@zitadel/testing 0.0.0 → 0.1.0-alpha.19

package/dist/{src-BIL0PdSd.cjs → src-I0KAh1zU.cjs}

@@ -1,4 +1,4 @@
-const require_handshake = require("./handshake-CggSIoxF.cjs");
+const require_handshake = require("./handshake-CRKcgkfN.cjs");
 require("node:fs");
 require("node:url");
 let node_fs_promises = require("node:fs/promises");
@@ -129,9 +129,7 @@ function safeJsonParse(text) {
 * OpenAPI spec version: 0.0.1
 */
 var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
-	activateFlowDefinition: () => activateFlowDefinition,
-	authorizeDevice: () => authorizeDevice,
-	authorizeGet: () => authorizeGet,
+	completeClaim: () => completeClaim,
 	createAuthAttempt: () => createAuthAttempt,
 	createBranding: () => createBranding,
 	createFlow: () => createFlow,
@@ -142,16 +140,14 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	createSession: () => createSession,
 	createTeam: () => createTeam,
 	createUser: () => createUser,
-	deactivateFlowDefinition: () => deactivateFlowDefinition,
 	deleteFlowDefinition: () => deleteFlowDefinition,
+	deleteTeam: () => deleteTeam,
 	deleteUserByID: () => deleteUserByID,
-	endSession: () => endSession,
 	exchangeHandoff: () => exchangeHandoff,
-	getActivateFlowDefinitionUrl: () => getActivateFlowDefinitionUrl,
 	getAuthAttempt: () => getAuthAttempt,
-	getAuthorizeDeviceUrl: () => getAuthorizeDeviceUrl,
-	getAuthorizeGetUrl: () => getAuthorizeGetUrl,
 	getBrandingById: () => getBrandingById,
+	getClaimStatus: () => getClaimStatus,
+	getCompleteClaimUrl: () => getCompleteClaimUrl,
 	getCreateAuthAttemptUrl: () => getCreateAuthAttemptUrl,
 	getCreateBrandingUrl: () => getCreateBrandingUrl,
 	getCreateFlowDefinitionUrl: () => getCreateFlowDefinitionUrl,
@@ -162,236 +158,80 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	getCreateSessionUrl: () => getCreateSessionUrl,
 	getCreateTeamUrl: () => getCreateTeamUrl,
 	getCreateUserUrl: () => getCreateUserUrl,
-	getDeactivateFlowDefinitionUrl: () => getDeactivateFlowDefinitionUrl,
 	getDeleteFlowDefinitionUrl: () => getDeleteFlowDefinitionUrl,
+	getDeleteTeamUrl: () => getDeleteTeamUrl,
 	getDeleteUserByIDUrl: () => getDeleteUserByIDUrl,
-	getEndSessionUrl: () => getEndSessionUrl,
+	getEvent: () => getEvent,
 	getExchangeHandoffUrl: () => getExchangeHandoffUrl,
 	getFlowDefinition: () => getFlowDefinition,
 	getFlowStep: () => getFlowStep,
 	getGetAuthAttemptUrl: () => getGetAuthAttemptUrl,
 	getGetBrandingByIdUrl: () => getGetBrandingByIdUrl,
+	getGetClaimStatusUrl: () => getGetClaimStatusUrl,
+	getGetEventUrl: () => getGetEventUrl,
 	getGetFlowDefinitionUrl: () => getGetFlowDefinitionUrl,
 	getGetFlowStepUrl: () => getGetFlowStepUrl,
 	getGetHealthUrl: () => getGetHealthUrl,
-	getGetKeysUrl: () => getGetKeysUrl,
 	getGetLiveUrl: () => getGetLiveUrl,
 	getGetMySessionUrl: () => getGetMySessionUrl,
 	getGetMyUserUrl: () => getGetMyUserUrl,
-	getGetOpenIDConfigurationUrl: () => getGetOpenIDConfigurationUrl,
 	getGetProjectUrl: () => getGetProjectUrl,
 	getGetReadyUrl: () => getGetReadyUrl,
 	getGetSchemaByIdUrl: () => getGetSchemaByIdUrl,
 	getGetSessionUrl: () => getGetSessionUrl,
 	getGetTeamUrl: () => getGetTeamUrl,
-	getGetTokenUrl: () => getGetTokenUrl,
 	getGetUserByIDUrl: () => getGetUserByIDUrl,
-	getGetUserInfoUrl: () => getGetUserInfoUrl,
 	getHealth: () => getHealth,
-	getIntrospectUrl: () => getIntrospectUrl,
+	getInitClaimUrl: () => getInitClaimUrl,
 	getIssueChallengeUrl: () => getIssueChallengeUrl,
-	getKeys: () => getKeys,
 	getListBrandingUrl: () => getListBrandingUrl,
+	getListEventsUrl: () => getListEventsUrl,
 	getListFlowDefinitionsUrl: () => getListFlowDefinitionsUrl,
 	getListSchemasUrl: () => getListSchemasUrl,
-	getListSessionsUrl: () => getListSessionsUrl,
 	getListUserPasskeysUrl: () => getListUserPasskeysUrl,
+	getListUserTeamsUrl: () => getListUserTeamsUrl,
 	getListUsersUrl: () => getListUsersUrl,
 	getLive: () => getLive,
 	getMySession: () => getMySession,
 	getMyUser: () => getMyUser,
-	getOpenIDConfiguration: () => getOpenIDConfiguration,
 	getPatchProjectUrl: () => getPatchProjectUrl,
 	getProject: () => getProject,
 	getQueryProjectsUrl: () => getQueryProjectsUrl,
+	getQuerySessionsUrl: () => getQuerySessionsUrl,
+	getQueryTeamsUrl: () => getQueryTeamsUrl,
 	getReady: () => getReady,
