryProjectsUrl, getQuerySessionsUrl, getQueryTeamsUrl, getQueryUsersUrl, getReady, getReleaseById, getRevokeMySessionUrl, getRevokeSessionUrl, getSchemaById, getSession, getSetUserPasswordUrl, getSubmitFlowStepUrl, getTeam, getUpdateTeamUrl, getUpdateVariablesUrl, getUserByID, getVariable, getVariables, getVerifyChallengeProofUrl, initClaim, issueChallenge, listBranding, listEnvironments, listEvents, listFlowDefinitions, listIdpRevisions, listMyProjects, listReleases, listSchemas, listUserPasskeys, listUserTeams, patchMyUser, patchProject, patchUserByID, queryGrants, queryIdps, queryProjects, querySessions, queryTeams, queryUsers, revokeMySession, revokeSession, setUserPassword, submitFlowStep, updateTeam, updateVariables, verifyChallengeProof };
 }
 declare const getGetHealthUrl: () => string;
 /**
@@ -35,9 +35,14 @@ declare const getQueryUsersUrl: () => string;
 /**
  * Returns the users of a project, paginated with a cursor.
 
-The project comes from the credential, not from a parameter: the operation
-is bound to the token's own project by construction. This is why it takes
-no `project_id`, unlike the other query endpoints.
+The project comes from the credential, not from a parameter: the
+operation is bound to the credential's home project by construction
+(oauth2 secret or user-bound session). This is why it takes no
+`project_id`, unlike the other query endpoints.
+
+Accepts either a project secret (`oauth2`) or a user-bound Console
+session cookie (`nextgenSession`). CSRF/Origin for cookie mutations
+is a follow-up (#1140).
 
  * @summary Query users
  */
@@ -47,6 +52,16 @@ declare const getGetUserByIDUrl: (userId: string, params?: GetUserByIDParams) =>
  * @summary Get user by ID
  */
 declare const getUserByID: (userId: string, params?: GetUserByIDParams, options?: RequestInit) => Promise<GetUserByID200>;
+declare const getPatchUserByIDUrl: (userId: string) => string;
+/**
+ * Partially updates a user's schema-defined attributes, and optionally
+moves the user to another registered schema. The merged result is
+validated against the schema before commit. Concurrent writes are
+last-write-wins.
+
+ * @summary Update user by ID
+ */
+declare const patchUserByID: (userId: string, patchUserByIDBody: PatchUserByIDBody, options?: RequestInit) => Promise<PatchUserByID200>;
 declare const getDeleteUserByIDUrl: (userId: string) => string;
 /**
  * @summary Delete user by ID
@@ -103,6 +118,28 @@ declare const getGetMyUserUrl: () => string;
  * @summary Get my user information
  */
 declare const getMyUser: (options?: RequestInit) => Promise<GetMyUser200>;
+declare const getPatchMyUserUrl: () => string;
+/**
+ * Partially updates the caller's own schema-defined attributes. The merged
+result is validated against the user's schema before commit. Concurrent
+writes are last-write-wins.
+
+ * @summary Update my user information
+ */
+declare const patchMyUser: (patchMyUserBody: PatchMyUserBody, options?: RequestInit) => Promise<PatchMyUser200>;
+declare const getListMyProjectsUrl: (params?: ListMyProjectsParams) => string;
+/**
+ * The projects the signed-in user holds an active grant on, either directly or
+through a team they are a member of. Ordered by project id and paged with an
+opaque cursor.
+
+This is not the same question as `queryProjects`, which answers with the one
+project the calling credential is bound to. Here the session is the caller
+and the grants are the answer, so the list spans projects.
+
+ * @summary List the projects I can act on
+ */
+declare const listMyProjects: (params?: ListMyProjectsParams, options?: RequestInit) => Promise<ListMyProjects200>;
 declare const getCreateFlowUrl: () => string;
 /**
  * Resolves a flow definition based on purpose + audience context and returns
@@ -271,7 +308,11 @@ declare const getGetClaimStatusUrl: (projectId: string, params: GetClaimStatusPa
  * Polled by the CLI while a browser completes the claim. Authorized by the
 project secret that initiated the challenge. Returns `pending`, or
 `completed` with the owning team, the claim timestamp, and the dashboard
-URL once the browser leg has finished.
