@zitadel/testing 0.0.0

package/dist/src-BIL0PdSd.cjs

@@ -0,0 +1,2356 @@
+const require_handshake = require("./handshake-CggSIoxF.cjs");
+require("node:fs");
+require("node:url");
+let node_fs_promises = require("node:fs/promises");
+let node_os = require("node:os");
+let node_path = require("node:path");
+let node_child_process = require("node:child_process");
+let node_module = require("node:module");
+let node_net = require("node:net");
+let node_crypto = require("node:crypto");
+//#region ../api/dist/runtime/base-url.mjs
+let proxyPath = "";
+function getProxyPath() {
+	return proxyPath;
+}
+function setProxyPath(path) {
+	proxyPath = path;
+}
+//#endregion
+//#region ../api/dist/runtime/auth.mjs
+/**
+* Module-global bearer token used by the orval-generated client's
+* custom fetch. Set once at command boot (the same lifecycle pattern
+* as `base-url.ts`); every generated request reads from here.
+*
+* Keeping the token here means the CLI doesn't have to thread an
+* `Authorization` header through every generated call site; orval's
+* `mutator` wires `runtime/fetch.ts` in, and that file pulls the token
+* from this module.
+*/
+let apiAuthToken;
+function getApiAuthToken() {
+	return apiAuthToken;
+}
+function setApiAuthToken(token) {
+	apiAuthToken = token;
+}
+//#endregion
+//#region ../api/dist/chunk-CfYAbeIz.mjs
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region ../api/dist/runtime/fetch.mjs
+/**
+* Framework-neutral failure type the orval-generated client throws on
+* any non-2xx response. Carries the HTTP status, the parsed error body
+* (the spec's `{code, message, details?}` envelope when the server
+* returned one), and the request URL — enough for callers to map to
+* their own error taxonomy without re-implementing the fetch layer.
+*
+* Callers that don't care about the distinction can catch `ApiError`
+* generically; callers that do (the CLI's `toZitadelError`) read
+* `status` and decide.
+*/
+var ApiError = class extends Error {
+	status;
+	url;
+	body;
+	constructor(status, url, body, message) {
+		super(message);
+		this.name = "ApiError";
+		this.status = status;
+		this.url = url;
+		this.body = body;
+	}
+};
+/**
+* The orval `mutator` for the fetch client. Every generated operation
+* routes its request through this function instead of the global
+* `fetch`. We pin three concerns here so generated call sites stay
+* focused on the shape of one HTTP call:
+*
+* - bearer auth — read from `runtime/auth.ts` and attached automatically;
+* - non-2xx → throw — orval's stock client parses the body regardless
+*   of status, so callers would have to inspect every response. Throw
+*   `ApiError` on `!res.ok` so failures interrupt control flow;
+* - body parsing — return the parsed JSON typed as `T` (the operation's
+*   return type, threaded through by orval), or `undefined` for the
+*   spec's `204`/`205`/`304` no-body responses.
+*/
+async function customFetch(url, options) {
+	const token = getApiAuthToken();
+	const headers = new Headers(options.headers);
+	if (token && !headers.has("authorization")) headers.set("authorization", `Bearer ${token}`);
+	const res = await fetch(url, {
+		...options,
+		headers
+	});
+	const rawBody = [
+		204,
+		205,
+		304
+	].includes(res.status) ? "" : await res.text();
+	const parsed = rawBody ? safeJsonParse(rawBody) : void 0;
+	if (!res.ok) {
+		const message = `${options.method ?? "GET"} ${url} returned ${res.status}`;
+		throw new ApiError(res.status, url, parsed, message);
+	}
+	return parsed;
+}
+/**
+* `JSON.parse` wrapped so a non-JSON body (e.g. an HTML 502 from a
+* proxy) becomes `{ raw: "<text>" }` instead of throwing inside
+* `customFetch`. The thrown `ApiError` then carries something useful
+* for the user to see.
+*/
+function safeJsonParse(text) {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return { raw: text };
+	}
+}
+//#endregion
+//#region ../api/dist/generated/endpoints/zitadelNextGen.mjs
+/**
+* Generated by orval v8.10.0 🍺
+* Do not edit manually.
+* Zitadel NextGen
+* This is the next generation of the Zitadel identity platform.
+* OpenAPI spec version: 0.0.1
+*/
+var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
+	activateFlowDefinition: () => activateFlowDefinition,
+	authorizeDevice: () => authorizeDevice,
+	authorizeGet: () => authorizeGet,
+	createAuthAttempt: () => createAuthAttempt,
+	createBranding: () => createBranding,
+	createFlow: () => createFlow,
+	createFlowDefinition: () => createFlowDefinition,
+	createHandoff: () => createHandoff,
+	createProject: () => createProject,
+	createSchema: () => createSchema,
+	createSession: () => createSession,
+	createTeam: () => createTeam,
+	createUser: () => createUser,
+	deactivateFlowDefinition: () => deactivateFlowDefinition,
+	deleteFlowDefinition: () => deleteFlowDefinition,
+	deleteUserByID: () => deleteUserByID,
+	endSession: () => endSession,
+	exchangeHandoff: () => exchangeHandoff,
+	getActivateFlowDefinitionUrl: () => getActivateFlowDefinitionUrl,
+	getAuthAttempt: () => getAuthAttempt,
+	getAuthorizeDeviceUrl: () => getAuthorizeDeviceUrl,
+	getAuthorizeGetUrl: () => getAuthorizeGetUrl,
+	getBrandingById: () => getBrandingById,
+	getCreateAuthAttemptUrl: () => getCreateAuthAttemptUrl,
+	getCreateBrandingUrl: () => getCreateBrandingUrl,
+	getCreateFlowDefinitionUrl: () => getCreateFlowDefinitionUrl,
+	getCreateFlowUrl: () => getCreateFlowUrl,
+	getCreateHandoffUrl: () => getCreateHandoffUrl,
+	getCreateProjectUrl: () => getCreateProjectUrl,
+	getCreateSchemaUrl: () => getCreateSchemaUrl,
+	getCreateSessionUrl: () => getCreateSessionUrl,
+	getCreateTeamUrl: () => getCreateTeamUrl,
+	getCreateUserUrl: () => getCreateUserUrl,
+	getDeactivateFlowDefinitionUrl: () => getDeactivateFlowDefinitionUrl,
+	getDeleteFlowDefinitionUrl: () => getDeleteFlowDefinitionUrl,
+	getDeleteUserByIDUrl: () => getDeleteUserByIDUrl,
+	getEndSessionUrl: () => getEndSessionUrl,
+	getExchangeHandoffUrl: () => getExchangeHandoffUrl,
+	getFlowDefinition: () => getFlowDefinition,
+	getFlowStep: () => getFlowStep,
+	getGetAuthAttemptUrl: () => getGetAuthAttemptUrl,
+	getGetBrandingByIdUrl: () => getGetBrandingByIdUrl,
+	getGetFlowDefinitionUrl: () => getGetFlowDefinitionUrl,
+	getGetFlowStepUrl: () => getGetFlowStepUrl,
+	getGetHealthUrl: () => getGetHealthUrl,
+	getGetKeysUrl: () => getGetKeysUrl,
+	getGetLiveUrl: () => getGetLiveUrl,
+	getGetMySessionUrl: () => getGetMySessionUrl,
+	getGetMyUserUrl: () => getGetMyUserUrl,
+	getGetOpenIDConfigurationUrl: () => getGetOpenIDConfigurationUrl,
+	getGetProjectUrl: () => getGetProjectUrl,
+	getGetReadyUrl: () => getGetReadyUrl,
+	getGetSchemaByIdUrl: () => getGetSchemaByIdUrl,
+	getGetSessionUrl: () => getGetSessionUrl,
+	getGetTeamUrl: () => getGetTeamUrl,
+	getGetTokenUrl: () => getGetTokenUrl,
+	getGetUserByIDUrl: () => getGetUserByIDUrl,
+	getGetUserInfoUrl: () => getGetUserInfoUrl,
+	getHealth: () => getHealth,
+	getIntrospectUrl: () => getIntrospectUrl,
+	getIssueChallengeUrl: () => getIssueChallengeUrl,
+	getKeys: () => getKeys,
+	getListBrandingUrl: () => getListBrandingUrl,
+	getListFlowDefinitionsUrl: () => getListFlowDefinitionsUrl,
+	getListSchemasUrl: () => getListSchemasUrl,
+	getListSessionsUrl: () => getListSessionsUrl,
+	getListUserPasskeysUrl: () => getListUserPasskeysUrl,
+	getListUsersUrl: () => getListUsersUrl,
+	getLive: () => getLive,
+	getMySession: () => getMySession,
+	getMyUser: () => getMyUser,
+	getOpenIDConfiguration: () => getOpenIDConfiguration,
+	getPatchProjectUrl: () => getPatchProjectUrl,
+	getProject: () => getProject,
+	getQueryProjectsUrl: () => getQueryProjectsUrl,
+	getReady: () => getReady,
+	getRevokeMySessionUrl: () => getRevokeMySessionUrl,
+	getRevokeSessionUrl: () => getRevokeSessionUrl,
+	getRevokeTokenUrl: () => getRevokeTokenUrl,
+	getSchemaById: () => getSchemaById,
+	getSession: () => getSession,
+	getSetUserPasswordUrl: () => getSetUserPasswordUrl,
+	getSubmitFlowEventUrl: () => getSubmitFlowEventUrl,
+	getSubmitFlowStepUrl: () => getSubmitFlowStepUrl,
+	getTeam: () => getTeam,
+	getToken: () => getToken,
+	getUpdateFlowDefinitionUrl: () => getUpdateFlowDefinitionUrl,
+	getUserByID: () => getUserByID,
+	getUserInfo: () => getUserInfo,
+	getVerifyChallengeProofUrl: () => getVerifyChallengeProofUrl,
+	introspect: () => introspect,
+	issueChallenge: () => issueChallenge,
+	listBranding: () => listBranding,
+	listFlowDefinitions: () => listFlowDefinitions,
+	listSchemas: () => listSchemas,
