@zitadel/testing 0.0.0 → 0.1.0-alpha.18

package/dist/{src-BIL0PdSd.cjs → src-DirKLqi4.cjs}

@@ -1,4 +1,4 @@
-const require_handshake = require("./handshake-CggSIoxF.cjs");
+const require_handshake = require("./handshake-CRKcgkfN.cjs");
 require("node:fs");
 require("node:url");
 let node_fs_promises = require("node:fs/promises");
@@ -129,9 +129,7 @@ function safeJsonParse(text) {
 * OpenAPI spec version: 0.0.1
 */
 var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
-	activateFlowDefinition: () => activateFlowDefinition,
-	authorizeDevice: () => authorizeDevice,
-	authorizeGet: () => authorizeGet,
+	completeClaim: () => completeClaim,
 	createAuthAttempt: () => createAuthAttempt,
 	createBranding: () => createBranding,
 	createFlow: () => createFlow,
@@ -142,16 +140,14 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	createSession: () => createSession,
 	createTeam: () => createTeam,
 	createUser: () => createUser,
-	deactivateFlowDefinition: () => deactivateFlowDefinition,
 	deleteFlowDefinition: () => deleteFlowDefinition,
+	deleteTeam: () => deleteTeam,
 	deleteUserByID: () => deleteUserByID,
-	endSession: () => endSession,
 	exchangeHandoff: () => exchangeHandoff,
-	getActivateFlowDefinitionUrl: () => getActivateFlowDefinitionUrl,
 	getAuthAttempt: () => getAuthAttempt,
-	getAuthorizeDeviceUrl: () => getAuthorizeDeviceUrl,
-	getAuthorizeGetUrl: () => getAuthorizeGetUrl,
 	getBrandingById: () => getBrandingById,
+	getClaimStatus: () => getClaimStatus,
+	getCompleteClaimUrl: () => getCompleteClaimUrl,
 	getCreateAuthAttemptUrl: () => getCreateAuthAttemptUrl,
 	getCreateBrandingUrl: () => getCreateBrandingUrl,
 	getCreateFlowDefinitionUrl: () => getCreateFlowDefinitionUrl,
@@ -162,236 +158,76 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	getCreateSessionUrl: () => getCreateSessionUrl,
 	getCreateTeamUrl: () => getCreateTeamUrl,
 	getCreateUserUrl: () => getCreateUserUrl,
-	getDeactivateFlowDefinitionUrl: () => getDeactivateFlowDefinitionUrl,
 	getDeleteFlowDefinitionUrl: () => getDeleteFlowDefinitionUrl,
+	getDeleteTeamUrl: () => getDeleteTeamUrl,
 	getDeleteUserByIDUrl: () => getDeleteUserByIDUrl,
-	getEndSessionUrl: () => getEndSessionUrl,
 	getExchangeHandoffUrl: () => getExchangeHandoffUrl,
 	getFlowDefinition: () => getFlowDefinition,
 	getFlowStep: () => getFlowStep,
 	getGetAuthAttemptUrl: () => getGetAuthAttemptUrl,
 	getGetBrandingByIdUrl: () => getGetBrandingByIdUrl,
+	getGetClaimStatusUrl: () => getGetClaimStatusUrl,
 	getGetFlowDefinitionUrl: () => getGetFlowDefinitionUrl,
 	getGetFlowStepUrl: () => getGetFlowStepUrl,
 	getGetHealthUrl: () => getGetHealthUrl,
-	getGetKeysUrl: () => getGetKeysUrl,
 	getGetLiveUrl: () => getGetLiveUrl,
 	getGetMySessionUrl: () => getGetMySessionUrl,
 	getGetMyUserUrl: () => getGetMyUserUrl,
-	getGetOpenIDConfigurationUrl: () => getGetOpenIDConfigurationUrl,
 	getGetProjectUrl: () => getGetProjectUrl,
 	getGetReadyUrl: () => getGetReadyUrl,
 	getGetSchemaByIdUrl: () => getGetSchemaByIdUrl,
 	getGetSessionUrl: () => getGetSessionUrl,
 	getGetTeamUrl: () => getGetTeamUrl,
-	getGetTokenUrl: () => getGetTokenUrl,
 	getGetUserByIDUrl: () => getGetUserByIDUrl,
-	getGetUserInfoUrl: () => getGetUserInfoUrl,
 	getHealth: () => getHealth,
-	getIntrospectUrl: () => getIntrospectUrl,
+	getInitClaimUrl: () => getInitClaimUrl,
 	getIssueChallengeUrl: () => getIssueChallengeUrl,
-	getKeys: () => getKeys,
 	getListBrandingUrl: () => getListBrandingUrl,
 	getListFlowDefinitionsUrl: () => getListFlowDefinitionsUrl,
 	getListSchemasUrl: () => getListSchemasUrl,
-	getListSessionsUrl: () => getListSessionsUrl,
 	getListUserPasskeysUrl: () => getListUserPasskeysUrl,
+	getListUserTeamsUrl: () => getListUserTeamsUrl,
 	getListUsersUrl: () => getListUsersUrl,