+URL once the project is claimed. The claim grant, not the polled
+challenge, is the source of truth: a project claimed through another
+concurrent challenge also reports `completed`, and a completed claim
+keeps reporting `completed` past this challenge's expiry and past the
+project's claim window.
 
  * @summary Get claim status
  */
@@ -286,6 +327,18 @@ its single-use, browser-safe authorization.
  * @summary Complete a project claim
  */
 declare const completeClaim: (projectId: string, completeClaimBody: CompleteClaimBody, options?: RequestInit) => Promise<CompleteClaim200>;
+declare const getGetClaimWindowUrl: (projectId: string, params: GetClaimWindowParams) => string;
+/**
+ * Read by the claim page in the browser to show how long is left to claim the
+project. Unauthenticated by design: the claim page runs this before the
+developer has signed in, and holding the `challenge_id` from the claim URL
+is the authorization — the same capability `claim/complete` accepts. It
+reveals only the window, never the project itself, and unlike
+`claim/complete` it spends nothing, so a reload is free.
+
+ * @summary Get the claim window for a project
+ */
+declare const getClaimWindow: (projectId: string, params: GetClaimWindowParams, options?: RequestInit) => Promise<GetClaimWindow200>;
 declare const getCreateSessionUrl: () => string;
 /**
  * Creates an anonymous session shell with no user and no factors (`state: building`).
@@ -430,19 +483,25 @@ object type, list with `revisions=latest`.
 declare const getSchemaById: (id: string, params?: GetSchemaByIdParams, options?: RequestInit) => Promise<GetSchemaById200>;
 declare const getCreateFlowDefinitionUrl: () => string;
 /**
- * Creates a new flow definition.
+ * Publishes a new flow definition revision.
 Flow definitions are templates that define the sequence of steps (capabilities)
 for a particular user journey (e.g., registration, login, password reset).
 
 Flow definitions are created based on the flow definition schema, which includes the flow's purpose, audience, and the steps involved.
 
+Every call allocates a new opaque id. Revisions of one flow share its
+`name`; posting a definition under an existing `name` publishes a new
+revision of that flow, it is not a conflict. List with `name` to see a
+flow's revisions, newest by creation time first.
+
  * @summary Create a new flow definition
  */
 declare const createFlowDefinition: (createFlowDefinitionBody: CreateFlowDefinitionBody, options?: RequestInit) => Promise<CreateFlowDefinition201>;
 declare const getListFlowDefinitionsUrl: (params: ListFlowDefinitionsParams) => string;
 /**
- * Retrieves a list of all flow definitions.
+ * Retrieves a list of all flow definitions, newest by creation time first.
 This endpoint can be used to view existing flow definitions and their configurations.
+Filter by `name` to list the revisions of one flow.
 
  * @summary List flow definitions
  */
@@ -453,23 +512,6 @@ declare const getGetFlowDefinitionUrl: (id: string) => string;
  * @summary Get a flow definition by id
  */
 declare const getFlowDefinition: (id: string, options?: RequestInit) => Promise<GetFlowDefinition200>;
-declare const getUpdateFlowDefinitionUrl: (id: string) => string;
-/**
- * Update a flow definition by id. This endpoint replaces the existing flow definition.
-If `flow_definition.status` is omitted, the current status is preserved
-
- * @summary Update a flow definition by id
- */
-declare const updateFlowDefinition: (id: string, updateFlowDefinitionBody: UpdateFlowDefinitionBody, options?: RequestInit) => Promise<UpdateFlowDefinition200>;
-declare const getDeleteFlowDefinitionUrl: (id: string) => string;
-/**
- * Delete a flow definition by id.
-If the flow definition is currently being used by a flow, the deletion will fail.
-If the flow definition is the last active flow definition for a given purpose, the deletion will fail to prevent disruption of new flows being started for that purpose.
-
- * @summary Delete a flow definition by id
- */
-declare const deleteFlowDefinition: (id: string, options?: RequestInit) => Promise<void>;
 declare const getCreateTeamUrl: (params: CreateTeamParams) => string;
 /**
  * @summary Create team
@@ -500,6 +542,11 @@ users whose lifecycle it owns are deactivated with it.