+	listSessions: () => listSessions,
+	listUserPasskeys: () => listUserPasskeys,
+	listUsers: () => listUsers,
+	patchProject: () => patchProject,
+	queryProjects: () => queryProjects,
+	revokeMySession: () => revokeMySession,
+	revokeSession: () => revokeSession,
+	revokeToken: () => revokeToken,
+	setUserPassword: () => setUserPassword,
+	submitFlowEvent: () => submitFlowEvent,
+	submitFlowStep: () => submitFlowStep,
+	updateFlowDefinition: () => updateFlowDefinition,
+	verifyChallengeProof: () => verifyChallengeProof
+});
+const getGetOpenIDConfigurationUrl = () => {
+	return `${getProxyPath()}/.well-known/openid-configuration`;
+};
+/**
+* Retrieve the OpenID Connect configuration
+* @summary Get OpenID Connect configuration
+*/
+const getOpenIDConfiguration = async (options) => {
+	return customFetch(getGetOpenIDConfigurationUrl(), {
+		...options,
+		method: "GET"
+	});
+};
+const getAuthorizeGetUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/auth/authorize?${stringifiedParams}` : `${getProxyPath()}/auth/authorize`;
+};
+/**
+* @summary Authorize a user
+*/
+const authorizeGet = async (params, options) => {
+	return customFetch(getAuthorizeGetUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getAuthorizeDeviceUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/auth/device-authorization?${stringifiedParams}` : `${getProxyPath()}/auth/device-authorization`;
+};
+/**
+* @summary Authorize a device
+*/
+const authorizeDevice = async (params, options) => {
+	return customFetch(getAuthorizeDeviceUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getEndSessionUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/auth/end-session?${stringifiedParams}` : `${getProxyPath()}/auth/end-session`;
+};
+/**
+* @summary End a session
+*/
+const endSession = async (params, options) => {
+	return customFetch(getEndSessionUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getIntrospectUrl = () => {
+	return `${getProxyPath()}/auth/introspect`;
+};
+/**
+* @summary Introspect a token
+*/
+const introspect = async (introspectBody, options) => {
+	const formUrlEncoded = new URLSearchParams();
+	formUrlEncoded.append(`token`, introspectBody.token);
+	if (introspectBody.token_type_hint !== void 0) formUrlEncoded.append(`token_type_hint`, introspectBody.token_type_hint);
+	return customFetch(getIntrospectUrl(), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/x-www-form-urlencoded",
+			...options?.headers
+		},
+		body: formUrlEncoded
+	});
+};
+const getGetKeysUrl = () => {
+	return `${getProxyPath()}/auth/keys`;
+};
+/**
+* @summary Get public keys
+*/
+const getKeys = async (options) => {
+	return customFetch(getGetKeysUrl(), {
+		...options,
+		method: "GET"
+	});
+};
+const getRevokeTokenUrl = () => {
+	return `${getProxyPath()}/auth/revoke`;
+};
+/**
+* @summary Revoke an access token or refresh token
+*/
+const revokeToken = async (revokeTokenBody, options) => {
+	const formUrlEncoded = new URLSearchParams();
+	if (revokeTokenBody.token !== void 0) formUrlEncoded.append(`token`, revokeTokenBody.token);
+	if (revokeTokenBody.token_type_hint !== void 0) formUrlEncoded.append(`token_type_hint`, revokeTokenBody.token_type_hint);
+	return customFetch(getRevokeTokenUrl(), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/x-www-form-urlencoded",
+			...options?.headers
+		},
+		body: formUrlEncoded
+	});
+};
+const getGetTokenUrl = () => {
+	return `${getProxyPath()}/auth/token`;
+};
+/**
+* @summary Get access token
+*/
+const getToken = async (getTokenBody, options) => {
+	const formUrlEncoded = new URLSearchParams();
+	if (getTokenBody.code !== void 0) formUrlEncoded.append(`code`, getTokenBody.code);
+	if (getTokenBody.client_assertion !== void 0) formUrlEncoded.append(`client_assertion`, getTokenBody.client_assertion);
+	if (getTokenBody.client_assertion_type !== void 0) formUrlEncoded.append(`client_assertion_type`, getTokenBody.client_assertion_type);
+	if (getTokenBody.client_id !== void 0) formUrlEncoded.append(`client_id`, getTokenBody.client_id);
+	if (getTokenBody.client_secret !== void 0) formUrlEncoded.append(`client_secret`, getTokenBody.client_secret);
+	if (getTokenBody.code_verifier !== void 0) formUrlEncoded.append(`code_verifier`, getTokenBody.code_verifier);
+	if (getTokenBody.grant_type !== void 0) formUrlEncoded.append(`grant_type`, getTokenBody.grant_type);
+	if (getTokenBody.redirect_uri !== void 0) formUrlEncoded.append(`redirect_uri`, getTokenBody.redirect_uri);
+	return customFetch(getGetTokenUrl(), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/x-www-form-urlencoded",
+			...options?.headers
+		},
+		body: formUrlEncoded
+	});
+};
+const getGetUserInfoUrl = () => {
+	return `${getProxyPath()}/auth/userinfo`;
+};
+/**
+* @summary Get user info
+*/
+const getUserInfo = async (options) => {
+	return customFetch(getGetUserInfoUrl(), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetHealthUrl = () => {
+	return `${getProxyPath()}/healthz`;
+};
+/**
+* Check whether the server is healthy
+* @summary Check server health
+*/
+const getHealth = async (options) => {
+	return customFetch(getGetHealthUrl(), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetLiveUrl = () => {
+	return `${getProxyPath()}/livez`;
+};
+/**
+* Check whether the server is started
+* @summary Check server liveness
+*/
+const getLive = async (options) => {
+	return customFetch(getGetLiveUrl(), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetReadyUrl = () => {
+	return `${getProxyPath()}/readyz`;
+};
+/**
+* Check whether the server is ready to accept requests
+* @summary Check server readiness
+*/
+const getReady = async (options) => {
+	return customFetch(getGetReadyUrl(), {
+		...options,
+		method: "GET"
+	});
+};
+const getCreateUserUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users?${stringifiedParams}` : `${getProxyPath()}/users`;
+};
+/**
+* @summary Create user
+*/
+const createUser = async (createUserBody, params, options) => {
+	return customFetch(getCreateUserUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createUserBody)
+	});
+};
+const getListUsersUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users?${stringifiedParams}` : `${getProxyPath()}/users`;
+};
+/**
+* @summary List users
+*/
+const listUsers = async (params, options) => {
+	return customFetch(getListUsersUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetUserByIDUrl = (userId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}?${stringifiedParams}` : `${getProxyPath()}/users/${userId}`;
+};
+/**
+* @summary Get user by ID
+*/
+const getUserByID = async (userId, params, options) => {
+	return customFetch(getGetUserByIDUrl(userId, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getDeleteUserByIDUrl = (userId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}?${stringifiedParams}` : `${getProxyPath()}/users/${userId}`;
+};
+/**
+* @summary Delete user by ID
+*/
+const deleteUserByID = async (userId, params, options) => {
+	return customFetch(getDeleteUserByIDUrl(userId, params), {
+		...options,
+		method: "DELETE"
+	});
+};
+const getListUserPasskeysUrl = (userId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/passkeys?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/passkeys`;
+};
+/**
+* @summary List user passkeys
+*/
+const listUserPasskeys = async (userId, params, options) => {
+	return customFetch(getListUserPasskeysUrl(userId, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getSetUserPasswordUrl = (userId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/password?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/password`;
+};
+/**
+* @summary Set user password
+*/
+const setUserPassword = async (userId, setUserPasswordBody, params, options) => {
+	return customFetch(getSetUserPasswordUrl(userId, params), {
+		...options,
+		method: "PUT",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(setUserPasswordBody)
+	});
+};
+const getGetMyUserUrl = () => {
+	return `${getProxyPath()}/users/me`;
+};
+/**
+* @summary Get my user information
+*/
+const getMyUser = async (options) => {
+	return customFetch(getGetMyUserUrl(), {
+		...options,
+		method: "GET"
+	});
+};
+const getCreateFlowUrl = () => {
+	return `${getProxyPath()}/flow`;
+};
+/**
+* Resolves a flow definition based on purpose + audience context and returns
+the first capability step. Creates a new session implicitly unless
+`session_id` is provided (for step-up / reauth on an existing session).
