@zitadel/testing 0.1.0-alpha.18 → 1.0.0-alpha.20

package/dist/{src-DirKLqi4.cjs → src-DtCJTEId.cjs}

@@ -1,4 +1,4 @@
-const require_handshake = require("./handshake-CRKcgkfN.cjs");
+const require_handshake = require("./handshake-BOsVBPtn.cjs");
 require("node:fs");
 require("node:url");
 let node_fs_promises = require("node:fs/promises");
@@ -129,22 +129,28 @@ function safeJsonParse(text) {
 * OpenAPI spec version: 0.0.1
 */
 var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
+	beginUserPasskeyRegistration: () => beginUserPasskeyRegistration,
 	completeClaim: () => completeClaim,
 	createAuthAttempt: () => createAuthAttempt,
 	createBranding: () => createBranding,
 	createFlow: () => createFlow,
 	createFlowDefinition: () => createFlowDefinition,
+	createGrant: () => createGrant,
 	createHandoff: () => createHandoff,
 	createProject: () => createProject,
+	createRelease: () => createRelease,
 	createSchema: () => createSchema,
 	createSession: () => createSession,
 	createTeam: () => createTeam,
 	createUser: () => createUser,
 	deleteFlowDefinition: () => deleteFlowDefinition,
+	deleteGrant: () => deleteGrant,
 	deleteTeam: () => deleteTeam,
 	deleteUserByID: () => deleteUserByID,
 	exchangeHandoff: () => exchangeHandoff,
+	finishUserPasskeyRegistration: () => finishUserPasskeyRegistration,
 	getAuthAttempt: () => getAuthAttempt,
+	getBeginUserPasskeyRegistrationUrl: () => getBeginUserPasskeyRegistrationUrl,
 	getBrandingById: () => getBrandingById,
 	getClaimStatus: () => getClaimStatus,
 	getCompleteClaimUrl: () => getCompleteClaimUrl,
@@ -152,42 +158,55 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	getCreateBrandingUrl: () => getCreateBrandingUrl,
 	getCreateFlowDefinitionUrl: () => getCreateFlowDefinitionUrl,
 	getCreateFlowUrl: () => getCreateFlowUrl,
+	getCreateGrantUrl: () => getCreateGrantUrl,
 	getCreateHandoffUrl: () => getCreateHandoffUrl,
 	getCreateProjectUrl: () => getCreateProjectUrl,
+	getCreateReleaseUrl: () => getCreateReleaseUrl,
 	getCreateSchemaUrl: () => getCreateSchemaUrl,
 	getCreateSessionUrl: () => getCreateSessionUrl,
 	getCreateTeamUrl: () => getCreateTeamUrl,
 	getCreateUserUrl: () => getCreateUserUrl,
 	getDeleteFlowDefinitionUrl: () => getDeleteFlowDefinitionUrl,
+	getDeleteGrantUrl: () => getDeleteGrantUrl,
 	getDeleteTeamUrl: () => getDeleteTeamUrl,
 	getDeleteUserByIDUrl: () => getDeleteUserByIDUrl,
+	getEnvironmentByName: () => getEnvironmentByName,
+	getEvent: () => getEvent,
 	getExchangeHandoffUrl: () => getExchangeHandoffUrl,
+	getFinishUserPasskeyRegistrationUrl: () => getFinishUserPasskeyRegistrationUrl,
 	getFlowDefinition: () => getFlowDefinition,
 	getFlowStep: () => getFlowStep,
 	getGetAuthAttemptUrl: () => getGetAuthAttemptUrl,
 	getGetBrandingByIdUrl: () => getGetBrandingByIdUrl,
 	getGetClaimStatusUrl: () => getGetClaimStatusUrl,
+	getGetEnvironmentByNameUrl: () => getGetEnvironmentByNameUrl,
+	getGetEventUrl: () => getGetEventUrl,
 	getGetFlowDefinitionUrl: () => getGetFlowDefinitionUrl,
 	getGetFlowStepUrl: () => getGetFlowStepUrl,
+	getGetGrantUrl: () => getGetGrantUrl,