 The request is idempotent. Deleting a team that is already deactivated
 or doesn't exist succeeds without changing anything.
 
+A team that still owns a project is refused with `409
+team.owns_project`: deactivating it would leave the project owned by a
+dead team and so unmanageable. No endpoint releases that ownership yet,
+so such a team cannot currently be deactivated through the API.
+
  * @summary Delete team
  */
 declare const deleteTeam: (teamId: string, options?: RequestInit) => Promise<void>;
@@ -531,8 +578,7 @@ declare const getCreateBrandingUrl: (params: CreateBrandingParams) => string;
 /**
  * Publishes a new immutable branding revision for the project. Branding
 revisions cannot be updated or deleted; every edit publishes a new
-revision, and flow responses resolve the latest revision per project
-(see ADR 040).
+revision, and flow responses resolve the latest revision per project.
 
 The `liquid_template` is validated lexically on save (size, encoding,
 banned patterns such as `<script>` tags, inline event handlers, and the
@@ -546,9 +592,9 @@ declare const getListBrandingUrl: (params: ListBrandingParams) => string;
 /**
  * Lists branding revisions for the project, newest first, capped at the
 100 most recent. The first entry is the revision flow responses
-currently resolve. Deliberately unpaginated in v1 — list endpoints
-gain a real query mechanism together (ADR 031); advertising pagination
-parameters the server ignores would be worse than none.
+currently resolve. Deliberately unpaginated in v1 — list endpoints gain a
+real query mechanism together; advertising pagination parameters the
+server ignores would be worse than none.
 
  * @summary List branding revisions
  */
@@ -559,6 +605,72 @@ declare const getGetBrandingByIdUrl: (id: string) => string;
  * @summary Get a branding revision by ID
  */
 declare const getBrandingById: (id: string, options?: RequestInit) => Promise<GetBrandingById200>;
+declare const getCreateIdpUrl: (params: CreateIdpParams) => string;
+/**
+ * Creates or revises a connection document. If the slug does not already
+exist, a new connection is created. If a connection with that slug already
+exists, a revision is created.
+
+A revision gets a new `revision_id` and does not modify the connection
+`id`, so identity links that reference the connection keep resolving while
+releases and auth attempts stay pinned to the revision they captured.
+
+Identity fields are fixed for the life of the connection and a revision
+that changes one is rejected: `protocol`, `subject_claim`, and the
+endpoints that name the authority (`issuer` for OIDC, `token_endpoint`
+and `userinfo_endpoint` for OAuth 2.0). Their values decide which provider
+account a stored subject belongs to, so changing one would silently
+repoint existing identities at a different provider.
+
+`subject_claim` is optional for OIDC and required for OAuth 2.0. For an
+OIDC connection, `sub` is used as the default value. If a revision updates
+`subject_claim` to a different value than the one set during creation, the
+request is rejected.
+
+The document is validated against the `idp-connection.json` schema before
+anything is stored.
+
+ * @summary Create or revise an identity provider connection
+ */
+declare const createIdp: (createIdpBody: CreateIdpBody, params: CreateIdpParams, options?: RequestInit) => Promise<CreateIdp200 | CreateIdp201>;
+declare const getQueryIdpsUrl: (params: QueryIdpsParams) => string;
+/**
+ * Returns the identity provider connections of a project, paginated with a
+cursor. One row per connection, carrying its newest revision.
+
+ * @summary Query identity provider connections
+ */
+declare const queryIdps: (queryIdpsBody: QueryIdpsBody, params: QueryIdpsParams, options?: RequestInit) => Promise<QueryIdps200>;
+declare const getGetIdpByIdUrl: (id: string, params: GetIdpByIdParams) => string;
+/**
+ * Reads a connection by its id, at its newest revision.
+`GET /idps/{id}/revisions` lists every revision of the connection.
+
+The lookup is scoped to the project in `project_id`.