+
+The response contains an `id` field — the flow handle. Use it as the path
+parameter for all subsequent `/flow/{id}/submit` and `/flow/{id}/event` calls.
+
+The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
+the flow's orchestration state (current step, collected data, history).
+The server is stateless between requests — all flow state lives in this
+cookie. The browser sends it automatically on subsequent requests.
+
+* @summary Start a new flow
+*/
+const createFlow = async (createFlowBody, options) => {
+	return customFetch(getCreateFlowUrl(), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createFlowBody)
+	});
+};
+const getGetFlowStepUrl = (id) => {
+	return `${getProxyPath()}/flow/${id}`;
+};
+/**
+* Returns the current capability step without advancing the state machine.
+Useful for page reloads or re-rendering after a network error.
+
+* @summary Get current step (re-render)
+*/
+const getFlowStep = async (id, options) => {
+	return customFetch(getGetFlowStepUrl(id), {
+		...options,
+		method: "GET"
+	});
+};
+const getSubmitFlowStepUrl = (id) => {
+	return `${getProxyPath()}/flow/${id}/submit`;
+};
+/**
+* Submits user input for the current step. The server validates,
+processes (e.g., verifies a credential), advances the state machine
+through any invisible steps, and returns the next visible step.
+
+The response sets an updated encrypted `HttpOnly` cookie (`_zflow`)
+with the new flow state. The server is stateless — all orchestration
+state is carried in this cookie between requests.
+
+**Important:** The `id` in the response may differ from the `id` used in
+the request. This happens when a flow pivots (pushes a new flow onto the
+stack) or when a stacked flow completes (auto-pops to the parent flow).
+Always use the `id` from the latest response for the next request.
+
+## Flow completion
+
+When `step.type` is `complete`, the flow is terminal. The `step.behavior`
+field tells the frontend what to do:
+
+| `behavior`   | Action                                                     |
+|------------- |------------------------------------------------------------|
+| `redirect`   | Navigate to `redirect_uri` (OIDC/SAML auth request done). |
+| `show`       | Render the step as a success screen (e.g., registration).  |
+
+A `complete` step is only returned when the **entire flow stack** is done.
+If a stacked flow (e.g., recovery pivoted from login) finishes, the server
+auto-pops to the parent flow and returns the parent's next step — the
+frontend never sees a `complete` for intermediate flows.
+
+* @summary Submit step data and advance
+*/
+const submitFlowStep = async (id, submitFlowStepBody, options) => {
+	return customFetch(getSubmitFlowStepUrl(id), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(submitFlowStepBody)
+	});
+};
+const getSubmitFlowEventUrl = (id) => {
+	return `${getProxyPath()}/flow/${id}/event`;
+};
+/**
+* Submits telemetry or fingerprint data from the frontend.
+Does not advance the state machine. Used for risk evaluation.
+
+* @summary Submit client-side event
+*/
+const submitFlowEvent = async (id, submitFlowEventBody, options) => {
+	return customFetch(getSubmitFlowEventUrl(id), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(submitFlowEventBody)
+	});
+};
+const getCreateAuthAttemptUrl = () => {
+	return `${getProxyPath()}/auth_attempts`;
+};
+/**
+* Starts a new authentication attempt. This is the entry point for the auth_attempts state machine.
+
+An attempt is an ephemeral (15-minute TTL) state machine that drives a single authentication round.
+It accepts factor challenges, verifies proofs, and completes into a session or handoff token.
+
+Accepts a project_id and challenge_nonce (from POST /bootstrap/challenge). For step-up re-auth,
+also include session_id to add factors to an existing session.
+
+* @summary Create a new authentication attempt
+*/
+const createAuthAttempt = async (createAuthAttemptBody, options) => {
+	return customFetch(getCreateAuthAttemptUrl(), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createAuthAttemptBody)
+	});
+};
+const getGetAuthAttemptUrl = (attemptId) => {
+	return `${getProxyPath()}/auth_attempts/${attemptId}`;
+};
+/**
+* Polls the current state of an authentication attempt.
+
+Returns the attempt's state, available factors for the next challenge,
+challenges issued so far, and any errors preventing progress.
+
+Use this for polling during long-running factor verifications (e.g., waiting for
+a federated IdP callback or a device flow).
+
+* @summary Get authentication attempt state
+*/
+const getAuthAttempt = async (attemptId, options) => {
+	return customFetch(getGetAuthAttemptUrl(attemptId), {
+		...options,
+		method: "GET"
+	});
+};
+const getIssueChallengeUrl = (attemptId) => {
+	return `${getProxyPath()}/auth_attempts/${attemptId}/challenges`;
+};
+/**
+* Issues a single-factor verification challenge within an auth attempt.
+
+This advances the authentication state machine by requesting a specific factor method
+(password, passkey, TOTP, OTP via SMS, etc.). The server responds with challenge details
+including method, metadata, and any UI hints. The client then verifies the proof
+by calling POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.
+
+* @summary Issue a factor challenge
+*/
+const issueChallenge = async (attemptId, issueChallengeBody, options) => {
+	return customFetch(getIssueChallengeUrl(attemptId), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(issueChallengeBody)
+	});
+};
+const getVerifyChallengeProofUrl = (attemptId, challengeId) => {
+	return `${getProxyPath()}/auth_attempts/${attemptId}/challenges/${challengeId}/verify`;
+};
+/**
+* Submits a proof (credential, code, assertion) to verify a factor challenge.
+
+The proof format depends on the challenge method. For example:
+- `password` method: { password: "…" }
+- `totp` method: { totp: { code: "123456" } }
+- `passkey` method: { passkey: { assertion: "…" } }
+- `recovery_code` method: { recovery_code: "…" }
+
+On successful verification, the factor is written to the auth attempt.
+The attempt moves to the next pending challenge or completes if all required factors are verified.
+
+* @summary Verify a factor proof
+*/
+const verifyChallengeProof = async (attemptId, challengeId, verifyChallengeProofBody, options) => {
+	return customFetch(getVerifyChallengeProofUrl(attemptId, challengeId), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(verifyChallengeProofBody)
+	});
+};
+const getCreateHandoffUrl = (attemptId) => {
+	return `${getProxyPath()}/auth_attempts/${attemptId}/handoff`;
+};
+/**
+* Completes the authentication attempt and mints a `handoff_token`.
+
+Call this after all required factors have been verified and the attempt is in `completed` state.
+The handoff token is short-lived (≤60 seconds) and must be exchanged at
+POST /sessions/exchange to receive the final session and session_token.
+
+The handoff token is:
+- Single-use (atomic exchange, no retry)
+- Audience-bound (requires matching project key for exchange)
+- Idempotency-safe within a 5-minute window (see conventions)
+
+* @summary Complete authentication and create handoff token
+*/
+const createHandoff = async (attemptId, options) => {
+	return customFetch(getCreateHandoffUrl(attemptId), {
+		...options,
+		method: "POST"
+	});
+};
+const getCreateProjectUrl = () => {
+	return `${getProxyPath()}/projects`;
+};
+/**
+* @summary Create project
+*/
+const createProject = async (createProjectBody, options) => {
+	return customFetch(getCreateProjectUrl(), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createProjectBody)
+	});
+};
+const getQueryProjectsUrl = () => {
+	return `${getProxyPath()}/projects/query`;
+};
+/**
+* @summary Query projects
+*/
+const queryProjects = async (queryProjectsBody, options) => {
+	return customFetch(getQueryProjectsUrl(), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(queryProjectsBody)
+	});
+};
+const getGetProjectUrl = (projectId) => {
+	return `${getProxyPath()}/projects/${projectId}`;
+};
+/**
+* Returns the current state of a project.
+
+* @summary Get project
+*/
+const getProject = async (projectId, options) => {
+	return customFetch(getGetProjectUrl(projectId), {
+		...options,
+		method: "GET"
+	});
+};
+const getPatchProjectUrl = (projectId) => {
+	return `${getProxyPath()}/projects/${projectId}`;
+};
+/**
+* Updates the state of a project.
+
+* @summary Update project
+*/
+const patchProject = async (projectId, patchProjectBody, options) => {
+	return customFetch(getPatchProjectUrl(projectId), {
+		...options,
+		method: "PATCH",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(patchProjectBody)
+	});
+};
+const getCreateSessionUrl = () => {
+	return `${getProxyPath()}/sessions`;
+};
+/**
+* Creates an anonymous session shell with no user and no factors (`state: building`).
+
+This is optional — an `auth_attempt` will create a session implicitly if none is provided.
+Use this explicitly when you want to:
+- Pre-allocate a `session_id` before the user is known, so device/telemetry signals
+can be correlated with the eventual authenticated session from the start.
+- Track anonymous state (bot detection, device fingerprint) that survives until authentication.
+
+The returned `session_token` authorises GET and DELETE on this session.
+It is superseded when a handoff exchange completes — clients must replace it at that point.
+
+Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
+full session TTL when the first authentication factor is written via a completing `auth_attempt`.