 	getLive: () => getLive,
 	getMySession: () => getMySession,
 	getMyUser: () => getMyUser,
-	getOpenIDConfiguration: () => getOpenIDConfiguration,
 	getPatchProjectUrl: () => getPatchProjectUrl,
 	getProject: () => getProject,
 	getQueryProjectsUrl: () => getQueryProjectsUrl,
+	getQuerySessionsUrl: () => getQuerySessionsUrl,
+	getQueryTeamsUrl: () => getQueryTeamsUrl,
 	getReady: () => getReady,
 	getRevokeMySessionUrl: () => getRevokeMySessionUrl,
 	getRevokeSessionUrl: () => getRevokeSessionUrl,
-	getRevokeTokenUrl: () => getRevokeTokenUrl,
 	getSchemaById: () => getSchemaById,
 	getSession: () => getSession,
 	getSetUserPasswordUrl: () => getSetUserPasswordUrl,
-	getSubmitFlowEventUrl: () => getSubmitFlowEventUrl,
 	getSubmitFlowStepUrl: () => getSubmitFlowStepUrl,
 	getTeam: () => getTeam,
-	getToken: () => getToken,
 	getUpdateFlowDefinitionUrl: () => getUpdateFlowDefinitionUrl,
+	getUpdateTeamUrl: () => getUpdateTeamUrl,
 	getUserByID: () => getUserByID,
-	getUserInfo: () => getUserInfo,
 	getVerifyChallengeProofUrl: () => getVerifyChallengeProofUrl,
-	introspect: () => introspect,
+	initClaim: () => initClaim,
 	issueChallenge: () => issueChallenge,
 	listBranding: () => listBranding,
 	listFlowDefinitions: () => listFlowDefinitions,
 	listSchemas: () => listSchemas,
-	listSessions: () => listSessions,
 	listUserPasskeys: () => listUserPasskeys,
+	listUserTeams: () => listUserTeams,
 	listUsers: () => listUsers,
 	patchProject: () => patchProject,
 	queryProjects: () => queryProjects,
+	querySessions: () => querySessions,
+	queryTeams: () => queryTeams,
 	revokeMySession: () => revokeMySession,
 	revokeSession: () => revokeSession,
-	revokeToken: () => revokeToken,
 	setUserPassword: () => setUserPassword,
-	submitFlowEvent: () => submitFlowEvent,
 	submitFlowStep: () => submitFlowStep,
 	updateFlowDefinition: () => updateFlowDefinition,
+	updateTeam: () => updateTeam,
 	verifyChallengeProof: () => verifyChallengeProof
 });
-const getGetOpenIDConfigurationUrl = () => {
-	return `${getProxyPath()}/.well-known/openid-configuration`;
-};
-/**
-* Retrieve the OpenID Connect configuration
-* @summary Get OpenID Connect configuration
-*/
-const getOpenIDConfiguration = async (options) => {
-	return customFetch(getGetOpenIDConfigurationUrl(), {
-		...options,
-		method: "GET"
-	});
-};
-const getAuthorizeGetUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/auth/authorize?${stringifiedParams}` : `${getProxyPath()}/auth/authorize`;
-};
-/**
-* @summary Authorize a user
-*/
-const authorizeGet = async (params, options) => {
-	return customFetch(getAuthorizeGetUrl(params), {
-		...options,
-		method: "GET"
-	});
-};
-const getAuthorizeDeviceUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/auth/device-authorization?${stringifiedParams}` : `${getProxyPath()}/auth/device-authorization`;
-};
-/**
-* @summary Authorize a device
-*/
-const authorizeDevice = async (params, options) => {
-	return customFetch(getAuthorizeDeviceUrl(params), {
-		...options,
-		method: "GET"
-	});
-};
-const getEndSessionUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/auth/end-session?${stringifiedParams}` : `${getProxyPath()}/auth/end-session`;
-};
-/**
-* @summary End a session
-*/
-const endSession = async (params, options) => {
-	return customFetch(getEndSessionUrl(params), {
-		...options,
-		method: "GET"
-	});
-};
-const getIntrospectUrl = () => {
-	return `${getProxyPath()}/auth/introspect`;
-};
-/**
-* @summary Introspect a token
-*/
-const introspect = async (introspectBody, options) => {
-	const formUrlEncoded = new URLSearchParams();
-	formUrlEncoded.append(`token`, introspectBody.token);
-	if (introspectBody.token_type_hint !== void 0) formUrlEncoded.append(`token_type_hint`, introspectBody.token_type_hint);