 	getRevokeMySessionUrl: () => getRevokeMySessionUrl,
 	getRevokeSessionUrl: () => getRevokeSessionUrl,
-	getRevokeTokenUrl: () => getRevokeTokenUrl,
 	getSchemaById: () => getSchemaById,
 	getSession: () => getSession,
 	getSetUserPasswordUrl: () => getSetUserPasswordUrl,
-	getSubmitFlowEventUrl: () => getSubmitFlowEventUrl,
 	getSubmitFlowStepUrl: () => getSubmitFlowStepUrl,
 	getTeam: () => getTeam,
-	getToken: () => getToken,
 	getUpdateFlowDefinitionUrl: () => getUpdateFlowDefinitionUrl,
+	getUpdateTeamUrl: () => getUpdateTeamUrl,
 	getUserByID: () => getUserByID,
-	getUserInfo: () => getUserInfo,
 	getVerifyChallengeProofUrl: () => getVerifyChallengeProofUrl,
-	introspect: () => introspect,
+	initClaim: () => initClaim,
 	issueChallenge: () => issueChallenge,
 	listBranding: () => listBranding,
+	listEvents: () => listEvents,
 	listFlowDefinitions: () => listFlowDefinitions,
 	listSchemas: () => listSchemas,
-	listSessions: () => listSessions,
 	listUserPasskeys: () => listUserPasskeys,
+	listUserTeams: () => listUserTeams,
 	listUsers: () => listUsers,
 	patchProject: () => patchProject,
 	queryProjects: () => queryProjects,
+	querySessions: () => querySessions,
+	queryTeams: () => queryTeams,
 	revokeMySession: () => revokeMySession,
 	revokeSession: () => revokeSession,
-	revokeToken: () => revokeToken,
 	setUserPassword: () => setUserPassword,
-	submitFlowEvent: () => submitFlowEvent,
 	submitFlowStep: () => submitFlowStep,
 	updateFlowDefinition: () => updateFlowDefinition,
+	updateTeam: () => updateTeam,
 	verifyChallengeProof: () => verifyChallengeProof
 });
-const getGetOpenIDConfigurationUrl = () => {
-	return `${getProxyPath()}/.well-known/openid-configuration`;
-};
-/**
-* Retrieve the OpenID Connect configuration
-* @summary Get OpenID Connect configuration
-*/
-const getOpenIDConfiguration = async (options) => {
-	return customFetch(getGetOpenIDConfigurationUrl(), {
-		...options,
-		method: "GET"
-	});
-};
-const getAuthorizeGetUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/auth/authorize?${stringifiedParams}` : `${getProxyPath()}/auth/authorize`;
-};
-/**
-* @summary Authorize a user
-*/
-const authorizeGet = async (params, options) => {
-	return customFetch(getAuthorizeGetUrl(params), {
-		...options,
-		method: "GET"
-	});
-};
-const getAuthorizeDeviceUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/auth/device-authorization?${stringifiedParams}` : `${getProxyPath()}/auth/device-authorization`;
-};
-/**
-* @summary Authorize a device
-*/
-const authorizeDevice = async (params, options) => {
-	return customFetch(getAuthorizeDeviceUrl(params), {
-		...options,
-		method: "GET"
-	});
-};
-const getEndSessionUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/auth/end-session?${stringifiedParams}` : `${getProxyPath()}/auth/end-session`;
-};
-/**
-* @summary End a session
-*/
-const endSession = async (params, options) => {
-	return customFetch(getEndSessionUrl(params), {
-		...options,
-		method: "GET"
-	});
-};
-const getIntrospectUrl = () => {
-	return `${getProxyPath()}/auth/introspect`;
-};
-/**
-* @summary Introspect a token
-*/
-const introspect = async (introspectBody, options) => {
-	const formUrlEncoded = new URLSearchParams();
-	formUrlEncoded.append(`token`, introspectBody.token);
-	if (introspectBody.token_type_hint !== void 0) formUrlEncoded.append(`token_type_hint`, introspectBody.token_type_hint);
-	return customFetch(getIntrospectUrl(), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-			...options?.headers
-		},
-		body: formUrlEncoded
-	});
-};
-const getGetKeysUrl = () => {
-	return `${getProxyPath()}/auth/keys`;
-};
-/**
-* @summary Get public keys
-*/
-const getKeys = async (options) => {
-	return customFetch(getGetKeysUrl(), {
-		...options,
-		method: "GET"
-	});
-};
-const getRevokeTokenUrl = () => {
-	return `${getProxyPath()}/auth/revoke`;
-};
-/**
-* @summary Revoke an access token or refresh token
-*/
-const revokeToken = async (revokeTokenBody, options) => {
-	const formUrlEncoded = new URLSearchParams();
-	if (revokeTokenBody.token !== void 0) formUrlEncoded.append(`token`, revokeTokenBody.token);
-	if (revokeTokenBody.token_type_hint !== void 0) formUrlEncoded.append(`token_type_hint`, revokeTokenBody.token_type_hint);