+
+ * @summary Get an identity provider connection by id
+ */
+declare const getIdpById: (id: string, params: GetIdpByIdParams, options?: RequestInit) => Promise<GetIdpById200>;
+declare const getListIdpRevisionsUrl: (id: string, params: ListIdpRevisionsParams) => string;
+/**
+ * Returns every revision of one connection, newest first, paginated with a
+cursor. The order is fixed, so there is no `sorting`.
+
+The lookup is scoped to the project in `project_id`.
+
+ * @summary List the revisions of an identity provider connection
+ */
+declare const listIdpRevisions: (id: string, params: ListIdpRevisionsParams, options?: RequestInit) => Promise<ListIdpRevisions200>;
+declare const getGetIdpRevisionByIdUrl: (revisionId: string, params: GetIdpRevisionByIdParams) => string;
+/**
+ * Reads one revision of a connection by its `revision_id`, the value an auth
+attempt or a release pins.
+
+The lookup is scoped to the project in `project_id`.
+
+ * @summary Get one revision of an identity provider connection
+ */
+declare const getIdpRevisionById: (revisionId: string, params: GetIdpRevisionByIdParams, options?: RequestInit) => Promise<GetIdpRevisionById200>;
 declare const getCreateReleaseUrl: (params: CreateReleaseParams) => string;
 /**
  * Bundles a release from revisions that already exist, supplied as
@@ -610,14 +722,49 @@ declare const getCreateGrantUrl: (params: CreateGrantParams) => string;
 /**
  * Bind a user or team to `project.viewer`, `project.editor`, or
 `project.admin` on the project identified by the `project-id` header.
-IDs are `asgn_<opaque>`. Owning-team (`project.team`) grants are not
-created here — claim owns that path. An unrevoked grant with the same
-principal and relation occupies the unique key even after `expires_at`;
-DELETE it before re-creating.
+Name the principal with `user` (`user_id` or `identifier`) or `team`
+(`team_id` or `name`). IDs are `asgn_<opaque>`. Owning-team
+(`project.team`) grants are not created here — claim owns that path. An
+unrevoked grant with the same principal and relation occupies the unique
+key even after `expires_at`; DELETE it before re-creating.
+Create does not accept `expand`. The `user_id` and team locators
+return 201, whose `user` / `team` carry only `user_id` / `team_id`,
+and still 404 / 409 when the principal is missing or the tuple
+already exists. Creating by `user.identifier` answers 202 with no
+body on every outcome. Granting the session caller's own user is
+`grant.invalid` on either user locator. Read the grant back for
+identifier and display.
+
+Accepts either a project secret (`oauth2`) or a user-bound Console
+session cookie (`nextgenSession`). Session callers are authorized as
+the human against the target project (home may differ). CSRF/Origin
+for cookie mutations is a follow-up (#1140).
 
  * @summary Create grant
  */
-declare const createGrant: (createGrantBody: CreateGrantBody, params: CreateGrantParams, options?: RequestInit) => Promise<CreateGrant201>;
+declare const createGrant: (createGrantBody: CreateGrantBody, params: CreateGrantParams, options?: RequestInit) => Promise<CreateGrant201 | void>;
+declare const getQueryGrantsUrl: (params: QueryGrantsParams) => string;
+/**
+ * Returns the collaboration grants of a project, paginated with a cursor.
+Only unrevoked grants this API manages are listed (user or team bound to
+viewer, editor, or admin), including expired grants so a client can
+DELETE before re-granting. Project-secret setup (`sk_proj`) and
+owning-team (`relation=team`) rows are not returned. Grants are not in
+`resource_scope_index`; project scope is required on the query (same as
+get). Requires `project.read`. `expand: ["principal"]` adds envelope
+fields on `user` / `team` and additionally requires `user.read` and
+`team.read` for project secrets (documented on the expand enum; those
+scopes cannot be ANDed onto this security block because they are
+body-conditional). A user-bound Console session that already passed
+the project Check may expand without those scopes.
+
+Accepts either a project secret (`oauth2`) or a user-bound Console
+session cookie (`nextgenSession`). CSRF/Origin for cookie mutations
+is a follow-up (#1140).