+
+* @summary Create an anonymous session shell
+*/
+const createSession = async (createSessionBody, options) => {
+	return customFetch(getCreateSessionUrl(), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createSessionBody)
+	});
+};
+const getListSessionsUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions?${stringifiedParams}` : `${getProxyPath()}/sessions`;
+};
+/**
+* Returns a paginated list of sessions for a project.
+Requires a project service key (OAuth2 client credentials).
+
+* @summary List sessions
+*/
+const listSessions = async (params, options) => {
+	return customFetch(getListSessionsUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getExchangeHandoffUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/exchange?${stringifiedParams}` : `${getProxyPath()}/sessions/exchange`;
+};
+/**
+* Consumes a one-time `handoff_token` minted by `POST /auth_attempts/{id}/handoff`
+and returns the resulting session and a `session_token`.
+
+The server resolves the originating `auth_attempt` from the token and then:
+
+| Originating auth_attempt | Outcome |
+|---|---|
+| No `session_id` | A new authenticated session is **created**. |
+| `session_id` points to an anonymous shell | Existing session is **upgraded** — user and factors written in, TTL reset to full session TTL. |
+| `session_id` points to an active session (step-up) | Existing session is **upgraded** — new factors merged, `assurance_levels[]` expanded. |
+
+The response shape is identical in all three cases.
+
+The `session_token` supersedes any previously issued `session_token` for the same session.
+Clients must replace their stored token at this point.
+
+Requires a project service key (OAuth2 client credentials).
+
+* @summary Exchange handoff token for a session
+*/
+const exchangeHandoff = async (exchangeHandoffBody, params, options) => {
+	return customFetch(getExchangeHandoffUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(exchangeHandoffBody)
+	});
+};
+const getGetSessionUrl = (sessionId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}` : `${getProxyPath()}/sessions/${sessionId}`;
+};
+/**
+* Returns the current state of a session including its factors and all currently
+satisfied assurance levels.
+
+`assurance_levels[]` may shrink over time as factor freshness windows expire,
+without the session itself expiring. Use step-up authentication (a new `auth_attempt`
+against the same `session_id`) to restore a dropped assurance level.
+
+* @summary Get session state
+*/
+const getSession = async (sessionId, params, options) => {
+	return customFetch(getGetSessionUrl(sessionId, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getRevokeSessionUrl = (sessionId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}` : `${getProxyPath()}/sessions/${sessionId}`;
+};
+/**
+* Revokes the session immediately (`state: revoked`).
+
+This is the operator revoke path and requires the `session.delete` scope on a
+project-bound credential. End-user logout with the `__nextgen_session` cookie is
+`DELETE /sessions/me` (`nextgenSession` scheme).
+
+After revocation, any tokens derived from this session are invalidated.
+
+* @summary Revoke session
+*/
+const revokeSession = async (sessionId, params, options) => {
+	return customFetch(getRevokeSessionUrl(sessionId, params), {
+		...options,
+		method: "DELETE"
+	});
+};
+const getGetMySessionUrl = () => {
+	return `${getProxyPath()}/sessions/me`;
+};
+/**
+* Returns the current state of the current session including its factors and all currently
+satisfied assurance levels.
+
+`assurance_levels[]` may shrink over time as factor freshness windows expire,
+without the session itself expiring. Use step-up authentication (a new `auth_attempt`
+against the same `session_id`) to restore a dropped assurance level.
+
+* @summary Get my session state
+*/
+const getMySession = async (options) => {
+	return customFetch(getGetMySessionUrl(), {
+		...options,
+		method: "GET"
+	});
+};
+const getRevokeMySessionUrl = () => {
+	return `${getProxyPath()}/sessions/me`;
+};
+/**
+* Revokes the session immediately (`state: revoked`). This is the logout operation.
+
+The __nextgen_session cookie issued at creation (or superseded by a handoff exchange) is required.
+After revocation, any tokens derived from this session are invalidated including the cookie itself, which is cleared in the response.
+
+* @summary Revoke my session
+*/
+const revokeMySession = async (options) => {
+	return customFetch(getRevokeMySessionUrl(), {
+		...options,
+		method: "DELETE"
+	});
+};
+const getCreateSchemaUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas?${stringifiedParams}` : `${getProxyPath()}/schemas`;
+};
+/**
+* Create a new schema. The schema definition must include a unique $id field,
+which will be used to identify the schema in future requests. The $id must
+be a valid URI and should ideally point to the location where the schema
+can be accessed.
+
+The schema can either be a concrete schema, e.g. a user schema, or a
+schema-url which will be resolved by the server.
+
+* @summary Create new schema
+*/
+const createSchema = async (createSchemaBody, params, options) => {
+	return customFetch(getCreateSchemaUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createSchemaBody)
+	});
+};
+const getListSchemasUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas?${stringifiedParams}` : `${getProxyPath()}/schemas`;
+};
+/**
+* Retrieve a list of all schemas available in the system. This endpoint
+supports pagination and filtering based on schema attributes.
+
+* @summary List all schemas
+*/
+const listSchemas = async (params, options) => {
+	return customFetch(getListSchemasUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetSchemaByIdUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas/${id}?${stringifiedParams}` : `${getProxyPath()}/schemas/${id}`;
+};
+/**
+* Get a schema by its ID. This will return the default revision of the schema.
+* @summary Get schema by ID
+*/
+const getSchemaById = async (id, params, options) => {
+	return customFetch(getGetSchemaByIdUrl(id, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getCreateFlowDefinitionUrl = () => {
+	return `${getProxyPath()}/flow_definitions`;
+};
+/**
+* Creates a new flow definition.
+Flow definitions are templates that define the sequence of steps (capabilities)
+for a particular user journey (e.g., registration, login, password reset).
+
+Flow definitions are created based on the flow definition schema, which includes the flow's purpose, audience, and the steps involved.
+
+* @summary Create a new flow definition
+*/
+const createFlowDefinition = async (createFlowDefinitionBody, options) => {
+	return customFetch(getCreateFlowDefinitionUrl(), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createFlowDefinitionBody)
+	});
+};
+const getListFlowDefinitionsUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions?${stringifiedParams}` : `${getProxyPath()}/flow_definitions`;
+};
+/**
+* Retrieves a list of all flow definitions.
+This endpoint can be used to view existing flow definitions and their configurations.
+
+* @summary List flow definitions
+*/
+const listFlowDefinitions = async (params, options) => {
+	return customFetch(getListFlowDefinitionsUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetFlowDefinitionUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+};
+/**
+* Get a flow definition by id
+* @summary Get a flow definition by id
+*/
+const getFlowDefinition = async (id, params, options) => {
+	return customFetch(getGetFlowDefinitionUrl(id, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getUpdateFlowDefinitionUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+};
+/**
+* Update a flow definition by id. This endpoint replaces the existing flow definition.
+If `flow_definition.status` is omitted, the current status is preserved
+
+* @summary Update a flow definition by id
+*/
+const updateFlowDefinition = async (id, updateFlowDefinitionBody, params, options) => {
+	return customFetch(getUpdateFlowDefinitionUrl(id, params), {
+		...options,
+		method: "PUT",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(updateFlowDefinitionBody)
+	});
+};
+const getDeleteFlowDefinitionUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+};
+/**
+* Delete a flow definition by id.
+If the flow definition is currently being used by a flow, the deletion will fail.
+If the flow definition is the last active flow definition for a given purpose, the deletion will fail to prevent disruption of new flows being started for that purpose.
+
+* @summary Delete a flow definition by id
+*/
+const deleteFlowDefinition = async (id, params, options) => {
+	return customFetch(getDeleteFlowDefinitionUrl(id, params), {
+		...options,
+		method: "DELETE"
+	});
+};
+const getActivateFlowDefinitionUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}/activate?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}/activate`;
+};
+/**
+* Activate a flow definition by transitioning it from a `draft` state to an `active` state.
+Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
+
+* @summary Activate a flow definition by ID.
+*/
+const activateFlowDefinition = async (id, params, options) => {
+	return customFetch(getActivateFlowDefinitionUrl(id, params), {
+		...options,
+		method: "POST"
+	});
+};
+const getDeactivateFlowDefinitionUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}/deactivate?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}/deactivate`;
+};
+/**
+* Deactivates a flow definition in the `active` state by transitioning it to the `draft` state.
+Flow definitions in `draft` state cannot be used to start new flows. Existing flows that use the deactivated flow definition must gracefully handle this.
+Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
+
+* @summary Deactivate a flow definition by ID.
+*/
+const deactivateFlowDefinition = async (id, params, options) => {
+	return customFetch(getDeactivateFlowDefinitionUrl(id, params), {
+		...options,
+		method: "POST"
+	});
+};
+const getCreateTeamUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams?${stringifiedParams}` : `${getProxyPath()}/teams`;
+};
+/**
+* @summary Create team
+*/
+const createTeam = async (createTeamBody, params, options) => {
+	return customFetch(getCreateTeamUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createTeamBody)
+	});
+};
+const getGetTeamUrl = (teamId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}` : `${getProxyPath()}/teams/${teamId}`;
+};
+/**
+* Returns the current state of a team.