 	getGetHealthUrl: () => getGetHealthUrl,
 	getGetLiveUrl: () => getGetLiveUrl,
 	getGetMySessionUrl: () => getGetMySessionUrl,
 	getGetMyUserUrl: () => getGetMyUserUrl,
 	getGetProjectUrl: () => getGetProjectUrl,
 	getGetReadyUrl: () => getGetReadyUrl,
+	getGetReleaseByIdUrl: () => getGetReleaseByIdUrl,
 	getGetSchemaByIdUrl: () => getGetSchemaByIdUrl,
 	getGetSessionUrl: () => getGetSessionUrl,
 	getGetTeamUrl: () => getGetTeamUrl,
 	getGetUserByIDUrl: () => getGetUserByIDUrl,
+	getGrant: () => getGrant,
 	getHealth: () => getHealth,
 	getInitClaimUrl: () => getInitClaimUrl,
 	getIssueChallengeUrl: () => getIssueChallengeUrl,
 	getListBrandingUrl: () => getListBrandingUrl,
+	getListEnvironmentsUrl: () => getListEnvironmentsUrl,
+	getListEventsUrl: () => getListEventsUrl,
 	getListFlowDefinitionsUrl: () => getListFlowDefinitionsUrl,
+	getListReleasesUrl: () => getListReleasesUrl,
 	getListSchemasUrl: () => getListSchemasUrl,
 	getListUserPasskeysUrl: () => getListUserPasskeysUrl,
 	getListUserTeamsUrl: () => getListUserTeamsUrl,
-	getListUsersUrl: () => getListUsersUrl,
 	getLive: () => getLive,
 	getMySession: () => getMySession,
 	getMyUser: () => getMyUser,
@@ -196,7 +215,9 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	getQueryProjectsUrl: () => getQueryProjectsUrl,
 	getQuerySessionsUrl: () => getQuerySessionsUrl,
 	getQueryTeamsUrl: () => getQueryTeamsUrl,
+	getQueryUsersUrl: () => getQueryUsersUrl,
 	getReady: () => getReady,
+	getReleaseById: () => getReleaseById,
 	getRevokeMySessionUrl: () => getRevokeMySessionUrl,
 	getRevokeSessionUrl: () => getRevokeSessionUrl,
 	getSchemaById: () => getSchemaById,
@@ -211,15 +232,18 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	initClaim: () => initClaim,
 	issueChallenge: () => issueChallenge,
 	listBranding: () => listBranding,
+	listEnvironments: () => listEnvironments,
+	listEvents: () => listEvents,
 	listFlowDefinitions: () => listFlowDefinitions,
+	listReleases: () => listReleases,
 	listSchemas: () => listSchemas,
 	listUserPasskeys: () => listUserPasskeys,
 	listUserTeams: () => listUserTeams,
-	listUsers: () => listUsers,
 	patchProject: () => patchProject,
 	queryProjects: () => queryProjects,
 	querySessions: () => querySessions,
 	queryTeams: () => queryTeams,
+	queryUsers: () => queryUsers,
 	revokeMySession: () => revokeMySession,
 	revokeSession: () => revokeSession,
 	setUserPassword: () => setUserPassword,
@@ -289,21 +313,27 @@ const createUser = async (createUserBody, params, options) => {
 		body: JSON.stringify(createUserBody)
 	});
 };
-const getListUsersUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/users?${stringifiedParams}` : `${getProxyPath()}/users`;
+const getQueryUsersUrl = () => {
+	return `${getProxyPath()}/users/query`;
 };
 /**
-* @summary List users
+* Returns the users of a project, paginated with a cursor.
+
+The project comes from the credential, not from a parameter: the operation
+is bound to the token's own project by construction. This is why it takes
+no `project_id`, unlike the other query endpoints.