-	return customFetch(getIntrospectUrl(), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-			...options?.headers
-		},
-		body: formUrlEncoded
-	});
-};
-const getGetKeysUrl = () => {
-	return `${getProxyPath()}/auth/keys`;
-};
-/**
-* @summary Get public keys
-*/
-const getKeys = async (options) => {
-	return customFetch(getGetKeysUrl(), {
-		...options,
-		method: "GET"
-	});
-};
-const getRevokeTokenUrl = () => {
-	return `${getProxyPath()}/auth/revoke`;
-};
-/**
-* @summary Revoke an access token or refresh token
-*/
-const revokeToken = async (revokeTokenBody, options) => {
-	const formUrlEncoded = new URLSearchParams();
-	if (revokeTokenBody.token !== void 0) formUrlEncoded.append(`token`, revokeTokenBody.token);
-	if (revokeTokenBody.token_type_hint !== void 0) formUrlEncoded.append(`token_type_hint`, revokeTokenBody.token_type_hint);
-	return customFetch(getRevokeTokenUrl(), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-			...options?.headers
-		},
-		body: formUrlEncoded
-	});
-};
-const getGetTokenUrl = () => {
-	return `${getProxyPath()}/auth/token`;
-};
-/**
-* @summary Get access token
-*/
-const getToken = async (getTokenBody, options) => {
-	const formUrlEncoded = new URLSearchParams();
-	if (getTokenBody.code !== void 0) formUrlEncoded.append(`code`, getTokenBody.code);
-	if (getTokenBody.client_assertion !== void 0) formUrlEncoded.append(`client_assertion`, getTokenBody.client_assertion);
-	if (getTokenBody.client_assertion_type !== void 0) formUrlEncoded.append(`client_assertion_type`, getTokenBody.client_assertion_type);
-	if (getTokenBody.client_id !== void 0) formUrlEncoded.append(`client_id`, getTokenBody.client_id);
-	if (getTokenBody.client_secret !== void 0) formUrlEncoded.append(`client_secret`, getTokenBody.client_secret);
-	if (getTokenBody.code_verifier !== void 0) formUrlEncoded.append(`code_verifier`, getTokenBody.code_verifier);
-	if (getTokenBody.grant_type !== void 0) formUrlEncoded.append(`grant_type`, getTokenBody.grant_type);
-	if (getTokenBody.redirect_uri !== void 0) formUrlEncoded.append(`redirect_uri`, getTokenBody.redirect_uri);
-	return customFetch(getGetTokenUrl(), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-			...options?.headers
-		},
-		body: formUrlEncoded
-	});
-};
-const getGetUserInfoUrl = () => {
-	return `${getProxyPath()}/auth/userinfo`;
-};
-/**
-* @summary Get user info
-*/
-const getUserInfo = async (options) => {
-	return customFetch(getGetUserInfoUrl(), {
-		...options,
-		method: "GET"
-	});
-};
 const getGetHealthUrl = () => {
 	return `${getProxyPath()}/healthz`;
 };
@@ -543,6 +379,31 @@ const setUserPassword = async (userId, setUserPasswordBody, params, options) =>
 		body: JSON.stringify(setUserPasswordBody)
 	});
 };
+const getListUserTeamsUrl = (userId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/teams?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/teams`;
+};
+/**
+* The user's team roster, ordered by team name. Each entry carries the
+team's name, so a client renders a page without resolving ids one by one.
+
+This is the N:N roster and it is not lifecycle ownership: the single team
+that owns the user's lifecycle is reported as `metadata.lifecycle_owner_team_id`
+on the user read endpoints. Memberships the user was removed from are not
+returned.
+
+* @summary List the teams a user belongs to
+*/
+const listUserTeams = async (userId, params, options) => {
+	return customFetch(getListUserTeamsUrl(userId, params), {
+		...options,
+		method: "GET"
+	});
+};
 const getGetMyUserUrl = () => {
 	return `${getProxyPath()}/users/me`;
 };
@@ -564,7 +425,7 @@ the first capability step. Creates a new session implicitly unless
 `session_id` is provided (for step-up / reauth on an existing session).
 