+
+* @summary Get team
+*/
+const getTeam = async (teamId, params, options) => {
+	return customFetch(getGetTeamUrl(teamId, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getCreateBrandingUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/branding?${stringifiedParams}` : `${getProxyPath()}/branding`;
+};
+/**
+* Publishes a new immutable branding revision for the project. Branding
+revisions cannot be updated or deleted; every edit publishes a new
+revision, and flow responses resolve the latest revision per project
+(see ADR 040).
+
+The `liquid_template` is validated lexically on save (size, encoding,
+banned patterns such as `<script>` tags, inline event handlers, and the
+`| raw` filter). Authoritative LiquidJS validation runs at authoring
+time via `zitadel plan` / `zitadel apply`.
+
+* @summary Publish a new branding revision
+*/
+const createBranding = async (createBrandingBody, params, options) => {
+	return customFetch(getCreateBrandingUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createBrandingBody)
+	});
+};
+const getListBrandingUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/branding?${stringifiedParams}` : `${getProxyPath()}/branding`;
+};
+/**
+* Lists branding revisions for the project, newest first, capped at the
+100 most recent. The first entry is the revision flow responses
+currently resolve. Deliberately unpaginated in v1 — list endpoints
+gain a real query mechanism together (ADR 031); advertising pagination
+parameters the server ignores would be worse than none.
+
+* @summary List branding revisions
+*/
+const listBranding = async (params, options) => {
+	return customFetch(getListBrandingUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetBrandingByIdUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/branding/${id}?${stringifiedParams}` : `${getProxyPath()}/branding/${id}`;
+};
+/**
+* Retrieves a single branding revision, including its stored configuration.
+* @summary Get a branding revision by ID
+*/
+const getBrandingById = async (id, params, options) => {
+	return customFetch(getGetBrandingByIdUrl(id, params), {
+		...options,
+		method: "GET"
+	});
+};
+//#endregion
+//#region ../api/dist/runtime/api-factory.mjs
+/**
+* Factory for the typed Zitadel client every consumer reaches for.
+*
+* Wraps the orval-generated endpoints in a {@link Proxy} so each
+* generated function sees the right base URL and (optionally) the
+* right bearer token at call time — without the caller having to
+* thread either through every operation, and without exposing the
+* module-globals (`setProxyPath` / `setApiAuthToken`) as part of the
+* public API.
+*
+* Per-instance isolation: multiple clients can coexist in one process
+* (different servers, different tokens). Their Proxy `get` traps set
+* the globals synchronously before invoking the underlying generated
+* function, which reads them at the top of `customFetch` before any
+* `await`. Two clients running interleaved within a single JS turn
+* are safe; two clients running in parallel across awaits could
+* clobber each other — not a pattern any current consumer uses.
+*/
+/**
+* Build a typed Zitadel client pre-bound to a base URL and (optionally)
+* a bearer token. Every method on the returned object mirrors a
+* generated orval function:
+*
+*     const client = createZitadelClient({ baseUrl, token });
+*     await client.createProject({ previewOrigins: [] });
+*     await client.createSchema(body, { project_id });
+*/
+function createZitadelClient(opts) {
+	let baseUrl = opts.baseUrl;
+	while (baseUrl.endsWith("/")) baseUrl = baseUrl.slice(0, -1);
+	return new Proxy(zitadelNextGen_exports, { get(target, prop, receiver) {
+		const value = Reflect.get(target, prop, receiver);
+		if (typeof value !== "function") return value;
+		return (...args) => {
+			setProxyPath(baseUrl);
+			setApiAuthToken(opts.token);
+			return value(...args);
+		};
+	} });
+}
+//#endregion
+//#region ../config/dist/defaults-CXTnFMHj.mjs
+var default_human_user_default = {
+	title: "DefaultHumanUserSchema",
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	metaSchema: "${SERVER_URL}/user-schema.json",
+	$id: "${USER_SCHEMA_URL}",
+	objectType: "human-user",
+	kind: "user-schema",
+	type: "object",
+	description: "The default editable schema for human users.",
+	"x-auth-methods": {
+		"password": {
+			"enabled": true,
+			"position": 1
+		},
+		"passkey": {
+			"enabled": true,
+			"position": 2
+		}
+	},
+	required: ["email"],
+	properties: { "email": {
+		"type": "string",
+		"format": "email",
+		"x-unique": "project",
+		"description": "The user's email address."
+	} }
+};
+var default_login_default = {
+	$schema: "../meta/flow-definition.json",
+	name: "default-login",
+	status: "active",
+	user_schema: "${USER_SCHEMA_URL}",
+	purposes: {
+		"login": "identifier",
+		"register": "register"
+	},
+	steps: [
+		{
+			"name": "identifier",
+			"fields": ["email"],
+			"actions": [{
+				"name": "submit",
+				"kind": "submit",
+				"primary": true,
+				"text_key": "identifier.action.continue"
+			}, {
+				"name": "passkey",
+				"kind": "passkey",
+				"primary": false,
+				"text_key": "identifier.action.passkey"
+			}],
+			"transitions": {
+				"submit": { "target": "password" },
+				"passkey": { "target": "done" },
+				"user_not_found": { "target": "register" }
+			}
+		},
+		{
+			"name": "password",
+			"fields": ["x-auth-methods#password"],
+			"actions": [{
+				"name": "submit",
+				"kind": "submit",
+				"primary": true,
+				"text_key": "password.action.signin"
+			}, {
+				"name": "passkey",
+				"kind": "passkey",
+				"primary": false,
+				"text_key": "password.action.passkey"
+			}],
+			"transitions": {
+				"submit": { "target": "done" },
+				"passkey": { "target": "done" }
+			}
+		},
+		{
+			"name": "register",
+			"fields": ["email"],
+			"actions": [{
+				"name": "submit",
+				"kind": "submit",
+				"primary": true,
+				"text_key": "register.action.password"
+			}, {
+				"name": "passkey_register",
+				"kind": "passkey_register",
+				"primary": false,
+				"text_key": "register.action.passkey"
+			}],
+			"transitions": {
+				"submit": { "target": "register-password" },
+				"passkey_register": { "target": "done" },
+				"user_already_exists": { "target": "password" }
+			}
+		},
+		{
+			"name": "register-password",
+			"fields": ["x-auth-methods#password"],
+			"actions": [{
+				"name": "submit",
+				"kind": "submit",
+				"primary": true,
+				"text_key": "register-password.action.submit"
+			}],
+			"on_success": "create_user",
+			"transitions": {
+				"submit": { "target": "done" },
+				"user_already_exists": { "target": "password" }
+			}
+		},
+		{
+			"name": "done",
+			"complete": "show"
+		}
+	]
+};
+var human_user_default = {
+	title: "DefaultHumanUserSchema",
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	metaSchema: "${SERVER_URL}/user-schema.json",
+	$id: "${USER_SCHEMA_URL}",
+	objectType: "human-user",
+	kind: "user-schema",
+	type: "object",
+	description: "The default editable schema for human users (passkey-first sign-in).",
+	"x-auth-methods": {
+		"passkey": {
+			"enabled": true,
+			"position": 1
+		},
+		"password": {
+			"enabled": true,
+			"position": 2
+		}
+	},
+	required: ["email"],
+	properties: { "email": {
+		"type": "string",
+		"format": "email",
+		"x-unique": "project",
+		"description": "The user's email address."
+	} }
+};
+var login_default = {
+	$schema: "../meta/flow-definition.json",
+	name: "default-login",
+	status: "active",
+	user_schema: "${USER_SCHEMA_URL}",
+	purposes: {
+		"login": "passkey-first",
+		"register": "register"
+	},
+	steps: [
+		{
+			"name": "passkey-first",
+			"fields": [],
+			"actions": [{
+				"name": "passkey",
+				"kind": "passkey",
+				"primary": true,
+				"text_key": "passkey-first.action.passkey"
+			}, {
+				"name": "email_fallback",
+				"kind": "navigate",
+				"primary": false,
+				"text_key": "passkey-first.action.email_fallback"
+			}],
+			"transitions": {
+				"passkey": { "target": "done" },
+				"email_fallback": { "target": "identifier" },
+				"user_not_found": { "target": "register" }
+			}
+		},
+		{
+			"name": "identifier",
+			"fields": ["email"],
+			"actions": [{
+				"name": "submit",
+				"kind": "submit",
+				"primary": true,
+				"text_key": "identifier.action.continue"
+			}, {
+				"name": "passkey",
+				"kind": "passkey",
+				"primary": false,
+				"text_key": "identifier.action.passkey"
+			}],
+			"transitions": {
+				"submit": { "target": "password" },
+				"passkey": { "target": "done" },
+				"user_not_found": { "target": "register" }
+			}
+		},
+		{
+			"name": "password",
+			"fields": ["x-auth-methods#password"],
+			"actions": [{
+				"name": "submit",
+				"kind": "submit",
+				"primary": true,
+				"text_key": "password.action.signin"
+			}, {
+				"name": "passkey",
+				"kind": "passkey",
+				"primary": false,
+				"text_key": "password.action.passkey"
+			}],
+			"transitions": {
+				"submit": { "target": "done" },
+				"passkey": { "target": "done" }
+			}
+		},
+		{
+			"name": "register",
+			"fields": ["email"],
+			"actions": [{
+				"name": "passkey_register",
+				"kind": "passkey_register",
+				"primary": true,
+				"text_key": "register.action.passkey"
+			}, {
+				"name": "submit",
+				"kind": "submit",
+				"primary": false,
+				"text_key": "register.action.password"
+			}],
+			"transitions": {
+				"passkey_register": { "target": "done" },
+				"submit": { "target": "register-password" },
+				"user_already_exists": { "target": "password" }
+			}
+		},
+		{
+			"name": "register-password",
+			"fields": ["x-auth-methods#password"],
+			"actions": [{
+				"name": "submit",
+				"kind": "submit",
+				"primary": true,
+				"text_key": "register-password.action.submit"
+			}],
+			"on_success": "create_user",
+			"transitions": {
+				"submit": { "target": "done" },
+				"user_already_exists": { "target": "password" }
+			}
+		},
+		{
+			"name": "done",
+			"complete": "show"
+		}
+	]
+};
+const DEFAULT_BUILTIN_SCHEMA_BASE = "https://nextgen.com/api/schemas";
+const DEFAULT_FLOW_SCHEMA_URI = "https://nextgen.com/flow-definition.json";
+/**
+* Named schema+flow bundles `zitadel setup` can scaffold (#448: the prompt
+* fires before any `.zitadel/` file is written; each preset maps to a
+* pre-defined bundle the CLI copies on first setup). `password-first` is
+* today's default; `passkey-first` puts a passkey ceremony on the login
+* entry step with an email→password fallback path.