+
+* @summary Query users
 */
-const listUsers = async (params, options) => {
-	return customFetch(getListUsersUrl(params), {
+const queryUsers = async (queryUsersBody, options) => {
+	return customFetch(getQueryUsersUrl(), {
 		...options,
-		method: "GET"
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(queryUsersBody)
 	});
 };
 const getGetUserByIDUrl = (userId, params) => {
@@ -323,19 +353,14 @@ const getUserByID = async (userId, params, options) => {
 		method: "GET"
 	});
 };
-const getDeleteUserByIDUrl = (userId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}?${stringifiedParams}` : `${getProxyPath()}/users/${userId}`;
+const getDeleteUserByIDUrl = (userId) => {
+	return `${getProxyPath()}/users/${userId}`;
 };
 /**
 * @summary Delete user by ID
 */
-const deleteUserByID = async (userId, params, options) => {
-	return customFetch(getDeleteUserByIDUrl(userId, params), {
+const deleteUserByID = async (userId, options) => {
+	return customFetch(getDeleteUserByIDUrl(userId), {
 		...options,
 		method: "DELETE"
 	});
@@ -357,19 +382,61 @@ const listUserPasskeys = async (userId, params, options) => {
 		method: "GET"
 	});
 };
-const getSetUserPasswordUrl = (userId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+const getBeginUserPasskeyRegistrationUrl = (userId) => {
+	return `${getProxyPath()}/users/${userId}/passkeys/registrations`;
+};
+/**
+* Starts a WebAuthn registration ceremony for the user and returns the
+creation options for `navigator.credentials.create()`. Complete the
+ceremony with `POST /users/{user_id}/passkeys/registrations/{registration_id}` within
+five minutes. Credentials already registered for the user are excluded
+automatically.
+
+* @summary Begin passkey registration
+*/
+const beginUserPasskeyRegistration = async (userId, beginUserPasskeyRegistrationBody, options) => {
+	return customFetch(getBeginUserPasskeyRegistrationUrl(userId), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(beginUserPasskeyRegistrationBody)
 	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/password?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/password`;
+};
+const getFinishUserPasskeyRegistrationUrl = (userId, registrationId) => {
+	return `${getProxyPath()}/users/${userId}/passkeys/registrations/${registrationId}`;
+};
+/**
+* Verifies the attestation against the ceremony started by
+`POST /users/{user_id}/passkeys/registrations` and persists the new credential. A
+rejected attestation counts against the ceremony's failure budget and the
+ceremony stays open for a retry. An expired ceremony surfaces as
+`att.stale_challenge`; an unknown or already-consumed registration id
+surfaces as `att.not_found`.
+
+* @summary Finish passkey registration
+*/
+const finishUserPasskeyRegistration = async (userId, registrationId, finishUserPasskeyRegistrationBody, options) => {
+	return customFetch(getFinishUserPasskeyRegistrationUrl(userId, registrationId), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(finishUserPasskeyRegistrationBody)
+	});
+};
+const getSetUserPasswordUrl = (userId) => {
+	return `${getProxyPath()}/users/${userId}/password`;
 };
 /**
 * @summary Set user password
 */
-const setUserPassword = async (userId, setUserPasswordBody, params, options) => {
-	return customFetch(getSetUserPasswordUrl(userId, params), {
+const setUserPassword = async (userId, setUserPasswordBody, options) => {
+	return customFetch(getSetUserPasswordUrl(userId), {
 		...options,
 		method: "PUT",
 		headers: {
@@ -859,13 +926,8 @@ const exchangeHandoff = async (exchangeHandoffBody, params, options) => {
 		body: JSON.stringify(exchangeHandoffBody)
 	});
 };
-const getGetSessionUrl = (sessionId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}` : `${getProxyPath()}/sessions/${sessionId}`;
+const getGetSessionUrl = (sessionId) => {
+	return `${getProxyPath()}/sessions/${sessionId}`;
 };
 /**
 * Returns the current state of a session including its factors and all currently
@@ -877,19 +939,14 @@ against the same `session_id`) to restore a dropped assurance level.
 
 * @summary Get session state
 */
-const getSession = async (sessionId, params, options) => {
-	return customFetch(getGetSessionUrl(sessionId, params), {
+const getSession = async (sessionId, options) => {
+	return customFetch(getGetSessionUrl(sessionId), {
 		...options,
 		method: "GET"
 	});
 };
-const getRevokeSessionUrl = (sessionId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}` : `${getProxyPath()}/sessions/${sessionId}`;
+const getRevokeSessionUrl = (sessionId) => {
+	return `${getProxyPath()}/sessions/${sessionId}`;
 };
 /**
 * Permanently deletes the session, terminating it immediately.
@@ -904,8 +961,8 @@ invalidated.
 
 * @summary Revoke session
 */
-const revokeSession = async (sessionId, params, options) => {
-	return customFetch(getRevokeSessionUrl(sessionId, params), {
+const revokeSession = async (sessionId, options) => {
+	return customFetch(getRevokeSessionUrl(sessionId), {
 		...options,
 		method: "DELETE"
 	});
@@ -1009,7 +1066,10 @@ const getGetSchemaByIdUrl = (id, params) => {
 	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas/${id}?${stringifiedParams}` : `${getProxyPath()}/schemas/${id}`;
 };
 /**
-* Get a schema by its ID. This will return the default revision of the schema.