 The response contains an `id` field — the flow handle. Use it as the path
-parameter for all subsequent `/flow/{id}/submit` and `/flow/{id}/event` calls.
+parameter for all subsequent `/flow/{id}/submit` calls.
 
 The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
 the flow's orchestration state (current step, collected data, history).
@@ -644,26 +505,6 @@ const submitFlowStep = async (id, submitFlowStepBody, options) => {
 		body: JSON.stringify(submitFlowStepBody)
 	});
 };
-const getSubmitFlowEventUrl = (id) => {
-	return `${getProxyPath()}/flow/${id}/event`;
-};
-/**
-* Submits telemetry or fingerprint data from the frontend.
-Does not advance the state machine. Used for risk evaluation.
-
-* @summary Submit client-side event
-*/
-const submitFlowEvent = async (id, submitFlowEventBody, options) => {
-	return customFetch(getSubmitFlowEventUrl(id), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(submitFlowEventBody)
-	});
-};
 const getCreateAuthAttemptUrl = () => {
 	return `${getProxyPath()}/auth_attempts`;
 };
@@ -851,6 +692,68 @@ const patchProject = async (projectId, patchProjectBody, options) => {
 		body: JSON.stringify(patchProjectBody)
 	});
 };
+const getInitClaimUrl = (projectId) => {
+	return `${getProxyPath()}/projects/${projectId}/claim/init`;
+};
+/**
+* Starts a claim challenge for an unclaimed project. Authenticated by the
+project secret, this mints a single-use, short-lived challenge and returns
+the `claim_url` the developer opens in a browser to complete the claim,
+together with the `challenge_id` the CLI polls with. The exact expiry is
+carried by `expires_at` on the response.
+
+* @summary Initialize a project claim
+*/
+const initClaim = async (projectId, options) => {
+	return customFetch(getInitClaimUrl(projectId), {
+		...options,
+		method: "POST"
+	});
+};
+const getGetClaimStatusUrl = (projectId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/projects/${projectId}/claim/status?${stringifiedParams}` : `${getProxyPath()}/projects/${projectId}/claim/status`;
+};
+/**
+* Polled by the CLI while a browser completes the claim. Authorized by the
+project secret that initiated the challenge. Returns `pending`, or
+`completed` with the owning team, the claim timestamp, and the dashboard
+URL once the browser leg has finished.
+
+* @summary Get claim status
+*/
+const getClaimStatus = async (projectId, params, options) => {
+	return customFetch(getGetClaimStatusUrl(projectId, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getCompleteClaimUrl = (projectId) => {
+	return `${getProxyPath()}/projects/${projectId}/claim/complete`;
+};
+/**
+* Called by the browser after the developer authenticates on the claim page.
+Authenticated by the `__nextgen_session` cookie, it attaches the project to
+the developer's personal team using the `challenge_id` from the claim URL as
+its single-use, browser-safe authorization.
+
+* @summary Complete a project claim
+*/
+const completeClaim = async (projectId, completeClaimBody, options) => {
+	return customFetch(getCompleteClaimUrl(projectId), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(completeClaimBody)
+	});
+};
 const getCreateSessionUrl = () => {
 	return `${getProxyPath()}/sessions`;
 };
@@ -863,8 +766,16 @@ Use this explicitly when you want to:
 can be correlated with the eventual authenticated session from the start.
 - Track anonymous state (bot detection, device fingerprint) that survives until authentication.
 