-	return customFetch(getRevokeTokenUrl(), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-			...options?.headers
-		},
-		body: formUrlEncoded
-	});
-};
-const getGetTokenUrl = () => {
-	return `${getProxyPath()}/auth/token`;
-};
-/**
-* @summary Get access token
-*/
-const getToken = async (getTokenBody, options) => {
-	const formUrlEncoded = new URLSearchParams();
-	if (getTokenBody.code !== void 0) formUrlEncoded.append(`code`, getTokenBody.code);
-	if (getTokenBody.client_assertion !== void 0) formUrlEncoded.append(`client_assertion`, getTokenBody.client_assertion);
-	if (getTokenBody.client_assertion_type !== void 0) formUrlEncoded.append(`client_assertion_type`, getTokenBody.client_assertion_type);
-	if (getTokenBody.client_id !== void 0) formUrlEncoded.append(`client_id`, getTokenBody.client_id);
-	if (getTokenBody.client_secret !== void 0) formUrlEncoded.append(`client_secret`, getTokenBody.client_secret);
-	if (getTokenBody.code_verifier !== void 0) formUrlEncoded.append(`code_verifier`, getTokenBody.code_verifier);
-	if (getTokenBody.grant_type !== void 0) formUrlEncoded.append(`grant_type`, getTokenBody.grant_type);
-	if (getTokenBody.redirect_uri !== void 0) formUrlEncoded.append(`redirect_uri`, getTokenBody.redirect_uri);
-	return customFetch(getGetTokenUrl(), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-			...options?.headers
-		},
-		body: formUrlEncoded
-	});
-};
-const getGetUserInfoUrl = () => {
-	return `${getProxyPath()}/auth/userinfo`;
-};
-/**
-* @summary Get user info
-*/
-const getUserInfo = async (options) => {
-	return customFetch(getGetUserInfoUrl(), {
-		...options,
-		method: "GET"
-	});
-};
 const getGetHealthUrl = () => {
 	return `${getProxyPath()}/healthz`;
 };
@@ -487,19 +327,14 @@ const getUserByID = async (userId, params, options) => {
 		method: "GET"
 	});
 };
-const getDeleteUserByIDUrl = (userId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}?${stringifiedParams}` : `${getProxyPath()}/users/${userId}`;
+const getDeleteUserByIDUrl = (userId) => {
+	return `${getProxyPath()}/users/${userId}`;
 };
 /**
 * @summary Delete user by ID
 */
-const deleteUserByID = async (userId, params, options) => {
-	return customFetch(getDeleteUserByIDUrl(userId, params), {
+const deleteUserByID = async (userId, options) => {
+	return customFetch(getDeleteUserByIDUrl(userId), {
 		...options,
 		method: "DELETE"
 	});
@@ -521,19 +356,14 @@ const listUserPasskeys = async (userId, params, options) => {
 		method: "GET"
 	});
 };
-const getSetUserPasswordUrl = (userId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/password?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/password`;
+const getSetUserPasswordUrl = (userId) => {
+	return `${getProxyPath()}/users/${userId}/password`;
 };
 /**
 * @summary Set user password
 */
-const setUserPassword = async (userId, setUserPasswordBody, params, options) => {
-	return customFetch(getSetUserPasswordUrl(userId, params), {
+const setUserPassword = async (userId, setUserPasswordBody, options) => {
+	return customFetch(getSetUserPasswordUrl(userId), {
 		...options,
 		method: "PUT",
 		headers: {
@@ -543,6 +373,31 @@ const setUserPassword = async (userId, setUserPasswordBody, params, options) =>
 		body: JSON.stringify(setUserPasswordBody)
 	});
 };
+const getListUserTeamsUrl = (userId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/teams?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/teams`;
+};
+/**
+* The user's team roster, ordered by team name. Each entry carries the
+team's name, so a client renders a page without resolving ids one by one.
+
+This is the N:N roster and it is not lifecycle ownership: the single team
+that owns the user's lifecycle is reported as `metadata.lifecycle_owner_team_id`
+on the user read endpoints. Memberships the user was removed from are not
+returned.
+
+* @summary List the teams a user belongs to
+*/
+const listUserTeams = async (userId, params, options) => {
+	return customFetch(getListUserTeamsUrl(userId, params), {
+		...options,
+		method: "GET"
+	});
+};
 const getGetMyUserUrl = () => {
 	return `${getProxyPath()}/users/me`;
 };
@@ -564,7 +419,7 @@ the first capability step. Creates a new session implicitly unless
 `session_id` is provided (for step-up / reauth on an existing session).
 