+* Get a schema by its ID. A schema ID identifies one immutable revision, so
+this returns exactly that revision. To find the current revision of an
+object type, list with `revisions=latest`.
+
 * @summary Get schema by ID
 */
 const getSchemaById = async (id, params, options) => {
@@ -1061,31 +1121,21 @@ const listFlowDefinitions = async (params, options) => {
 		method: "GET"
 	});
 };
-const getGetFlowDefinitionUrl = (id, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+const getGetFlowDefinitionUrl = (id) => {
+	return `${getProxyPath()}/flow_definitions/${id}`;
 };
 /**
 * Get a flow definition by id
 * @summary Get a flow definition by id
 */
-const getFlowDefinition = async (id, params, options) => {
-	return customFetch(getGetFlowDefinitionUrl(id, params), {
+const getFlowDefinition = async (id, options) => {
+	return customFetch(getGetFlowDefinitionUrl(id), {
 		...options,
 		method: "GET"
 	});
 };
-const getUpdateFlowDefinitionUrl = (id, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+const getUpdateFlowDefinitionUrl = (id) => {
+	return `${getProxyPath()}/flow_definitions/${id}`;
 };
 /**
 * Update a flow definition by id. This endpoint replaces the existing flow definition.
@@ -1093,8 +1143,8 @@ If `flow_definition.status` is omitted, the current status is preserved
 
 * @summary Update a flow definition by id
 */
-const updateFlowDefinition = async (id, updateFlowDefinitionBody, params, options) => {
-	return customFetch(getUpdateFlowDefinitionUrl(id, params), {
+const updateFlowDefinition = async (id, updateFlowDefinitionBody, options) => {
+	return customFetch(getUpdateFlowDefinitionUrl(id), {
 		...options,
 		method: "PUT",
 		headers: {
@@ -1104,13 +1154,8 @@ const updateFlowDefinition = async (id, updateFlowDefinitionBody, params, option
 		body: JSON.stringify(updateFlowDefinitionBody)
 	});
 };
-const getDeleteFlowDefinitionUrl = (id, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+const getDeleteFlowDefinitionUrl = (id) => {
+	return `${getProxyPath()}/flow_definitions/${id}`;
 };
 /**
 * Delete a flow definition by id.
@@ -1119,8 +1164,8 @@ If the flow definition is the last active flow definition for a given purpose, t
 
 * @summary Delete a flow definition by id
 */
-const deleteFlowDefinition = async (id, params, options) => {
-	return customFetch(getDeleteFlowDefinitionUrl(id, params), {
+const deleteFlowDefinition = async (id, options) => {
+	return customFetch(getDeleteFlowDefinitionUrl(id), {
 		...options,
 		method: "DELETE"
 	});
@@ -1157,7 +1202,6 @@ const getQueryTeamsUrl = (params) => {
 };
 /**
 * Returns the teams of a project, paginated with a cursor.
-Teams of every lifecycle status are returned; each carries its `status`.
 
 * @summary Query teams
 */
@@ -1172,32 +1216,22 @@ const queryTeams = async (queryTeamsBody, params, options) => {
 		body: JSON.stringify(queryTeamsBody)
 	});
 };
-const getGetTeamUrl = (teamId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}` : `${getProxyPath()}/teams/${teamId}`;
+const getGetTeamUrl = (teamId) => {
+	return `${getProxyPath()}/teams/${teamId}`;
 };
 /**
 * Returns a Team by its id.
 
 * @summary Get team
 */
-const getTeam = async (teamId, params, options) => {
-	return customFetch(getGetTeamUrl(teamId, params), {
+const getTeam = async (teamId, options) => {
+	return customFetch(getGetTeamUrl(teamId), {
 		...options,
 		method: "GET"
 	});
 };
-const getDeleteTeamUrl = (teamId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}` : `${getProxyPath()}/teams/${teamId}`;
+const getDeleteTeamUrl = (teamId) => {
+	return `${getProxyPath()}/teams/${teamId}`;
 };
 /**
 * Deactivates the team.
@@ -1211,27 +1245,22 @@ or doesn't exist succeeds without changing anything.