+*/
+const SETUP_PRESETS = ["password-first", "passkey-first"];
+const PRESET_TEMPLATES = {
+	"password-first": {
+		schema: default_human_user_default,
+		flow: default_login_default
+	},
+	"passkey-first": {
+		schema: human_user_default,
+		flow: login_default
+	}
+};
+function presetTemplates(preset) {
+	if (!Object.hasOwn(PRESET_TEMPLATES, preset)) throw new Error(`unknown setup preset ${JSON.stringify(preset)} (known presets: ${SETUP_PRESETS.join(", ")})`);
+	return PRESET_TEMPLATES[preset];
+}
+/**
+* The second setup axis (#448): *who* signs in, orthogonal to the sign-in
+* preset (*how* they sign in). The sign-in preset owns the flow shape and
+* auth methods; the use case owns which profile fields the schema collects.
+* Composing the two keeps us at one field catalog + one flow-per-preset
+* instead of a bundle per (use case × preset) pair. `minimal` is the
+* default and never blocks non-interactive runs.
+*/
+const SETUP_USE_CASES = [
+	"minimal",
+	"consumer",
+	"business"
+];
+/**
+* Fields each use case collects, in register/display order. `email` is
+* always first and stays the only required property; the rest are optional
+* profile attributes gathered on the flow's register step. `givenName`/
+* `familyName` are the attributes the backend reads for a user's identity
+* (`internal/domain/user.go`); `companyName` is stored as a plain user
+* attribute today — there is no org/team model behind it yet.
+*/
+const USE_CASE_FIELDS = {
+	minimal: ["email"],
+	consumer: [
+		"email",
+		"givenName",
+		"familyName"
+	],
+	business: [
+		"email",
+		"givenName",
+		"familyName",
+		"companyName"
+	]
+};
+/**
+* JSON-Schema bodies for the optional profile fields the CLI composes in per
+* use case. The shipped templates are an email-only baseline (shared verbatim
+* with the Go server fallback), so this catalog owns every field beyond
+* `email`. Authored in the templates' style — no `x-claim`, since the backend
+* maps identity by attribute name and the user-property meta-schema defines no
+* claim keyword. `givenName`/`familyName` are the attributes the backend reads
+* for a user's identity (`internal/domain/user.go`).
+*/
+const EXTRA_FIELD_BODIES = {
+	givenName: {
+		type: "string",
+		maxLength: 50,
+		description: "The user's given (first) name."
+	},
+	familyName: {
+		type: "string",
+		maxLength: 50,
+		description: "The user's family (last) name."
+	},
+	companyName: {
+		type: "string",
+		maxLength: 200,
+		description: "The user's company name."
+	}
+};
+function useCaseFields(useCase) {
+	if (!Object.hasOwn(USE_CASE_FIELDS, useCase)) throw new Error(`unknown setup use case ${JSON.stringify(useCase)} (known use cases: ${SETUP_USE_CASES.join(", ")})`);
+	return USE_CASE_FIELDS[useCase];
+}
+/**
+* The body for one use-case field: reuse the template's authored body when it
+* has one (so composed schemas match the shipped defaults for shared fields),
+* else the extra catalog, else a generic editable string so composition stays
+* total for any field a future use case introduces.
+*/
+function fieldBody(field, templateProps) {
+	if (Object.hasOwn(templateProps, field)) return { ...templateProps[field] };
+	if (Object.hasOwn(EXTRA_FIELD_BODIES, field)) return { ...EXTRA_FIELD_BODIES[field] };
+	return {
+		type: "string",
+		description: `The user's ${field}.`
+	};
+}
+/**
+* Narrow a rendered schema to the chosen use case: keep the preset-owned
+* header and `x-auth-methods`, but replace `properties`/`required` with the
+* use case's field set. `email` is the sole required property.
+*/
+function applyUseCaseToSchema(schema, useCase) {
+	const templateProps = schema.properties ?? {};
+	const properties = {};
+	for (const field of useCaseFields(useCase)) properties[field] = fieldBody(field, templateProps);
+	return {
+		...schema,
+		required: ["email"],
+		properties
+	};
+}
+/**
+* Derive the flow's register-step fields from the use case rather than
+* copying a hard-coded list into every bundle (#448): the register step
+* collects exactly what the schema defines. Other steps are untouched.
+*/
+function applyUseCaseToFlow(flow, useCase) {
+	const fields = [...useCaseFields(useCase)];
+	const steps = flow.steps.map((step) => step.name === "register" ? {
+		...step,
+		fields
+	} : step);
+	return {
+		...flow,
+		steps
+	};
+}
+function defaultHumanUserSchemaUrl(builtinSchemaBase = DEFAULT_BUILTIN_SCHEMA_BASE) {
+	return `${trimTrailingSlash(builtinSchemaBase)}/default-human-user.json`;
+}
+function getDefaultHumanUserSchema(options = {}) {
+	const builtinSchemaBase = trimTrailingSlash(options.builtinSchemaBase ?? "https://nextgen.com/api/schemas");
+	return applyUseCaseToSchema(renderTemplate(presetTemplates(options.preset ?? "password-first").schema, {
+		SERVER_URL: builtinSchemaBase,
+		USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase)
+	}), options.useCase ?? "minimal");
+}
+function getDefaultLoginFlow(options = {}) {
+	const builtinSchemaBase = trimTrailingSlash(options.builtinSchemaBase ?? "https://nextgen.com/api/schemas");
+	return applyUseCaseToFlow(renderTemplate(presetTemplates(options.preset ?? "password-first").flow, {
+		SERVER_URL: builtinSchemaBase,
+		USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase)
+	}), options.useCase ?? "minimal");
+}
+function renderTemplate(value, replacements) {
+	if (Array.isArray(value)) return value.map((item) => renderTemplate(item, replacements));
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, renderTemplate(item, replacements)]));
+	if (typeof value === "string") return value.replaceAll(/\$\{([A-Z_]+)\}/g, (match, name) => {
+		return replacements[name] ?? match;
+	});
+	return value;
+}
+function trimTrailingSlash(value) {
+	let trimmed = value;
+	while (trimmed.endsWith("/")) trimmed = trimmed.slice(0, -1);
+	return trimmed;
+}
+//#endregion
+//#region src/bootstrap.ts
+const DEFAULT_PROJECT_NAME = "zitadel-testing";
+/**
+* Server-side half of `zitadel setup`, without any file scaffolding:
+* `POST /projects` is unauthenticated and mints the projectSecret used as the
+* bearer for everything else; the schema is uploaded without `$id` so the
+* server assigns an opaque id, which the flow must then reference.