-The returned `session_token` authorises GET and DELETE on this session.
-It is superseded when a handoff exchange completes — clients must replace it at that point.
+Creating a session is an app-plane operation on the project credential
+(`session.write`). The returned `session_token` is a session credential for the
+end-user client, not a management scope: it is delivered as the
+`__nextgen_session` cookie and authorises the self-service operations
+`GET /sessions/me` and `DELETE /sessions/me` (`nextgenSession` scheme). The
+by-id operations `GET /sessions/{session_id}` and `DELETE /sessions/{session_id}`
+are operator endpoints and require `session.read` / `session.delete` instead.
+
+The `session_token` is superseded when a handoff exchange completes — clients must
+replace it at that point.
 
 Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
 full session TTL when the first authentication factor is written via a completing `auth_attempt`.
@@ -882,24 +793,30 @@ const createSession = async (createSessionBody, options) => {
 		body: JSON.stringify(createSessionBody)
 	});
 };
-const getListSessionsUrl = (params) => {
+const getQuerySessionsUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions?${stringifiedParams}` : `${getProxyPath()}/sessions`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/query?${stringifiedParams}` : `${getProxyPath()}/sessions/query`;
 };
 /**
-* Returns a paginated list of sessions for a project.
-Requires a project service key (OAuth2 client credentials).
+* Returns the sessions of a project, paginated with a cursor.
+Sessions of every lifecycle state are returned; each carries its `state`.
+Requires `session.read` permission.
 
-* @summary List sessions
+* @summary Query sessions
 */
-const listSessions = async (params, options) => {
-	return customFetch(getListSessionsUrl(params), {
+const querySessions = async (querySessionsBody, params, options) => {
+	return customFetch(getQuerySessionsUrl(params), {
 		...options,
-		method: "GET"
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(querySessionsBody)
 	});
 };
 const getExchangeHandoffUrl = (params) => {
@@ -975,13 +892,15 @@ const getRevokeSessionUrl = (sessionId, params) => {
 	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}` : `${getProxyPath()}/sessions/${sessionId}`;
 };
 /**
-* Revokes the session immediately (`state: revoked`).
+* Permanently deletes the session, terminating it immediately.
 
 This is the operator revoke path and requires the `session.delete` scope on a
 project-bound credential. End-user logout with the `__nextgen_session` cookie is
 `DELETE /sessions/me` (`nextgenSession` scheme).
 
-After revocation, any tokens derived from this session are invalidated.
+Idempotent: deleting a session that does not exist (or was already deleted)
+still returns 204. After deletion, any tokens derived from the session are
+invalidated.
 
 * @summary Revoke session
 */
@@ -1014,10 +933,12 @@ const getRevokeMySessionUrl = () => {
 	return `${getProxyPath()}/sessions/me`;
 };
 /**
-* Revokes the session immediately (`state: revoked`). This is the logout operation.
+* Logs out by permanently deleting the session.
 
-The __nextgen_session cookie issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated including the cookie itself, which is cleared in the response.
+The `__nextgen_session` cookie issued at creation (or superseded by a handoff
+exchange) is required. Idempotent: if the session is already gone this still
+returns 204. Any tokens derived from the session are invalidated, and the
+cookie itself is cleared in the response.
 