 The response contains an `id` field — the flow handle. Use it as the path
-parameter for all subsequent `/flow/{id}/submit` and `/flow/{id}/event` calls.
+parameter for all subsequent `/flow/{id}/submit` calls.
 
 The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
 the flow's orchestration state (current step, collected data, history).
@@ -644,26 +499,6 @@ const submitFlowStep = async (id, submitFlowStepBody, options) => {
 		body: JSON.stringify(submitFlowStepBody)
 	});
 };
-const getSubmitFlowEventUrl = (id) => {
-	return `${getProxyPath()}/flow/${id}/event`;
-};
-/**
-* Submits telemetry or fingerprint data from the frontend.
-Does not advance the state machine. Used for risk evaluation.
-
-* @summary Submit client-side event
-*/
-const submitFlowEvent = async (id, submitFlowEventBody, options) => {
-	return customFetch(getSubmitFlowEventUrl(id), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(submitFlowEventBody)
-	});
-};
 const getCreateAuthAttemptUrl = () => {
 	return `${getProxyPath()}/auth_attempts`;
 };
@@ -851,6 +686,68 @@ const patchProject = async (projectId, patchProjectBody, options) => {
 		body: JSON.stringify(patchProjectBody)
 	});
 };
+const getInitClaimUrl = (projectId) => {
+	return `${getProxyPath()}/projects/${projectId}/claim/init`;
+};
+/**
+* Starts a claim challenge for an unclaimed project. Authenticated by the
+project secret, this mints a single-use, short-lived challenge and returns
+the `claim_url` the developer opens in a browser to complete the claim,
+together with the `challenge_id` the CLI polls with. The exact expiry is
+carried by `expires_at` on the response.
+
+* @summary Initialize a project claim
+*/
+const initClaim = async (projectId, options) => {
+	return customFetch(getInitClaimUrl(projectId), {
+		...options,
+		method: "POST"
+	});
+};
+const getGetClaimStatusUrl = (projectId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/projects/${projectId}/claim/status?${stringifiedParams}` : `${getProxyPath()}/projects/${projectId}/claim/status`;
+};
+/**
+* Polled by the CLI while a browser completes the claim. Authorized by the
+project secret that initiated the challenge. Returns `pending`, or
+`completed` with the owning team, the claim timestamp, and the dashboard
+URL once the browser leg has finished.
+
+* @summary Get claim status
+*/
+const getClaimStatus = async (projectId, params, options) => {
+	return customFetch(getGetClaimStatusUrl(projectId, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getCompleteClaimUrl = (projectId) => {
+	return `${getProxyPath()}/projects/${projectId}/claim/complete`;
+};
+/**
+* Called by the browser after the developer authenticates on the claim page.
+Authenticated by the `__nextgen_session` cookie, it attaches the project to
+the developer's personal team using the `challenge_id` from the claim URL as
+its single-use, browser-safe authorization.
+
+* @summary Complete a project claim
+*/
+const completeClaim = async (projectId, completeClaimBody, options) => {
+	return customFetch(getCompleteClaimUrl(projectId), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(completeClaimBody)
+	});
+};
 const getCreateSessionUrl = () => {
 	return `${getProxyPath()}/sessions`;
 };
@@ -863,8 +760,16 @@ Use this explicitly when you want to:
 can be correlated with the eventual authenticated session from the start.
 - Track anonymous state (bot detection, device fingerprint) that survives until authentication.
 
-The returned `session_token` authorises GET and DELETE on this session.
-It is superseded when a handoff exchange completes — clients must replace it at that point.
+Creating a session is an app-plane operation on the project credential
+(`session.write`). The returned `session_token` is a session credential for the
+end-user client, not a management scope: it is delivered as the
+`__nextgen_session` cookie and authorises the self-service operations
+`GET /sessions/me` and `DELETE /sessions/me` (`nextgenSession` scheme). The
+by-id operations `GET /sessions/{session_id}` and `DELETE /sessions/{session_id}`
+are operator endpoints and require `session.read` / `session.delete` instead.
+
+The `session_token` is superseded when a handoff exchange completes — clients must
+replace it at that point.
 
 Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
 full session TTL when the first authentication factor is written via a completing `auth_attempt`.
@@ -882,24 +787,30 @@ const createSession = async (createSessionBody, options) => {
 		body: JSON.stringify(createSessionBody)
 	});
 };
-const getListSessionsUrl = (params) => {
+const getQuerySessionsUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions?${stringifiedParams}` : `${getProxyPath()}/sessions`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/query?${stringifiedParams}` : `${getProxyPath()}/sessions/query`;
 };
 /**
-* Returns a paginated list of sessions for a project.
-Requires a project service key (OAuth2 client credentials).
+* Returns the sessions of a project, paginated with a cursor.
+Sessions of every lifecycle state are returned; each carries its `state`.
+Requires `session.read` permission.
 
-* @summary List sessions
+* @summary Query sessions
 */
-const listSessions = async (params, options) => {
-	return customFetch(getListSessionsUrl(params), {
+const querySessions = async (querySessionsBody, params, options) => {
+	return customFetch(getQuerySessionsUrl(params), {
 		...options,
-		method: "GET"
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(querySessionsBody)
 	});
 };
 const getExchangeHandoffUrl = (params) => {
@@ -942,13 +853,8 @@ const exchangeHandoff = async (exchangeHandoffBody, params, options) => {
 		body: JSON.stringify(exchangeHandoffBody)
 	});
 };
-const getGetSessionUrl = (sessionId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}` : `${getProxyPath()}/sessions/${sessionId}`;
+const getGetSessionUrl = (sessionId) => {
+	return `${getProxyPath()}/sessions/${sessionId}`;
 };
 /**
 * Returns the current state of a session including its factors and all currently
@@ -960,33 +866,30 @@ against the same `session_id`) to restore a dropped assurance level.
 
 * @summary Get session state
 */
-const getSession = async (sessionId, params, options) => {
-	return customFetch(getGetSessionUrl(sessionId, params), {
+const getSession = async (sessionId, options) => {
+	return customFetch(getGetSessionUrl(sessionId), {
 		...options,
 		method: "GET"
 	});
 };
-const getRevokeSessionUrl = (sessionId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}` : `${getProxyPath()}/sessions/${sessionId}`;
+const getRevokeSessionUrl = (sessionId) => {
+	return `${getProxyPath()}/sessions/${sessionId}`;
 };
 /**
-* Revokes the session immediately (`state: revoked`).
+* Permanently deletes the session, terminating it immediately.
 