 
 * @summary Delete team
 */
-const deleteTeam = async (teamId, params, options) => {
-	return customFetch(getDeleteTeamUrl(teamId, params), {
+const deleteTeam = async (teamId, options) => {
+	return customFetch(getDeleteTeamUrl(teamId), {
 		...options,
 		method: "DELETE"
 	});
 };
-const getUpdateTeamUrl = (teamId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}` : `${getProxyPath()}/teams/${teamId}`;
+const getUpdateTeamUrl = (teamId) => {
+	return `${getProxyPath()}/teams/${teamId}`;
 };
 /**
 * Update team. Only active teams can be updated.
 
 * @summary Update team
 */
-const updateTeam = async (teamId, updateTeamBody, params, options) => {
-	return customFetch(getUpdateTeamUrl(teamId, params), {
+const updateTeam = async (teamId, updateTeamBody, options) => {
+	return customFetch(getUpdateTeamUrl(teamId), {
 		...options,
 		method: "PATCH",
 		headers: {
@@ -1241,6 +1270,47 @@ const updateTeam = async (teamId, updateTeamBody, params, options) => {
 		body: JSON.stringify(updateTeamBody)
 	});
 };
+const getListEnvironmentsUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/environments?${stringifiedParams}` : `${getProxyPath()}/environments`;
+};
+/**
+* Lists the project's environments ordered by name.
+
+* @summary List environments
+*/
+const listEnvironments = async (params, options) => {
+	return customFetch(getListEnvironmentsUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetEnvironmentByNameUrl = (name, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/environments/${name}?${stringifiedParams}` : `${getProxyPath()}/environments/${name}`;
+};
+/**
+* Reads one environment of the project by its name.
+
+The lookup is scoped to the project in `project_id`: a name that exists in
+another project answers `env.not_found` exactly as an unused name does.
+
+* @summary Get an environment by name
+*/
+const getEnvironmentByName = async (name, params, options) => {
+	return customFetch(getGetEnvironmentByNameUrl(name, params), {
+		...options,
+		method: "GET"
+	});
+};
 const getCreateBrandingUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
@@ -1296,20 +1366,238 @@ const listBranding = async (params, options) => {
 		method: "GET"
 	});
 };
-const getGetBrandingByIdUrl = (id, params) => {
+const getGetBrandingByIdUrl = (id) => {
+	return `${getProxyPath()}/branding/${id}`;
+};
+/**
+* Retrieves a single branding revision, including its stored configuration.
+* @summary Get a branding revision by ID
+*/
+const getBrandingById = async (id, options) => {
+	return customFetch(getGetBrandingByIdUrl(id), {
+		...options,
+		method: "GET"
+	});
+};
+const getCreateReleaseUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/branding/${id}?${stringifiedParams}` : `${getProxyPath()}/branding/${id}`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/releases?${stringifiedParams}` : `${getProxyPath()}/releases`;
 };
 /**
-* Retrieves a single branding revision, including its stored configuration.
-* @summary Get a branding revision by ID
+* Bundles a release from revisions that already exist, supplied as
+`(kind, revision_id)` pairs. No new revisions are allocated — use the
+per-kind create endpoints for that, then pin the ids here.
+
+Every referenced `revision_id` must exist in the project. Each one's handle
+is read from the revision itself and recorded on the release, so a resource
+is always pinned under the identity it declares.
+
+Creating a release does not deploy it. A release is environment-agnostic
+and the same release can later be deployed to any number of environments
+unchanged.
+
+Idempotent on the pinned set: metadata is excluded from the comparison, so
+re-submitting the same revisions with a different `message` returns the
+release that already pins them rather than creating a second one.
+
+* @summary Create a release
 */
-const getBrandingById = async (id, params, options) => {
-	return customFetch(getGetBrandingByIdUrl(id, params), {
+const createRelease = async (createReleaseBody, params, options) => {
+	return customFetch(getCreateReleaseUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createReleaseBody)
+	});
+};
+const getListReleasesUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/releases?${stringifiedParams}` : `${getProxyPath()}/releases`;
+};
+/**
+* Lists the project's releases, newest first.
+
+Entries carry metadata only — the pinned set is omitted. Read one release
+with `GET /releases/{release_id}` to get its pointers.