 * @summary Revoke my session
 */
@@ -1036,10 +957,12 @@ const getCreateSchemaUrl = (params) => {
 	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas?${stringifiedParams}` : `${getProxyPath()}/schemas`;
 };
 /**
-* Create a new schema. The schema definition must include a unique $id field,
-which will be used to identify the schema in future requests. The $id must
-be a valid URI and should ideally point to the location where the schema
-can be accessed.
+* Create a new schema. The optional `$id` field is the JSON Schema document
+URI used to identify the schema in future requests (GitOps-stable identity,
+not a free-form resource primary key). When `$id` is omitted, the server
+generates a `sch_*` URL. When provided, `$id` must be unique within the
+project and should ideally be a valid URI pointing at where the schema can
+be accessed.
 
 The schema can either be a concrete schema, e.g. a user schema, or a
 schema-url which will be resolved by the server.
@@ -1202,70 +1125,99 @@ const deleteFlowDefinition = async (id, params, options) => {
 		method: "DELETE"
 	});
 };
-const getActivateFlowDefinitionUrl = (id, params) => {
+const getCreateTeamUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}/activate?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}/activate`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams?${stringifiedParams}` : `${getProxyPath()}/teams`;
 };
 /**
-* Activate a flow definition by transitioning it from a `draft` state to an `active` state.
-Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
+* @summary Create team
+*/
+const createTeam = async (createTeamBody, params, options) => {
+	return customFetch(getCreateTeamUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createTeamBody)
+	});
+};
+const getQueryTeamsUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/query?${stringifiedParams}` : `${getProxyPath()}/teams/query`;
+};
+/**
+* Returns the teams of a project, paginated with a cursor.
+Teams of every lifecycle status are returned; each carries its `status`.
 
-* @summary Activate a flow definition by ID.
+* @summary Query teams
 */
-const activateFlowDefinition = async (id, params, options) => {
-	return customFetch(getActivateFlowDefinitionUrl(id, params), {
+const queryTeams = async (queryTeamsBody, params, options) => {
+	return customFetch(getQueryTeamsUrl(params), {
 		...options,
-		method: "POST"
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(queryTeamsBody)
 	});
 };
-const getDeactivateFlowDefinitionUrl = (id, params) => {
+const getGetTeamUrl = (teamId, params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}/deactivate?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}/deactivate`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}` : `${getProxyPath()}/teams/${teamId}`;
 };
 /**
-* Deactivates a flow definition in the `active` state by transitioning it to the `draft` state.
-Flow definitions in `draft` state cannot be used to start new flows. Existing flows that use the deactivated flow definition must gracefully handle this.
-Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
+* Returns a Team by its id.
 
-* @summary Deactivate a flow definition by ID.
+* @summary Get team
 */
-const deactivateFlowDefinition = async (id, params, options) => {
-	return customFetch(getDeactivateFlowDefinitionUrl(id, params), {
+const getTeam = async (teamId, params, options) => {
+	return customFetch(getGetTeamUrl(teamId, params), {
 		...options,
-		method: "POST"
+		method: "GET"
 	});
 };
-const getCreateTeamUrl = (params) => {
+const getDeleteTeamUrl = (teamId, params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams?${stringifiedParams}` : `${getProxyPath()}/teams`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}` : `${getProxyPath()}/teams/${teamId}`;
 };
 /**
-* @summary Create team
+* Deactivates the team.
+
+The team is tombstoned rather than erased: it stays readable through
+getTeam with status `deactivated`. Its memberships are removed and the
+users whose lifecycle it owns are deactivated with it.
+
+The request is idempotent. Deleting a team that is already deactivated
+or doesn't exist succeeds without changing anything.
+
+* @summary Delete team
 */
-const createTeam = async (createTeamBody, params, options) => {
-	return customFetch(getCreateTeamUrl(params), {
+const deleteTeam = async (teamId, params, options) => {
+	return customFetch(getDeleteTeamUrl(teamId, params), {
 		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(createTeamBody)
+		method: "DELETE"
 	});
 };
-const getGetTeamUrl = (teamId, params) => {
+const getUpdateTeamUrl = (teamId, params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
@@ -1274,14 +1226,19 @@ const getGetTeamUrl = (teamId, params) => {
 	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}` : `${getProxyPath()}/teams/${teamId}`;
 };
 /**
-* Returns the current state of a team.
+* Update team. Only active teams can be updated.
 