+
+ * @summary Query grants
+ */
+declare const queryGrants: (queryGrantsBody: QueryGrantsBody, params: QueryGrantsParams, options?: RequestInit) => Promise<QueryGrants200>;
 declare const getGetGrantUrl: (id: string, params: GetGrantParams) => string;
 /**
  * Loads a grant by `(project_id, id)` that this API manages (user or team
@@ -628,6 +775,14 @@ still ignores expired grants. Grants are not registered in
 `resource_scope_index`; project scope is required on the query (same as
 events). Misses, revoked rows, project-secret setup (`sk_proj`),
 owning-team (`relation=team`) rows, and cross-project ids return 404.
+`expand=principal` adds envelope fields on `user` or `team` and requires
+`user.read` and `team.read` in addition to `project.read` for project
+secrets. A user-bound Console session that already passed the project
+Check may expand without those scopes.
+
+Accepts either a project secret (`oauth2`) or a user-bound Console
+session cookie (`nextgenSession`). CSRF/Origin for cookie mutations
+is a follow-up (#1140).
 
  * @summary Get grant
  */
@@ -639,6 +794,10 @@ Already-revoked, missing, project-secret setup, and owning-team grants
 return 404. The row is not un-revoked. Expired grants can still be
 revoked so the unique binding can be reused.
 
+Accepts either a project secret (`oauth2`) or a user-bound Console
+session cookie (`nextgenSession`). CSRF/Origin for cookie mutations
+is a follow-up (#1140).
+
  * @summary Revoke grant
  */
 declare const deleteGrant: (id: string, params: DeleteGrantParams, options?: RequestInit) => Promise<void>;
@@ -669,7 +828,70 @@ Pre-claim projects return 404 (stored events stay invisible until claim).
 
  * @summary Get event by ID
  */
-declare const getEvent: (id: string, params: GetEventParams, options?: RequestInit) => Promise<GetEvent200>; //#endregion
+declare const getEvent: (id: string, params: GetEventParams, options?: RequestInit) => Promise<GetEvent200>;
+declare const getGetVariablesUrl: (params: GetVariablesParams) => string;
+/**
+ * Returns the variables entered at the owner this request addresses, keyed by
+name — one environment of the project with `environment_name`, the project
+level itself without it.
+
+Owners are separate, not a ladder: an environment does not inherit the
+project's variables and the project does not see its environments'. Reading
+everything a project holds therefore means reading each owner in turn.
+
+Secret values are not returned. A secret appears as `{"secret": true}`,
+which says a value is held without disclosing it.
+
+ * @summary Get variables
+ */
+declare const getVariables: (params: GetVariablesParams, options?: RequestInit) => Promise<GetVariables200>;
+declare const getUpdateVariablesUrl: (params: UpdateVariablesParams) => string;
+/**
+ * Enters, replaces and removes variables at the owner this request
+addresses.
+
+Every name in the body is applied at exactly that owner — the project, or
+the environment named by `environment_name` — and reaches no other. Names
+not in the body are untouched.
+
+A bare scalar enters a non-secret value. `{"value": …, "secret": true}`
+stores the value encrypted under the project's active `secret` key, after
+which it can be referenced but not read back. `null` removes the name from
+this owner (RFC 7386), which is how several variables are removed in one
+request; removing a name this owner does not hold is a no-op rather than an
+error.
+
+The body is applied whole or not at all, so a rejected request leaves the
+owner exactly as it was. Writing the same name and owner twice replaces the
+value rather than duplicating it, which makes a retry safe.
+
+ * @summary Update variables
+ */
+declare const updateVariables: (updateVariablesBody: UpdateVariablesBody, params: UpdateVariablesParams, options?: RequestInit) => Promise<UpdateVariables200>;
+declare const getGetVariableUrl: (variableName: string, params: GetVariableParams) => string;
+/**
+ * Reads one variable by name from the owner this request addresses — one
+environment of the project with `environment_name`, the project level
+itself without it.
+
+A name that owner has not entered answers `var.not_found`, even when
+another owner of the same project holds it: nothing is inherited. A secret
+is found but not disclosed: the response is `{"secret": true}`.
+
+ * @summary Get a variable
+ */
+declare const getVariable: (variableName: string, params: GetVariableParams, options?: RequestInit) => Promise<GetVariable200>;
+declare const getDeleteVariableUrl: (variableName: string, params: DeleteVariableParams) => string;
+/**
+ * Removes the variable this owner entered under this name.