+
+* @summary List releases
+*/
+const listReleases = async (params, options) => {
+	return customFetch(getListReleasesUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetReleaseByIdUrl = (releaseId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/releases/${releaseId}?${stringifiedParams}` : `${getProxyPath()}/releases/${releaseId}`;
+};
+/**
+* Reads one release: its metadata and the `(kind, handle, revision_id)`
+tuples it pins.
+
+Does not embed resource content. Resolve each `revision_id` through the
+per-kind read endpoints when the bytes are needed.
+
+The lookup is scoped to the project in `project_id`: a release id belonging
+to another project answers not found exactly as an unknown id does, so the
+endpoint cannot be used to probe for releases in projects the caller cannot
+read.
+
+* @summary Get a release by id
+*/
+const getReleaseById = async (releaseId, params, options) => {
+	return customFetch(getGetReleaseByIdUrl(releaseId, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getCreateGrantUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/grants?${stringifiedParams}` : `${getProxyPath()}/grants`;
+};
+/**
+* Bind a user or team to `project.viewer`, `project.editor`, or
+`project.admin` on the project identified by the `project-id` header.
+IDs are `asgn_<opaque>`. Owning-team (`project.team`) grants are not
+created here — claim owns that path. An unrevoked grant with the same
+principal and relation occupies the unique key even after `expires_at`;
+DELETE it before re-creating.
+
+* @summary Create grant
+*/
+const createGrant = async (createGrantBody, params, options) => {
+	return customFetch(getCreateGrantUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createGrantBody)
+	});
+};
+const getGetGrantUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/grants/${id}?${stringifiedParams}` : `${getProxyPath()}/grants/${id}`;
+};
+/**
+* Loads a grant by `(project_id, id)` that this API manages (user or team
+bound to viewer, editor, or admin) and that has not been revoked.
+"Active" here means not revoked: expired grants stay visible so the
+client can DELETE before re-granting the same binding. Authorization
+still ignores expired grants. Grants are not registered in
+`resource_scope_index`; project scope is required on the query (same as
+events). Misses, revoked rows, project-secret setup (`sk_proj`),
+owning-team (`relation=team`) rows, and cross-project ids return 404.
+
+* @summary Get grant
+*/
+const getGrant = async (id, params, options) => {
+	return customFetch(getGetGrantUrl(id, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getDeleteGrantUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/grants/${id}?${stringifiedParams}` : `${getProxyPath()}/grants/${id}`;
+};
+/**
+* Soft-revokes a grant this API manages and emits `authz.revoked`.
+Already-revoked, missing, project-secret setup, and owning-team grants
+return 404. The row is not un-revoked. Expired grants can still be
+revoked so the unique binding can be reused.
+
+* @summary Revoke grant
+*/
+const deleteGrant = async (id, params, options) => {
+	return customFetch(getDeleteGrantUrl(id, params), {
+		...options,
+		method: "DELETE"
+	});
+};
+const getListEventsUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (Array.isArray(value) && ["category", "event_type"].includes(key)) {
+			value.forEach((v) => {
+				normalizedParams.append(key, v === null ? "null" : v.toString());
+			});
+			return;
+		}
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/events?${stringifiedParams}` : `${getProxyPath()}/events`;
+};
+/**
+* Returns project-scoped audit events, newest-first by keyset on
+`(created_at, id)` (ADR 027 / ADR 049). Pass `order=asc` for oldest-first.
+Requires `events.read`.
+
+Pre-claim projects return an empty list (events are stored but not
+visible until claim succeeds). Team-scoped credentials see only events
+whose emit-time `team_id` matches the credential team (enforced when
+team-scoped tokens exist).
+
+Clients discriminate each item via `event_type` (OpenAPI Event oneOf) —
+see docs/design/api/events-catalog.md.
+
+* @summary List events
+*/
+const listEvents = async (params, options) => {
+	return customFetch(getListEventsUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetEventUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/events/${id}?${stringifiedParams}` : `${getProxyPath()}/events/${id}`;
+};
+/**
+* Loads a single event by `(project_id, id)`. Requires `events.read`.
+Events are not registered in `resource_scope_index`; project scope is
+required on the query (ADR 049). Misses and cross-project ids return 404.
+
+Pre-claim projects return 404 (stored events stay invisible until claim).