 This is the operator revoke path and requires the `session.delete` scope on a
 project-bound credential. End-user logout with the `__nextgen_session` cookie is
 `DELETE /sessions/me` (`nextgenSession` scheme).
 
-After revocation, any tokens derived from this session are invalidated.
+Idempotent: deleting a session that does not exist (or was already deleted)
+still returns 204. After deletion, any tokens derived from the session are
+invalidated.
 
 * @summary Revoke session
 */
-const revokeSession = async (sessionId, params, options) => {
-	return customFetch(getRevokeSessionUrl(sessionId, params), {
+const revokeSession = async (sessionId, options) => {
+	return customFetch(getRevokeSessionUrl(sessionId), {
 		...options,
 		method: "DELETE"
 	});
@@ -1014,10 +917,12 @@ const getRevokeMySessionUrl = () => {
 	return `${getProxyPath()}/sessions/me`;
 };
 /**
-* Revokes the session immediately (`state: revoked`). This is the logout operation.
+* Logs out by permanently deleting the session.
 
-The __nextgen_session cookie issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated including the cookie itself, which is cleared in the response.
+The `__nextgen_session` cookie issued at creation (or superseded by a handoff
+exchange) is required. Idempotent: if the session is already gone this still
+returns 204. Any tokens derived from the session are invalidated, and the
+cookie itself is cleared in the response.
 
 * @summary Revoke my session
 */
@@ -1036,10 +941,12 @@ const getCreateSchemaUrl = (params) => {
 	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas?${stringifiedParams}` : `${getProxyPath()}/schemas`;
 };
 /**
-* Create a new schema. The schema definition must include a unique $id field,
-which will be used to identify the schema in future requests. The $id must
-be a valid URI and should ideally point to the location where the schema
-can be accessed.
+* Create a new schema. The optional `$id` field is the JSON Schema document
+URI used to identify the schema in future requests (GitOps-stable identity,
+not a free-form resource primary key). When `$id` is omitted, the server
+generates a `sch_*` URL. When provided, `$id` must be unique within the
+project and should ideally be a valid URI pointing at where the schema can
+be accessed.
 
 The schema can either be a concrete schema, e.g. a user schema, or a
 schema-url which will be resolved by the server.
@@ -1138,31 +1045,21 @@ const listFlowDefinitions = async (params, options) => {
 		method: "GET"
 	});
 };
-const getGetFlowDefinitionUrl = (id, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+const getGetFlowDefinitionUrl = (id) => {
+	return `${getProxyPath()}/flow_definitions/${id}`;
 };
 /**
 * Get a flow definition by id
 * @summary Get a flow definition by id
 */
-const getFlowDefinition = async (id, params, options) => {
-	return customFetch(getGetFlowDefinitionUrl(id, params), {
+const getFlowDefinition = async (id, options) => {
+	return customFetch(getGetFlowDefinitionUrl(id), {
 		...options,
 		method: "GET"
 	});
 };
-const getUpdateFlowDefinitionUrl = (id, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+const getUpdateFlowDefinitionUrl = (id) => {
+	return `${getProxyPath()}/flow_definitions/${id}`;
 };
 /**
 * Update a flow definition by id. This endpoint replaces the existing flow definition.
@@ -1170,8 +1067,8 @@ If `flow_definition.status` is omitted, the current status is preserved
 
 * @summary Update a flow definition by id
 */
-const updateFlowDefinition = async (id, updateFlowDefinitionBody, params, options) => {
-	return customFetch(getUpdateFlowDefinitionUrl(id, params), {
+const updateFlowDefinition = async (id, updateFlowDefinitionBody, options) => {
+	return customFetch(getUpdateFlowDefinitionUrl(id), {
 		...options,
 		method: "PUT",
 		headers: {
@@ -1181,13 +1078,8 @@ const updateFlowDefinition = async (id, updateFlowDefinitionBody, params, option
 		body: JSON.stringify(updateFlowDefinitionBody)
 	});
 };
-const getDeleteFlowDefinitionUrl = (id, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+const getDeleteFlowDefinitionUrl = (id) => {
+	return `${getProxyPath()}/flow_definitions/${id}`;
 };
 /**
 * Delete a flow definition by id.
@@ -1196,94 +1088,112 @@ If the flow definition is the last active flow definition for a given purpose, t
 
 * @summary Delete a flow definition by id
 */
-const deleteFlowDefinition = async (id, params, options) => {
-	return customFetch(getDeleteFlowDefinitionUrl(id, params), {
+const deleteFlowDefinition = async (id, options) => {
+	return customFetch(getDeleteFlowDefinitionUrl(id), {
 		...options,
 		method: "DELETE"
 	});
 };
-const getActivateFlowDefinitionUrl = (id, params) => {
+const getCreateTeamUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}/activate?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}/activate`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams?${stringifiedParams}` : `${getProxyPath()}/teams`;
 };
 /**
-* Activate a flow definition by transitioning it from a `draft` state to an `active` state.
-Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
-
-* @summary Activate a flow definition by ID.
+* @summary Create team
 */
-const activateFlowDefinition = async (id, params, options) => {
-	return customFetch(getActivateFlowDefinitionUrl(id, params), {
+const createTeam = async (createTeamBody, params, options) => {
+	return customFetch(getCreateTeamUrl(params), {
 		...options,
-		method: "POST"
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createTeamBody)
 	});
 };
-const getDeactivateFlowDefinitionUrl = (id, params) => {
+const getQueryTeamsUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}/deactivate?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}/deactivate`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/query?${stringifiedParams}` : `${getProxyPath()}/teams/query`;
 };
 /**
-* Deactivates a flow definition in the `active` state by transitioning it to the `draft` state.
-Flow definitions in `draft` state cannot be used to start new flows. Existing flows that use the deactivated flow definition must gracefully handle this.
-Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
+* Returns the teams of a project, paginated with a cursor.
 