+
+A variable is deletable only by the owner that entered it. Deleting a name
+another owner of the same project holds answers `var.not_found` and leaves
+that owner's value standing.
+
+ * @summary Delete a variable
+ */
+declare const deleteVariable: (variableName: string, params: DeleteVariableParams, options?: RequestInit) => Promise<void>; //#endregion
 //#endregion
 //#region ../api/dist/runtime/api-factory.d.mts
 //#region src/runtime/api-factory.d.ts
@@ -741,63 +963,40 @@ declare const builtinLocales: Readonly<Record<string, Locale>>;
 //#endregion
 //#region src/orchestrator/branding.d.ts
 type FlowLayout = CreateFlow201BrandingLayout;
-type BrandingPalette = {
-  primary?: string;
-  on_primary?: string;
-  background?: string;
-  surface?: string;
-  muted?: string;
-  border?: string;
-  text?: string;
-  text_muted?: string;
-  link?: string;
-  success?: string;
-  warning?: string;
-  error?: string;
-};
-type BrandingTypography = {
-  font_family?: string;
-  /**
-   * Display face for card titles and labels. Optional: without it a tenant's
-   * `font_family` sets the headings too, which is the single-font look most
-   * brands want. Naming it is how a brand keeps a separate display face.
-   */
-  font_family_heading?: string;
-  font_family_mono?: string;
-  scale?: number;
-};
-type BrandingShape = {
-  radius?: "none" | "sm" | "md" | "lg" | "full";
-  density?: "compact" | "regular" | "comfortable";
-};
-type BrandingTheme = {
-  mode?: "light" | "dark" | "auto";
-  dark?: {
-    palette?: BrandingPalette;
-  };
-};
-type BrandingAssets = {
-  logo_dark?: string;
-  favicon?: string;
-  background_image?: string;
-};
+type BrandingPalette = CreateFlow201BrandingThemeLightPalette;
 /**
- * Wire shape (`CreateFlow201Branding`) plus the v2 client-only extension.
- * Structurally a superset, so any `CreateFlow201Branding` payload from the
- * wire is assignable to `Branding` without a cast.
+ * One complete surface. Light and dark carry the same fields and neither
+ * inherits from the other, so the two sides share one type.
+ */
+type BrandingThemeSide = CreateFlow201BrandingThemeLight;
+type BrandingTheme = CreateFlow201BrandingTheme;
+type BrandingTypography = CreateFlow201BrandingTypography;
+type BrandingShape = CreateFlow201BrandingShape;
+/** The published sides a revision offers, in the order the surface prefers them. */
+type PublishedSides = readonly ResolvableSide[];
+type ResolvableSide = "light" | "dark";
+/**
+ * Which sides the revision actually publishes. A side is published when the
+ * revision names it at all — an empty side object still says "this surface is
+ * mine", it just takes the maintained defaults for every key.
+ */
+declare function publishedSides(branding: Branding | undefined): PublishedSides;
+/**
+ * The mark for the resolved surface. A logo is pixels and is never recoloured,
+ * so a side without its own file shows no mark rather than borrowing the other
+ * side's. The legacy top-level `logo_url` is a single-mark fallback and applies
+ * only when neither side names one.
+ */
+declare function resolveLogoUrl(branding: Branding | undefined, theme: ResolvableSide): string | undefined;
+/**
+ * Wire shape plus the embedding-owned attribution block.
  *
  * `attribution.show_zitadel` controls the "Secured with Zitadel" pill in
  * the orchestrator footer. Tenants set it to `false` only when they have a
  * licence that permits removing attribution (community / OSS deployments
- * always show it). The flag intentionally lives on `Branding` so it can
- * be overridden per-flow alongside the rest of the visual surface.
+ * always show it).
  */
 type Branding = CreateFlow201Branding & {
-  palette?: BrandingPalette;
-  typography?: BrandingTypography;
-  shape?: BrandingShape;
-  assets?: BrandingAssets;
-  theme?: BrandingTheme;
   attribution?: BrandingAttribution;
 };
 type BrandingAttribution = {
@@ -829,7 +1028,10 @@ declare class ThemeController implements ReactiveController {
    * element nor the branding payload names a mode. Precedence, strongest
    * first: element `theme` property → `branding.theme.mode` → fallback. The
    * element wins because the page embedding the widget knows its own surface
-   * better than the tenant's stored branding does.