+
+* @summary Get event by ID
+*/
+const getEvent = async (id, params, options) => {
+	return customFetch(getGetEventUrl(id, params), {
 		...options,
 		method: "GET"
 	});
@@ -1357,7 +1645,7 @@ function createZitadelClient(opts) {
 	} });
 }
 //#endregion
-//#region ../config/dist/defaults-CXTnFMHj.mjs
+//#region ../config/dist/defaults-DPq0o3iU.mjs
 var default_human_user_default = {
 	title: "DefaultHumanUserSchema",
 	$schema: "https://json-schema.org/draft/2020-12/schema",
@@ -1366,16 +1654,11 @@ var default_human_user_default = {
 	objectType: "human-user",
 	kind: "user-schema",
 	type: "object",
+	"x-identifier": "email",
 	description: "The default editable schema for human users.",
 	"x-auth-methods": {
-		"password": {
-			"enabled": true,
-			"position": 1
-		},
-		"passkey": {
-			"enabled": true,
-			"position": 2
-		}
+		"password": { "enabled": true },
+		"passkey": { "enabled": true }
 	},
 	required: ["email"],
 	properties: { "email": {
@@ -1398,21 +1681,34 @@ var default_login_default = {
 		{
 			"name": "identifier",
 			"fields": ["email"],
-			"actions": [{
-				"name": "submit",
-				"kind": "submit",
-				"primary": true,
-				"text_key": "identifier.action.continue"
-			}, {
-				"name": "passkey",
-				"kind": "passkey",
-				"primary": false,
-				"text_key": "identifier.action.passkey"
-			}],
+			"actions": [
+				{
+					"name": "submit",
+					"kind": "submit",
+					"primary": true,
+					"text_key": "identifier.action.continue"
+				},
+				{
+					"name": "passkey",
+					"kind": "passkey",
+					"primary": false,
+					"text_key": "identifier.action.passkey"
+				},
+				{
+					"name": "register",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "identifier.action.register.link"
+				}
+			],
 			"transitions": {
 				"submit": { "target": "password" },
 				"passkey": { "target": "done" },
-				"user_not_found": { "target": "register" }
+				"user_not_found": { "target": "register" },
+				"register": {
+					"target": "register",
+					"purpose": "register"
+				}
 			}
 		},
 		{
@@ -1437,21 +1733,34 @@ var default_login_default = {
 		{
 			"name": "register",
 			"fields": ["email"],
-			"actions": [{
-				"name": "submit",
-				"kind": "submit",
-				"primary": true,
-				"text_key": "register.action.password"
-			}, {
-				"name": "passkey_register",
-				"kind": "passkey_register",
-				"primary": false,
-				"text_key": "register.action.passkey"
-			}],
+			"actions": [
+				{
+					"name": "submit",
+					"kind": "submit",
+					"primary": true,
+					"text_key": "register.action.password"
+				},
+				{
+					"name": "passkey_register",
+					"kind": "passkey_register",
+					"primary": false,
+					"text_key": "register.action.passkey"
+				},
+				{
+					"name": "sign_in",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "register.action.sign_in.link"
+				}
+			],
 			"transitions": {
 				"submit": { "target": "register-password" },
 				"passkey_register": { "target": "done" },
-				"user_already_exists": { "target": "password" }
+				"user_already_exists": { "target": "password" },
+				"sign_in": {
+					"target": "identifier",
+					"purpose": "login"
+				}
 			}
 		},
 		{
@@ -1483,16 +1792,11 @@ var human_user_default = {
 	objectType: "human-user",
 	kind: "user-schema",
 	type: "object",
+	"x-identifier": "email",
 	description: "The default editable schema for human users (passkey-first sign-in).",
 	"x-auth-methods": {
-		"passkey": {
-			"enabled": true,
-			"position": 1
-		},
-		"password": {
-			"enabled": true,
-			"position": 2
-		}
+		"passkey": { "enabled": true },
+		"password": { "enabled": true }
 	},
 	required: ["email"],
 	properties: { "email": {
@@ -1515,41 +1819,67 @@ var login_default = {
 		{
 			"name": "passkey-first",
 			"fields": [],
-			"actions": [{
-				"name": "passkey",
-				"kind": "passkey",
-				"primary": true,
-				"text_key": "passkey-first.action.passkey"
-			}, {
-				"name": "email_fallback",
-				"kind": "navigate",
-				"primary": false,
-				"text_key": "passkey-first.action.email_fallback"
-			}],
+			"actions": [
+				{
+					"name": "passkey",
+					"kind": "passkey",