-* @summary Get team
+* @summary Update team
 */
-const getTeam = async (teamId, params, options) => {
-	return customFetch(getGetTeamUrl(teamId, params), {
+const updateTeam = async (teamId, updateTeamBody, params, options) => {
+	return customFetch(getUpdateTeamUrl(teamId, params), {
 		...options,
-		method: "GET"
+		method: "PATCH",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(updateTeamBody)
 	});
 };
 const getCreateBrandingUrl = (params) => {
@@ -1383,7 +1340,7 @@ const getBrandingById = async (id, params, options) => {
 * generated orval function:
 *
 *     const client = createZitadelClient({ baseUrl, token });
-*     await client.createProject({ previewOrigins: [] });
+*     await client.createProject({ preview_origins: [] });
 *     await client.createSchema(body, { project_id });
 */
 function createZitadelClient(opts) {
@@ -1832,12 +1789,12 @@ async function bootstrapProject(options) {
 	const { baseUrl } = options;
 	const project = await createZitadelClient({ baseUrl }).createProject({
 		name: options.projectName ?? DEFAULT_PROJECT_NAME,
-		previewOrigins: options.appOrigins ?? [],
-		seedDefaults: false
+		preview_origins: options.appOrigins ?? [],
+		seed_defaults: false
 	});
 	const projectId = requireString(project.id, "project id");
-	const projectSecret = requireString(project.projectSecret, "project secret");
-	const previewSecret = typeof project.previewSecret === "string" ? project.previewSecret : void 0;
+	const projectSecret = requireString(project.project_secret, "project secret");
+	const previewSecret = typeof project.preview_secret === "string" ? project.preview_secret : void 0;
 	const client = createZitadelClient({
 		baseUrl,
 		token: projectSecret
@@ -1988,9 +1945,8 @@ function getFreePort() {
 /**
 * Boot an ephemeral local server by shelling out to `zitadel start` and parse
 * its JSON envelope. The CLI owns the subtle parts (port preflight, health
-* wait, process-group stop, embedded-Postgres reaping), so this module stays a
-* thin adapter; swapping it for direct library calls later must not change the
-* shape returned here.
+* wait, process-group stop), so this module stays a thin adapter; swapping it
+* for direct library calls later must not change the shape returned here.
 */
 async function bootLocalServer(options = {}) {
 	const ownsDir = options.dir === void 0;
@@ -2096,7 +2052,7 @@ function identity() {
 /**
 * Create a user that can immediately complete the password login flow:
 * `POST /users` (the body must carry `$schema: <schema id>`) followed by
-* `PUT /users/{id}/password` with `isChangeRequired: false`.
+* `PUT /users/{id}/password` with `is_change_required: false`.
 *
 * Defaults mint a unique email per call (email is x-unique per project), which
 * is what makes per-test seeding parallel-safe on a shared instance.
@@ -2112,7 +2068,7 @@ async function seedUser(client, context, input = {}) {
 	}, { project_id: context.projectId })).id, "user id");
 	await client.setUserPassword(id, {
 		password,
-		isChangeRequired: false
+		is_change_required: false
 	}, { project_id: context.projectId });
 	return {
 		id,
@@ -2284,7 +2240,7 @@ function connectZitadel(handle) {
 	};
 }
 /**
-* Boot an ephemeral local instance (binary runtime + embedded Postgres, no
+* Boot an ephemeral local instance (binary runtime + SQLite by default, no
 * Docker) and bootstrap a project + default schema + login flow on it. The
 * result can seed loginable password users immediately.
 */
@@ -2353,4 +2309,4 @@ Object.defineProperty(exports, "startLocalZitadel", {
 	}
 });
 
-//# sourceMappingURL=src-BIL0PdSd.cjs.map
+//# sourceMappingURL=src-DirKLqi4.cjs.map