+   * better than the tenant's stored branding does — but it selects among the
+   * sides the revision published, and cannot reach one it did not. A revision
+   * with a single published side therefore ignores this property: an embedder
+   * pinning `theme="light"` against a dark-only revision gets dark.
    */
   setModePreference(explicit: ThemeMode | undefined, fallback: ThemeMode): void;
   hostConnected(): void;
@@ -1001,9 +1203,18 @@ declare class ZitadelLogin extends ZitadelSurface {
   private accessor response;
   private accessor branding;
   private accessor loading;
+  /** Terminal step that navigates away, so its screen is never painted. */
+  private accessor completing;
   private accessor startupError;
   private accessor formValues;
   private engine;
+  /**
+   * The theme the last commit rendered with. The template output carries the
+   * resolved side's mark, so a theme change rewrites the string and
+   * `unsafeHTML` rebuilds the form — which drops what the visitor had typed
+   * unless it is put back.
+   */
+  private lastRenderedTheme;
   private readonly sanitise;
   /**
    * Cached compiled tenant template, keyed by source string. Re-rendering on
@@ -1068,6 +1279,12 @@ declare class ZitadelLogin extends ZitadelSurface {
    * swaps are user-initiated, so focus moves in both modes.
    */
   private hydrateStepAfterRender;
+  /**
+   * Put captured values back once the rebuilt subtree has rendered. Awaits the
+   * child atoms' own first render before touching them, rather than guessing a
+   * frame with `requestAnimationFrame`.
+   */
+  private restoreValuesAfterRender;
   render(): _$lit.TemplateResult<1>;
   /**
    * Inject the attribution badge into the rendered template's
@@ -1082,6 +1299,13 @@ declare class ZitadelLogin extends ZitadelSurface {
    * any tenant-supplied values (`custom_link`) are escaped via `escapeHtml`.
    */
   private injectAttribution;
+  /**
+   * The branding a template renders against, with `logo_url` already resolved
+   * to the mark for the active side. Templates read one logo field and get the
+   * right file per surface; the per-side URLs stay on `theme` for a template
+   * that wants to reach them itself.
+   */
+  private brandingForTemplate;
   /**
    * "Secured with Zitadel" attribution chrome injected into every
    * template's page-shell footer slot. Controlled by
@@ -1378,7 +1602,7 @@ declare global {
 /**
  * `<zitadel-session>` — the "signed in" card.
  *
- * Renders the post-sign-in confirmation surface (Figma `7355:8959`): a
+ * Renders the post-sign-in confirmation surface: a
  * centred auth card reading "Signed in as {identity}" with a **Sign out**
  * action. Composed from the same `<zl-page-shell>` / `<zl-card>` /
  * `<zl-button>` atoms as the `<zitadel-login>` orchestrator, so it inherits
@@ -1470,15 +1694,20 @@ declare global {
 } //# sourceMappingURL=zitadel-session.d.ts.map
 //#endregion
 //#region src/orchestrator/branding-to-tokens.d.ts
-type BrandingToTokensOptions = {
-  resolvedTheme?: ResolvedTheme;
-};
 /**
  * Build a CSS string of `:host { --zl-* }` declarations from a Branding
- * payload. Light values land on `:host`; dark overrides land on
- * `:host([data-theme="dark"])`.
+ * payload. Shape and typography are shared across the sides and land on the
+ * shared selector; each side's palette lands only under its own `data-theme`
+ * selector, and nowhere else.
+ *
+ * No copy of the resolved side goes on the shared selector. That copy would
+ * reach `[data-theme="light"]` as well, so a key set on the dark side and not
+ * the light one would paint on both, with nothing in the light block to
+ * override it. Callers stamp `data-theme` on the host — `applySurfaceTheme`
+ * does it in the same update that adopts this sheet — so the per-side block is
+ * already matching by the time anything paints.