+*/
+async function bootstrapProject(options) {
+	const { baseUrl } = options;
+	const project = await createZitadelClient({ baseUrl }).createProject({
+		name: options.projectName ?? DEFAULT_PROJECT_NAME,
+		previewOrigins: options.appOrigins ?? [],
+		seedDefaults: false
+	});
+	const projectId = requireString(project.id, "project id");
+	const projectSecret = requireString(project.projectSecret, "project secret");
+	const previewSecret = typeof project.previewSecret === "string" ? project.previewSecret : void 0;
+	const client = createZitadelClient({
+		baseUrl,
+		token: projectSecret
+	});
+	const { $id: _templateId, ...schemaBody } = getDefaultHumanUserSchema({
+		preset: options.preset,
+		useCase: options.useCase
+	});
+	const schemaId = requireString((await client.createSchema(schemaBody, { project_id: projectId })).id, "schema id");
+	const flowBody = getDefaultLoginFlow({
+		userSchemaUrl: schemaId,
+		preset: options.preset,
+		useCase: options.useCase
+	});
+	return {
+		projectId,
+		projectSecret,
+		previewSecret,
+		schemaId,
+		flowId: requireString((await client.createFlowDefinition({
+			project_id: projectId,
+			schema_uri: DEFAULT_FLOW_SCHEMA_URI,
+			flow_definition: flowBody
+		})).id, "flow definition id")
+	};
+}
+function requireString(value, label) {
+	if (typeof value === "string" && value.length > 0) return value;
+	throw new Error(`Missing ${label} in server response.`);
+}
+//#endregion
+//#region src/cli.ts
+const DEFAULT_TIMEOUT_MS = 12e4;
+function resolveCliBin() {
+	const require = (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href);
+	const pkgPath = require.resolve("@zitadel/cli/package.json");
+	const rel = require(pkgPath).bin?.zitadel;
+	if (!rel) throw new Error("@zitadel/cli does not declare a `zitadel` bin entry");
+	return (0, node_path.join)((0, node_path.dirname)(pkgPath), rel);
+}
+function runCli(options) {
+	const bin = options.bin ?? resolveCliBin();
+	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	return new Promise((resolve, reject) => {
+		const child = (0, node_child_process.spawn)(process.execPath, [bin, ...options.args], {
+			env: {
+				...process.env,
+				...options.env
+			},
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk;
+		});
+		child.stderr.setEncoding("utf8");
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk;
+		});
+		const timer = setTimeout(() => {
+			child.kill("SIGKILL");
+			reject(/* @__PURE__ */ new Error(`zitadel ${options.args[0] ?? ""} timed out after ${timeoutMs}ms\n${tail(stderr)}`));
+		}, timeoutMs);
+		timer.unref();
+		child.on("error", (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+		child.on("close", (code) => {
+			clearTimeout(timer);
+			resolve({
+				exitCode: code ?? -1,
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+function tail(text, lines = 20) {
+	return text.split("\n").slice(-lines).join("\n").trim();
+}
+//#endregion
+//#region src/envelope.ts
+/**
+* Render an error envelope's remediation fields for humans — the CLI's
+* `hint`/`next_commands` are the actionable part of a failure (e.g. "Reinstall
+* @zitadel/cli so npm can install @zitadel/server"), so surface them instead
+* of a raw stdout dump. Returns undefined when the envelope has no message.
+*/
+function describeEnvelopeError(envelope) {
+	if (typeof envelope.message !== "string" || envelope.message.length === 0) return;
+	const lines = [envelope.code ? `${envelope.code}: ${envelope.message}` : envelope.message];
+	if (envelope.hint) lines.push(`hint: ${envelope.hint}`);
+	if (envelope.next_commands && envelope.next_commands.length > 0) lines.push(`next: ${envelope.next_commands.join(" | ")}`);
+	return lines.join("\n");
+}
+function parseCliEnvelope(stdout, context) {
+	const start = stdout.indexOf("{");
+	const end = stdout.lastIndexOf("}");
+	if (start === -1 || end <= start) throw new Error(`${context}: expected a JSON envelope on stdout, got:\n${stdout.trim() || "(empty)"}`);
+	let parsed;
+	try {
+		parsed = JSON.parse(stdout.slice(start, end + 1));
+	} catch (error) {
+		throw new Error(`${context}: failed to parse JSON envelope: ${error.message}\n${stdout.trim()}`, { cause: error });
+	}
+	if (typeof parsed !== "object" || parsed === null || typeof parsed.status !== "string") throw new Error(`${context}: stdout JSON is not a CLI envelope:\n${stdout.trim()}`);
+	return parsed;
+}
+//#endregion
+//#region src/ports.ts
+/**
+* Ask the OS for a free TCP port. The port is released before returning, so a
+* racing process could grab it; the CLI's own preflight surfaces that as
+* E_PORT_IN_USE, which is loud rather than corrupting.
+*/
+function getFreePort() {
+	return new Promise((resolve, reject) => {
+		const server = (0, node_net.createServer)();
+		server.unref();
+		server.on("error", reject);
+		server.listen(0, "127.0.0.1", () => {
+			const address = server.address();
+			if (address === null || typeof address === "string") {
+				server.close();
+				reject(/* @__PURE__ */ new Error("could not determine a free port"));
+				return;
+			}
+			const { port } = address;
+			server.close((err) => {
+				if (err) {
+					reject(err);
+					return;
+				}
+				resolve(port);
+			});
+		});
+	});
+}
+//#endregion
+//#region src/lifecycle.ts
+/**
+* Boot an ephemeral local server by shelling out to `zitadel start` and parse
+* its JSON envelope. The CLI owns the subtle parts (port preflight, health
+* wait, process-group stop, embedded-Postgres reaping), so this module stays a
+* thin adapter; swapping it for direct library calls later must not change the
+* shape returned here.
+*/
+async function bootLocalServer(options = {}) {
+	const ownsDir = options.dir === void 0;
+	const dir = options.dir ?? await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "zitadel-testing-"));
+	const port = options.port ?? await getFreePort();
+	const env = {};
+	if (options.serverBinary) env.ZITADEL_SERVER_BINARY = options.serverBinary;
+	const result = await runCli({
+		args: [
+			"start",
+			"--port",
+			String(port),
+			"--non-interactive",
+			"--json",
+			"-c",
+			dir
+		],
+		bin: options.cliBin,
+		env,
+		timeoutMs: options.timeoutMs
+	});
+	if (result.exitCode !== 0) throw new Error(`zitadel start exited with code ${result.exitCode}.\n${failureDetail(result)}\nstate dir kept for inspection: ${dir}`);
+	const stopViaCli = async () => {
+		const stopResult = await runCli({
+			args: [
+				"stop",
+				"--non-interactive",
+				"--json",
+				"-c",
+				dir
+			],
+			bin: options.cliBin,
+			env,
+			timeoutMs: options.timeoutMs
+		});
+		if (stopResult.exitCode !== 0) throw new Error(`zitadel stop exited with code ${stopResult.exitCode}.\n${failureDetail(stopResult)}\nstate dir kept for inspection: ${dir}`);
+	};
+	let envelope;
+	try {
+		envelope = parseCliEnvelope(result.stdout, "zitadel start");
+		if (envelope.status !== "ok") throw new Error(`zitadel start reported status "${envelope.status}":\n${describeEnvelopeError(envelope) ?? tail(result.stdout)}`);
+	} catch (error) {
+		const startError = new Error(`zitadel start produced unusable output.\nreason: ${error instanceof Error ? error.message : String(error)}\nstdout: ${tail(result.stdout) || "(empty)"}\nstderr: ${tail(result.stderr) || "(empty)"}\nstate dir kept for inspection: ${dir}`, { cause: error });
+		try {
+			await stopViaCli();
+		} catch (stopError) {
+			throw new AggregateError([startError, stopError], `${startError.message}\nStopping the possibly-running instance also failed: ${stopError instanceof Error ? stopError.message : String(stopError)}`);
+		}
+		throw startError;
+	}
+	const { runtime, urls } = envelope.data;
+	const runStop = async () => {
+		await stopViaCli();
+		if (ownsDir && !options.keep) await (0, node_fs_promises.rm)(dir, {
+			recursive: true,
+			force: true
+		});
+	};
+	let stopPromise;
+	const stop = () => {
+		stopPromise ??= runStop().catch((error) => {
+			stopPromise = void 0;
+			throw error;
+		});
+		return stopPromise;
+	};
+	return {
+		baseUrl: urls.api,
+		runtime: {
+			port: runtime.port,
+			pid: runtime.pid,
+			dir,
+			logPath: runtime.log_path
+		},
+		stop
+	};
+}
+/**
+* A failed CLI run usually still prints an error envelope; its
+* message/hint/next_commands beat raw output tails (e.g. a fresh install
+* missing @zitadel/server gets "Reinstall @zitadel/cli" instead of a stack).
+*/
+function failureDetail(result) {
+	try {
+		const described = describeEnvelopeError(parseCliEnvelope(result.stdout, "zitadel"));
+		if (described) return described;
+	} catch {}
+	return `stdout: ${tail(result.stdout) || "(empty)"}\nstderr: ${tail(result.stderr) || "(empty)"}`;
+}
+//#endregion
+//#region src/seed.ts
+/**
+* A unique unused email + password. Nothing is created on the instance —
+* this is the input for registration-flow specs, which must prove the flow
+* creates the user.
+*/
+function identity() {
+	return {
+		email: `e2e-${(0, node_crypto.randomUUID)().slice(0, 8)}@example.com`,
+		password: `Pw!${(0, node_crypto.randomUUID)()}`
+	};
+}
+/**
+* Create a user that can immediately complete the password login flow:
+* `POST /users` (the body must carry `$schema: <schema id>`) followed by
+* `PUT /users/{id}/password` with `isChangeRequired: false`.
+*
+* Defaults mint a unique email per call (email is x-unique per project), which
+* is what makes per-test seeding parallel-safe on a shared instance.