-* @summary Deactivate a flow definition by ID.
+* @summary Query teams
 */
-const deactivateFlowDefinition = async (id, params, options) => {
-	return customFetch(getDeactivateFlowDefinitionUrl(id, params), {
-		...options,
-		method: "POST"
-	});
-};
-const getCreateTeamUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams?${stringifiedParams}` : `${getProxyPath()}/teams`;
-};
-/**
-* @summary Create team
-*/
-const createTeam = async (createTeamBody, params, options) => {
-	return customFetch(getCreateTeamUrl(params), {
+const queryTeams = async (queryTeamsBody, params, options) => {
+	return customFetch(getQueryTeamsUrl(params), {
 		...options,
 		method: "POST",
 		headers: {
 			"Content-Type": "application/json",
 			...options?.headers
 		},
-		body: JSON.stringify(createTeamBody)
+		body: JSON.stringify(queryTeamsBody)
 	});
 };
-const getGetTeamUrl = (teamId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}` : `${getProxyPath()}/teams/${teamId}`;
+const getGetTeamUrl = (teamId) => {
+	return `${getProxyPath()}/teams/${teamId}`;
 };
 /**
-* Returns the current state of a team.
+* Returns a Team by its id.
 
 * @summary Get team
 */
-const getTeam = async (teamId, params, options) => {
-	return customFetch(getGetTeamUrl(teamId, params), {
+const getTeam = async (teamId, options) => {
+	return customFetch(getGetTeamUrl(teamId), {
 		...options,
 		method: "GET"
 	});
 };
+const getDeleteTeamUrl = (teamId) => {
+	return `${getProxyPath()}/teams/${teamId}`;
+};
+/**
+* Deactivates the team.
+
+The team is tombstoned rather than erased: it stays readable through
+getTeam with status `deactivated`. Its memberships are removed and the
+users whose lifecycle it owns are deactivated with it.
+
+The request is idempotent. Deleting a team that is already deactivated
+or doesn't exist succeeds without changing anything.
+
+* @summary Delete team
+*/
+const deleteTeam = async (teamId, options) => {
+	return customFetch(getDeleteTeamUrl(teamId), {
+		...options,
+		method: "DELETE"
+	});
+};
+const getUpdateTeamUrl = (teamId) => {
+	return `${getProxyPath()}/teams/${teamId}`;
+};
+/**
+* Update team. Only active teams can be updated.
+
+* @summary Update team
+*/
+const updateTeam = async (teamId, updateTeamBody, options) => {
+	return customFetch(getUpdateTeamUrl(teamId), {
+		...options,
+		method: "PATCH",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(updateTeamBody)
+	});
+};
 const getCreateBrandingUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
@@ -1339,20 +1249,73 @@ const listBranding = async (params, options) => {
 		method: "GET"
 	});
 };
-const getGetBrandingByIdUrl = (id, params) => {
+const getGetBrandingByIdUrl = (id) => {
+	return `${getProxyPath()}/branding/${id}`;
+};
+/**
+* Retrieves a single branding revision, including its stored configuration.
+* @summary Get a branding revision by ID
+*/
+const getBrandingById = async (id, options) => {
+	return customFetch(getGetBrandingByIdUrl(id), {
+		...options,
+		method: "GET"
+	});
+};
+const getListEventsUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
+		if (Array.isArray(value) && ["category", "event_type"].includes(key)) {
+			value.forEach((v) => {
+				normalizedParams.append(key, v === null ? "null" : v.toString());
+			});
+			return;
+		}
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/branding/${id}?${stringifiedParams}` : `${getProxyPath()}/branding/${id}`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/events?${stringifiedParams}` : `${getProxyPath()}/events`;
 };
 /**
-* Retrieves a single branding revision, including its stored configuration.
-* @summary Get a branding revision by ID
+* Returns project-scoped audit events, newest-first by keyset on
+`(created_at, id)` (ADR 027 / ADR 049). Pass `order=asc` for oldest-first.
+Requires `events.read`.
+
+Pre-claim projects return an empty list (events are stored but not
+visible until claim succeeds). Team-scoped credentials see only events
+whose emit-time `team_id` matches the credential team (enforced when
+team-scoped tokens exist).
+
+Clients discriminate each item via `event_type` (OpenAPI Event oneOf) —
+see docs/design/api/events-catalog.md.
+
+* @summary List events
 */
-const getBrandingById = async (id, params, options) => {
-	return customFetch(getGetBrandingByIdUrl(id, params), {
+const listEvents = async (params, options) => {
+	return customFetch(getListEventsUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetEventUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/events/${id}?${stringifiedParams}` : `${getProxyPath()}/events/${id}`;
+};
+/**
+* Loads a single event by `(project_id, id)`. Requires `events.read`.
+Events are not registered in `resource_scope_index`; project scope is
+required on the query (ADR 049). Misses and cross-project ids return 404.
+
+Pre-claim projects return 404 (stored events stay invisible until claim).
+
+* @summary Get event by ID
+*/
+const getEvent = async (id, params, options) => {
+	return customFetch(getGetEventUrl(id, params), {
 		...options,
 		method: "GET"
 	});
@@ -1383,7 +1346,7 @@ const getBrandingById = async (id, params, options) => {