  */
-declare function buildBrandingStylesheet(branding: Branding | undefined, options?: BrandingToTokensOptions): string;
+declare function buildBrandingStylesheet(branding: Branding | undefined): string;
 /**
  * Apply a branding payload as a `--zl-*` overrides layer on top of the base
  * token sheet. Subsequent calls replace the previous override sheet so a new
@@ -1487,7 +1716,7 @@ declare function buildBrandingStylesheet(branding: Branding | undefined, options
  * Callers should run `applyBaseTokens(shadowRoot)` first (once per shadow
  * root) so the base values exist before branding patches them.
  */
-declare function applyBrandingTokens(shadowRoot: ShadowRoot, branding: Branding | undefined, resolvedTheme: ResolvedTheme): void;
+declare function applyBrandingTokens(shadowRoot: ShadowRoot, branding: Branding | undefined): void;
 /**
  * Standalone branding→theme resolution for callers outside the orchestrator
  * (SSR, tests, embedders composing atoms by hand). `<zitadel-login>` itself
@@ -1495,13 +1724,13 @@ declare function applyBrandingTokens(shadowRoot: ShadowRoot, branding: Branding
  * and a variant-derived fallback on top of the same branding input.
  *
  * Defaults to dark: the design system's primary surface, and the mode a
- * hosted login page renders when a tenant states no preference.
+ * hosted login page renders when a revision states no preference.
  */
 declare function resolveTheme(branding: Branding | undefined): ResolvedTheme;
 //#endregion
 //#region src/orchestrator/font-loader.d.ts
 /**
- * Inject the tenant's `branding.font_url` stylesheet. Pass `null`/`undefined`
+ * Inject the tenant's `branding.typography.font_url` stylesheet. Pass `null`/`undefined`
  * to withdraw this surface's registration (e.g. when a flow resolves with no
  * tenant font); the link disappears once no surface registers a URL.
  */
@@ -1595,5 +1824,5 @@ type LiquidContext = {
   loading: boolean;
 };
 //#endregion
-export { BrandingPalette as A, en as B, ZitadelLogin as C, Branding as D, ThemeMode as E, builtinLocales as F, businessLocales as I, it as L, BrandingTheme as M, BrandingTypography as N, BrandingAssets as O, FlowLayout as P, de as R, ZitadelLogout as S, ThemeController as T, applyFontUrl as _, LiquidContext as a, resolveTheme as b, validateBranding as c, submitStep as d, createSanitiser as f, TEMPLATE_NAMES as g, patchMandatoryGates as h, FlowMessage as i, BrandingShape as j, BrandingAttribution as k, getCurrentStep as l, mandatoryGatesMarkerComment as m, FlowError as n, BrandingValidationContext as o, MANDATORY_GATES_MARKER as p, FlowIdentity as r, BrandingValidationResult as s, layoutChromeCss as t, startFlow as u, applyBrandingTokens as v, ResolvedTheme as w, ZitadelSession as x, buildBrandingStylesheet as y, Locale as z };
-//# sourceMappingURL=index-DFdR16-D.d.mts.map
+export { BrandingShape as A, businessLocales as B, ZitadelLogin as C, Branding as D, ThemeMode as E, PublishedSides as F, de as H, ResolvableSide as I, publishedSides as L, BrandingThemeSide as M, BrandingTypography as N, BrandingAttribution as O, FlowLayout as P, resolveLogoUrl as R, ZitadelLogout as S, ThemeController as T, Locale as U, it as V, en as W, applyFontUrl as _, LiquidContext as a, resolveTheme as b, validateBranding as c, submitStep as d, createSanitiser as f, TEMPLATE_NAMES as g, patchMandatoryGates as h, FlowMessage as i, BrandingTheme as j, BrandingPalette as k, getCurrentStep as l, mandatoryGatesMarkerComment as m, FlowError as n, BrandingValidationContext as o, MANDATORY_GATES_MARKER as p, FlowIdentity as r, BrandingValidationResult as s, layoutChromeCss as t, startFlow as u, applyBrandingTokens as v, ResolvedTheme as w, ZitadelSession as x, buildBrandingStylesheet as y, builtinLocales as z };
+//# sourceMappingURL=index-1PzVwdYA.d.mts.map