+*/
+async function seedUser(client, context, input = {}) {
+	const fresh = identity();
+	const email = input.email ?? fresh.email;
+	const password = input.password ?? fresh.password;
+	const id = requireString((await client.createUser({
+		...input.attributes,
+		$schema: context.schemaId,
+		email
+	}, { project_id: context.projectId })).id, "user id");
+	await client.setUserPassword(id, {
+		password,
+		isChangeRequired: false
+	}, { project_id: context.projectId });
+	return {
+		id,
+		email,
+		password
+	};
+}
+/**
+* Seed `count` users sequentially. The template makes fixture data
+* deterministic per index (stable emails/names keep screenshot diffs about
+* code, not reshuffled data — the `console:dev-real` pattern); untemplated
+* fields fall back to the unique defaults. Name-like attributes need a
+* schema that declares them (`useCase: "consumer"` or wider).
+*/
+async function seedUsers(client, context, count, template = {}) {
+	const users = [];
+	for (let index = 0; index < count; index += 1) users.push(await seedUser(client, context, {
+		email: template.email?.(index),
+		password: template.password?.(index),
+		attributes: template.attributes?.(index)
+	}));
+	return users;
+}
+//#endregion
+//#region src/session.ts
+/** Mirrors the server's session cookie (internal/api/session.go). */
+const SESSION_COOKIE_NAME = "__nextgen_session";
+const MAX_FLOW_STEPS = 6;
+/**
+* Drive the real login flow headlessly for a seeded password user and
+* exchange the terminal handoff for a session: exactly what `<zitadel-login>`
+* does, minus the rendering. Supports flows whose steps only ask for the
+* user's email and password (the shipped `password-first` presets); any step
+* demanding more — a challenge, an unknown field — fails loudly by design.
+*
+* Flow calls use raw fetch instead of the typed client because the flow is
+* stateless through the sealed `_zflow` cookie (internal/api/flow.go): every
+* response re-seals the flow state into Set-Cookie, and submits are rejected
+* without it. Browsers round-trip it implicitly; here a one-cookie jar does.
+*/
+async function mintSession(client, handle, context, user, options = {}) {
+	const values = {
+		email: user.email,
+		password: user.password
+	};
+	const jar = new FlowCookieJar();
+	const origin = options.origin;
+	let response = await flowFetch(handle, jar, origin, "/flow", {
+		project_id: context.projectId,
+		purpose: "login",
+		...options.flowDefinitionName ? { flow_definition_name: options.flowDefinitionName } : {}
+	});
+	for (let hop = 0; hop < MAX_FLOW_STEPS; hop += 1) {
+		if (response.handoff_token) {
+			const exchanged = await client.exchangeHandoff({ handoff_token: response.handoff_token }, { project_id: context.projectId });
+			return {
+				user,
+				sessionToken: exchanged.session_token,
+				expiresAt: exchanged.session.expires_at,
+				cookie: {
+					name: SESSION_COOKIE_NAME,
+					value: exchanged.session_token,
+					httpOnly: true,
+					secure: true,
+					sameSite: "Lax",
+					path: "/"
+				}
+			};
+		}
+		response = await flowFetch(handle, jar, origin, `/flow/${encodeURIComponent(response.id)}/submit`, {
+			session_token: response.session_token,
+			action: "submit",
+			fields: collectFields(response, values)
+		});
+	}
+	throw new Error(`seed.session: flow did not complete within ${MAX_FLOW_STEPS} steps (last step: ${describeStep(response)}).`);
+}
+/** One-cookie jar for the sealed `_zflow` flow-state cookie. */
+var FlowCookieJar = class {
+	cookie;
+	absorb(response) {
+		for (const raw of response.headers.getSetCookie()) {
+			const [pair] = raw.split(";", 1);
+			if (pair?.startsWith("_zflow=")) this.cookie = pair;
+		}
+	}
+	header() {
+		return this.cookie ? { cookie: this.cookie } : {};
+	}
+};
+async function flowFetch(handle, jar, origin, path, body) {
+	const response = await fetch(`${handle.baseUrl}${path}`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			authorization: `Bearer ${handle.projectSecret}`,
+			...origin ? { origin } : {},
+			...jar.header()
+		},
+		body: JSON.stringify(body)
+	});
+	jar.absorb(response);
+	const parsed = await response.json().catch(() => void 0);
+	if (!response.ok || !parsed) {
+		const detail = parsed && typeof parsed === "object" ? ` — ${JSON.stringify(parsed)}` : "";
+		const hint = !origin && /origin/i.test(detail) ? "\nNo Origin header was sent: pass `origin` to seedSession() (the Playwright fixtures pass the suite's baseURL) or `appOrigins` to startLocalZitadel()." : "";
+		throw new Error(`seed.session: POST ${path} returned ${response.status}${detail}${hint}`);
+	}
+	return parsed;
+}
+/**
+* Fill exactly the fields the current step declares — the orchestrator's
+* convention — from the known email/password values. An unknown required
+* field means this flow needs more than a password login can provide.
+*/
+function collectFields(response, values) {
+	const fields = {};
+	for (const field of response.step.fields ?? []) {
+		const value = values[fieldKey(field)];
+		if (value === void 0) throw new Error(`seed.session supports password flows only; step ${describeStep(response)} declares field "${field.name}", which the kit cannot fill. Log in through the UI for flows with additional factors.`);
+		fields[field.name] = value;
+	}
+	return fields;
+}
+/**
+* Steps name credential fields with schema pointers (e.g.
+* `x-auth-methods#password`); match on the trailing segment so the value map
+* stays the plain `{ email, password }` a caller thinks in.
+*/
+function fieldKey(field) {
+	const name = field.name;
+	return (name.split(/[#/.]/).at(-1) ?? name).toLowerCase();
+}
+function describeStep(response) {
+	const name = response.step.name ?? "(unnamed)";
+	const declared = (response.step.fields ?? []).map((field) => field.name).join(", ");
+	return `"${name}"${declared ? ` [fields: ${declared}]` : ""}`;
+}
+//#endregion
+//#region src/index.ts
+/**
+* Attach to an already-bootstrapped instance/project. Lifecycle-free on
+* purpose: this is the entry point for Playwright workers (via the handshake
+* file) and, later, for seeding remote instances.
+*/
+function connectZitadel(handle) {
+	const api = createZitadelClient({
+		baseUrl: handle.baseUrl,
+		token: handle.projectSecret
+	});
+	const context = {
+		projectId: handle.projectId,
+		schemaId: handle.schemaId
+	};
+	return {
+		handle,
+		api,
+		appEnv: require_handshake.applyAppEnvTemplate(require_handshake.nextAppEnv, handle),
+		seedUser: (input) => seedUser(api, context, input),
+		seedUsers: (count, template) => seedUsers(api, context, count, template),
+		identity,
+		seedSession: async (input = {}) => {
+			const { user: existing, flowDefinitionName, origin, ...userInput } = input;
+			return mintSession(api, handle, context, existing ?? await seedUser(api, context, userInput), {
+				flowDefinitionName,
+				origin: origin ?? handle.appOrigin
+			});
+		}
+	};
+}
+/**
+* Boot an ephemeral local instance (binary runtime + embedded Postgres, no
+* Docker) and bootstrap a project + default schema + login flow on it. The
+* result can seed loginable password users immediately.
+*/
+async function startLocalZitadel(options = {}) {
+	const server = await bootLocalServer(options);
+	let bootstrapped;
+	try {
+		bootstrapped = await bootstrapProject({
+			baseUrl: server.baseUrl,
+			projectName: options.projectName,
+			appOrigins: options.appOrigins,
+			preset: options.preset,
+			useCase: options.useCase
+		});
+	} catch (error) {
+		try {
+			await server.stop();
+		} catch (stopError) {
+			throw new AggregateError([error, stopError], "bootstrap failed, and stopping the booted instance also failed");
+		}
+		throw error;
+	}
+	return {
+		...connectZitadel({
+			baseUrl: server.baseUrl,
+			projectId: bootstrapped.projectId,
+			projectSecret: bootstrapped.projectSecret,
+			schemaId: bootstrapped.schemaId,
+			previewSecret: bootstrapped.previewSecret,
+			appOrigin: options.appOrigins?.[0]
+		}),
+		runtime: server.runtime,
+		stop: server.stop,
+		[Symbol.asyncDispose]: server.stop
+	};
+}
+//#endregion
+Object.defineProperty(exports, "SESSION_COOKIE_NAME", {
+	enumerable: true,
+	get: function() {
+		return SESSION_COOKIE_NAME;
+	}
+});
+Object.defineProperty(exports, "bootLocalServer", {
+	enumerable: true,
+	get: function() {
+		return bootLocalServer;
+	}
+});
+Object.defineProperty(exports, "bootstrapProject", {
+	enumerable: true,
+	get: function() {
+		return bootstrapProject;
+	}
+});
+Object.defineProperty(exports, "connectZitadel", {
+	enumerable: true,
+	get: function() {
+		return connectZitadel;
+	}
+});
+Object.defineProperty(exports, "startLocalZitadel", {
+	enumerable: true,
+	get: function() {
+		return startLocalZitadel;
+	}
+});
+
+//# sourceMappingURL=src-BIL0PdSd.cjs.map