 * generated orval function:
 *
 *     const client = createZitadelClient({ baseUrl, token });
-*     await client.createProject({ previewOrigins: [] });
+*     await client.createProject({ preview_origins: [] });
 *     await client.createSchema(body, { project_id });
 */
 function createZitadelClient(opts) {
@@ -1400,7 +1363,7 @@ function createZitadelClient(opts) {
 	} });
 }
 //#endregion
-//#region ../config/dist/defaults-CXTnFMHj.mjs
+//#region ../config/dist/defaults-eiGHyI5Y.mjs
 var default_human_user_default = {
 	title: "DefaultHumanUserSchema",
 	$schema: "https://json-schema.org/draft/2020-12/schema",
@@ -1411,14 +1374,8 @@ var default_human_user_default = {
 	type: "object",
 	description: "The default editable schema for human users.",
 	"x-auth-methods": {
-		"password": {
-			"enabled": true,
-			"position": 1
-		},
-		"passkey": {
-			"enabled": true,
-			"position": 2
-		}
+		"password": { "enabled": true },
+		"passkey": { "enabled": true }
 	},
 	required: ["email"],
 	properties: { "email": {
@@ -1441,21 +1398,34 @@ var default_login_default = {
 		{
 			"name": "identifier",
 			"fields": ["email"],
-			"actions": [{
-				"name": "submit",
-				"kind": "submit",
-				"primary": true,
-				"text_key": "identifier.action.continue"
-			}, {
-				"name": "passkey",
-				"kind": "passkey",
-				"primary": false,
-				"text_key": "identifier.action.passkey"
-			}],
+			"actions": [
+				{
+					"name": "submit",
+					"kind": "submit",
+					"primary": true,
+					"text_key": "identifier.action.continue"
+				},
+				{
+					"name": "passkey",
+					"kind": "passkey",
+					"primary": false,
+					"text_key": "identifier.action.passkey"
+				},
+				{
+					"name": "register",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "identifier.action.register.link"
+				}
+			],
 			"transitions": {
 				"submit": { "target": "password" },
 				"passkey": { "target": "done" },
-				"user_not_found": { "target": "register" }
+				"user_not_found": { "target": "register" },
+				"register": {
+					"target": "register",
+					"purpose": "register"
+				}
 			}
 		},
 		{
@@ -1480,21 +1450,34 @@ var default_login_default = {
 		{
 			"name": "register",
 			"fields": ["email"],
-			"actions": [{
-				"name": "submit",
-				"kind": "submit",
-				"primary": true,
-				"text_key": "register.action.password"
-			}, {
-				"name": "passkey_register",
-				"kind": "passkey_register",
-				"primary": false,
-				"text_key": "register.action.passkey"
-			}],
+			"actions": [
+				{
+					"name": "submit",
+					"kind": "submit",
+					"primary": true,
+					"text_key": "register.action.password"
+				},
+				{
+					"name": "passkey_register",
+					"kind": "passkey_register",
+					"primary": false,
+					"text_key": "register.action.passkey"
+				},
+				{
+					"name": "sign_in",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "register.action.sign_in.link"
+				}
+			],
 			"transitions": {
 				"submit": { "target": "register-password" },
 				"passkey_register": { "target": "done" },
-				"user_already_exists": { "target": "password" }
+				"user_already_exists": { "target": "password" },
+				"sign_in": {
+					"target": "identifier",
+					"purpose": "login"
+				}
 			}
 		},
 		{
@@ -1528,14 +1511,8 @@ var human_user_default = {
 	type: "object",
 	description: "The default editable schema for human users (passkey-first sign-in).",
 	"x-auth-methods": {
-		"passkey": {
-			"enabled": true,
-			"position": 1
-		},
-		"password": {
-			"enabled": true,
-			"position": 2
-		}
+		"passkey": { "enabled": true },
+		"password": { "enabled": true }
 	},
 	required: ["email"],
 	properties: { "email": {
@@ -1558,41 +1535,67 @@ var login_default = {
 		{
 			"name": "passkey-first",
 			"fields": [],
-			"actions": [{
-				"name": "passkey",
-				"kind": "passkey",
-				"primary": true,
-				"text_key": "passkey-first.action.passkey"
-			}, {
-				"name": "email_fallback",
-				"kind": "navigate",
-				"primary": false,
-				"text_key": "passkey-first.action.email_fallback"
-			}],
+			"actions": [
+				{
+					"name": "passkey",
+					"kind": "passkey",
+					"primary": true,
+					"text_key": "passkey-first.action.passkey"
+				},
+				{
+					"name": "email_fallback",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "passkey-first.action.email_fallback"
+				},
+				{
+					"name": "register",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "identifier.action.register.link"
+				}
+			],
 			"transitions": {
 				"passkey": { "target": "done" },
 				"email_fallback": { "target": "identifier" },
-				"user_not_found": { "target": "register" }
+				"user_not_found": { "target": "register" },
+				"register": {
+					"target": "register",
+					"purpose": "register"
+				}
 			}
 		},
 		{
 			"name": "identifier",
 			"fields": ["email"],
-			"actions": [{
-				"name": "submit",
-				"kind": "submit",
-				"primary": true,
-				"text_key": "identifier.action.continue"
-			}, {
-				"name": "passkey",
-				"kind": "passkey",
-				"primary": false,
-				"text_key": "identifier.action.passkey"