+					"primary": true,
+					"text_key": "passkey-first.action.passkey"
+				},
+				{
+					"name": "email_fallback",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "passkey-first.action.email_fallback"
+				},
+				{
+					"name": "register",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "identifier.action.register.link"
+				}
+			],
 			"transitions": {
 				"passkey": { "target": "done" },
 				"email_fallback": { "target": "identifier" },
-				"user_not_found": { "target": "register" }
+				"user_not_found": { "target": "register" },
+				"register": {
+					"target": "register",
+					"purpose": "register"
+				}
 			}
 		},
 		{
 			"name": "identifier",
 			"fields": ["email"],
-			"actions": [{
-				"name": "submit",
-				"kind": "submit",
-				"primary": true,
-				"text_key": "identifier.action.continue"
-			}, {
-				"name": "passkey",
-				"kind": "passkey",
-				"primary": false,
-				"text_key": "identifier.action.passkey"
-			}],
+			"actions": [
+				{
+					"name": "submit",
+					"kind": "submit",
+					"primary": true,
+					"text_key": "identifier.action.continue"
+				},
+				{
+					"name": "passkey",
+					"kind": "passkey",
+					"primary": false,
+					"text_key": "identifier.action.passkey"
+				},
+				{
+					"name": "register",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "identifier.action.register.link"
+				}
+			],
 			"transitions": {
 				"submit": { "target": "password" },
 				"passkey": { "target": "done" },
-				"user_not_found": { "target": "register" }
+				"user_not_found": { "target": "register" },
+				"register": {
+					"target": "register",
+					"purpose": "register"
+				}
 			}
 		},
 		{
@@ -1574,21 +1904,34 @@ var login_default = {
 		{
 			"name": "register",
 			"fields": ["email"],
-			"actions": [{
-				"name": "passkey_register",
-				"kind": "passkey_register",
-				"primary": true,
-				"text_key": "register.action.passkey"
-			}, {
-				"name": "submit",
-				"kind": "submit",
-				"primary": false,
-				"text_key": "register.action.password"
-			}],
+			"actions": [
+				{
+					"name": "passkey_register",
+					"kind": "passkey_register",
+					"primary": true,
+					"text_key": "register.action.passkey"
+				},
+				{
+					"name": "submit",
+					"kind": "submit",
+					"primary": false,
+					"text_key": "register.action.password"
+				},
+				{
+					"name": "sign_in",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "register.action.sign_in.link"
+				}
+			],
 			"transitions": {
 				"passkey_register": { "target": "done" },
 				"submit": { "target": "register-password" },
-				"user_already_exists": { "target": "password" }
+				"user_already_exists": { "target": "password" },
+				"sign_in": {
+					"target": "passkey-first",
+					"purpose": "login"
+				}
 			}
 		},
 		{
@@ -2051,8 +2394,9 @@ function identity() {
 }
 /**
 * Create a user that can immediately complete the password login flow:
-* `POST /users` (the body must carry `$schema: <schema id>`) followed by
-* `PUT /users/{id}/password` with `is_change_required: false`.
+* `POST /users` (the body carries `schema: <schema id>` and the schema-defined
+* content under `attributes`) followed by `PUT /users/{id}/password` with
+* `is_change_required: false`.
 *
 * Defaults mint a unique email per call (email is x-unique per project), which
 * is what makes per-test seeding parallel-safe on a shared instance.
@@ -2062,14 +2406,16 @@ async function seedUser(client, context, input = {}) {
 	const email = input.email ?? fresh.email;
 	const password = input.password ?? fresh.password;
 	const id = requireString((await client.createUser({
-		...input.attributes,
-		$schema: context.schemaId,
-		email
+		schema: context.schemaId,
+		attributes: {
+			...input.attributes,
+			email
+		}
 	}, { project_id: context.projectId })).id, "user id");
 	await client.setUserPassword(id, {
 		password,
 		is_change_required: false
-	}, { project_id: context.projectId });
+	});
 	return {
 		id,
 		email,
@@ -2309,4 +2655,4 @@ Object.defineProperty(exports, "startLocalZitadel", {
 	}
 });
 
-//# sourceMappingURL=src-DirKLqi4.cjs.map
+//# sourceMappingURL=src-DtCJTEId.cjs.map