-			}],
+			"actions": [
+				{
+					"name": "submit",
+					"kind": "submit",
+					"primary": true,
+					"text_key": "identifier.action.continue"
+				},
+				{
+					"name": "passkey",
+					"kind": "passkey",
+					"primary": false,
+					"text_key": "identifier.action.passkey"
+				},
+				{
+					"name": "register",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "identifier.action.register.link"
+				}
+			],
 			"transitions": {
 				"submit": { "target": "password" },
 				"passkey": { "target": "done" },
-				"user_not_found": { "target": "register" }
+				"user_not_found": { "target": "register" },
+				"register": {
+					"target": "register",
+					"purpose": "register"
+				}
 			}
 		},
 		{
@@ -1617,21 +1620,34 @@ var login_default = {
 		{
 			"name": "register",
 			"fields": ["email"],
-			"actions": [{
-				"name": "passkey_register",
-				"kind": "passkey_register",
-				"primary": true,
-				"text_key": "register.action.passkey"
-			}, {
-				"name": "submit",
-				"kind": "submit",
-				"primary": false,
-				"text_key": "register.action.password"
-			}],
+			"actions": [
+				{
+					"name": "passkey_register",
+					"kind": "passkey_register",
+					"primary": true,
+					"text_key": "register.action.passkey"
+				},
+				{
+					"name": "submit",
+					"kind": "submit",
+					"primary": false,
+					"text_key": "register.action.password"
+				},
+				{
+					"name": "sign_in",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "register.action.sign_in.link"
+				}
+			],
 			"transitions": {
 				"passkey_register": { "target": "done" },
 				"submit": { "target": "register-password" },
-				"user_already_exists": { "target": "password" }
+				"user_already_exists": { "target": "password" },
+				"sign_in": {
+					"target": "passkey-first",
+					"purpose": "login"
+				}
 			}
 		},
 		{
@@ -1832,12 +1848,12 @@ async function bootstrapProject(options) {
 	const { baseUrl } = options;
 	const project = await createZitadelClient({ baseUrl }).createProject({
 		name: options.projectName ?? DEFAULT_PROJECT_NAME,
-		previewOrigins: options.appOrigins ?? [],
-		seedDefaults: false
+		preview_origins: options.appOrigins ?? [],
+		seed_defaults: false
 	});
 	const projectId = requireString(project.id, "project id");
-	const projectSecret = requireString(project.projectSecret, "project secret");
-	const previewSecret = typeof project.previewSecret === "string" ? project.previewSecret : void 0;
+	const projectSecret = requireString(project.project_secret, "project secret");
+	const previewSecret = typeof project.preview_secret === "string" ? project.preview_secret : void 0;
 	const client = createZitadelClient({
 		baseUrl,
 		token: projectSecret
@@ -1988,9 +2004,8 @@ function getFreePort() {
 /**
 * Boot an ephemeral local server by shelling out to `zitadel start` and parse
 * its JSON envelope. The CLI owns the subtle parts (port preflight, health
-* wait, process-group stop, embedded-Postgres reaping), so this module stays a
-* thin adapter; swapping it for direct library calls later must not change the
-* shape returned here.
+* wait, process-group stop), so this module stays a thin adapter; swapping it
+* for direct library calls later must not change the shape returned here.
 */
 async function bootLocalServer(options = {}) {
 	const ownsDir = options.dir === void 0;
@@ -2095,8 +2110,9 @@ function identity() {
 }
 /**
 * Create a user that can immediately complete the password login flow:
-* `POST /users` (the body must carry `$schema: <schema id>`) followed by
-* `PUT /users/{id}/password` with `isChangeRequired: false`.
+* `POST /users` (the body carries `schema: <schema id>` and the schema-defined
+* content under `attributes`) followed by `PUT /users/{id}/password` with
+* `is_change_required: false`.
 *
 * Defaults mint a unique email per call (email is x-unique per project), which
 * is what makes per-test seeding parallel-safe on a shared instance.
@@ -2106,14 +2122,16 @@ async function seedUser(client, context, input = {}) {
 	const email = input.email ?? fresh.email;
 	const password = input.password ?? fresh.password;
 	const id = requireString((await client.createUser({
-		...input.attributes,
-		$schema: context.schemaId,
-		email
+		schema: context.schemaId,
+		attributes: {
+			...input.attributes,
+			email
+		}
 	}, { project_id: context.projectId })).id, "user id");
 	await client.setUserPassword(id, {
 		password,
-		isChangeRequired: false
-	}, { project_id: context.projectId });
+		is_change_required: false
+	});
 	return {
 		id,
 		email,
@@ -2284,7 +2302,7 @@ function connectZitadel(handle) {
 	};
 }
 /**
-* Boot an ephemeral local instance (binary runtime + embedded Postgres, no
+* Boot an ephemeral local instance (binary runtime + SQLite by default, no
 * Docker) and bootstrap a project + default schema + login flow on it. The
 * result can seed loginable password users immediately.
 */
@@ -2353,4 +2371,4 @@ Object.defineProperty(exports, "startLocalZitadel", {
 	}
 });
 
-//# sourceMappingURL=src-BIL0PdSd.cjs.map
+//# sourceMappingURL=src-I0KAh1zU.cjs.map