@zitadel/testing 1.0.0-alpha.21 → 1.0.0-alpha.23

package/dist/{src-DtCJTEId.cjs → src-CFX_ayWr.cjs}

@@ -137,22 +137,24 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	createFlowDefinition: () => createFlowDefinition,
 	createGrant: () => createGrant,
 	createHandoff: () => createHandoff,
+	createIdp: () => createIdp,
 	createProject: () => createProject,
 	createRelease: () => createRelease,
 	createSchema: () => createSchema,
 	createSession: () => createSession,
 	createTeam: () => createTeam,
 	createUser: () => createUser,
-	deleteFlowDefinition: () => deleteFlowDefinition,
 	deleteGrant: () => deleteGrant,
 	deleteTeam: () => deleteTeam,
 	deleteUserByID: () => deleteUserByID,
+	deleteVariable: () => deleteVariable,
 	exchangeHandoff: () => exchangeHandoff,
 	finishUserPasskeyRegistration: () => finishUserPasskeyRegistration,
 	getAuthAttempt: () => getAuthAttempt,
 	getBeginUserPasskeyRegistrationUrl: () => getBeginUserPasskeyRegistrationUrl,
 	getBrandingById: () => getBrandingById,
 	getClaimStatus: () => getClaimStatus,
+	getClaimWindow: () => getClaimWindow,
 	getCompleteClaimUrl: () => getCompleteClaimUrl,
 	getCreateAuthAttemptUrl: () => getCreateAuthAttemptUrl,
 	getCreateBrandingUrl: () => getCreateBrandingUrl,
@@ -160,16 +162,17 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	getCreateFlowUrl: () => getCreateFlowUrl,
 	getCreateGrantUrl: () => getCreateGrantUrl,
 	getCreateHandoffUrl: () => getCreateHandoffUrl,
+	getCreateIdpUrl: () => getCreateIdpUrl,
 	getCreateProjectUrl: () => getCreateProjectUrl,
 	getCreateReleaseUrl: () => getCreateReleaseUrl,
 	getCreateSchemaUrl: () => getCreateSchemaUrl,
 	getCreateSessionUrl: () => getCreateSessionUrl,
 	getCreateTeamUrl: () => getCreateTeamUrl,
 	getCreateUserUrl: () => getCreateUserUrl,
-	getDeleteFlowDefinitionUrl: () => getDeleteFlowDefinitionUrl,
 	getDeleteGrantUrl: () => getDeleteGrantUrl,
 	getDeleteTeamUrl: () => getDeleteTeamUrl,
 	getDeleteUserByIDUrl: () => getDeleteUserByIDUrl,
+	getDeleteVariableUrl: () => getDeleteVariableUrl,
 	getEnvironmentByName: () => getEnvironmentByName,
 	getEvent: () => getEvent,
 	getExchangeHandoffUrl: () => getExchangeHandoffUrl,
@@ -179,12 +182,15 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	getGetAuthAttemptUrl: () => getGetAuthAttemptUrl,
 	getGetBrandingByIdUrl: () => getGetBrandingByIdUrl,
 	getGetClaimStatusUrl: () => getGetClaimStatusUrl,
+	getGetClaimWindowUrl: () => getGetClaimWindowUrl,
 	getGetEnvironmentByNameUrl: () => getGetEnvironmentByNameUrl,
 	getGetEventUrl: () => getGetEventUrl,
 	getGetFlowDefinitionUrl: () => getGetFlowDefinitionUrl,
 	getGetFlowStepUrl: () => getGetFlowStepUrl,
 	getGetGrantUrl: () => getGetGrantUrl,
 	getGetHealthUrl: () => getGetHealthUrl,
+	getGetIdpByIdUrl: () => getGetIdpByIdUrl,
+	getGetIdpRevisionByIdUrl: () => getGetIdpRevisionByIdUrl,
 	getGetLiveUrl: () => getGetLiveUrl,
 	getGetMySessionUrl: () => getGetMySessionUrl,
 	getGetMyUserUrl: () => getGetMyUserUrl,
@@ -195,14 +201,20 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	getGetSessionUrl: () => getGetSessionUrl,
 	getGetTeamUrl: () => getGetTeamUrl,
 	getGetUserByIDUrl: () => getGetUserByIDUrl,
+	getGetVariableUrl: () => getGetVariableUrl,
+	getGetVariablesUrl: () => getGetVariablesUrl,
 	getGrant: () => getGrant,
 	getHealth: () => getHealth,
+	getIdpById: () => getIdpById,
+	getIdpRevisionById: () => getIdpRevisionById,
 	getInitClaimUrl: () => getInitClaimUrl,
 	getIssueChallengeUrl: () => getIssueChallengeUrl,
 	getListBrandingUrl: () => getListBrandingUrl,
 	getListEnvironmentsUrl: () => getListEnvironmentsUrl,
 	getListEventsUrl: () => getListEventsUrl,
 	getListFlowDefinitionsUrl: () => getListFlowDefinitionsUrl,
+	getListIdpRevisionsUrl: () => getListIdpRevisionsUrl,
+	getListMyProjectsUrl: () => getListMyProjectsUrl,
 	getListReleasesUrl: () => getListReleasesUrl,
 	getListSchemasUrl: () => getListSchemasUrl,
 	getListUserPasskeysUrl: () => getListUserPasskeysUrl,
@@ -210,8 +222,12 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	getLive: () => getLive,
 	getMySession: () => getMySession,
 	getMyUser: () => getMyUser,
+	getPatchMyUserUrl: () => getPatchMyUserUrl,
 	getPatchProjectUrl: () => getPatchProjectUrl,
+	getPatchUserByIDUrl: () => getPatchUserByIDUrl,
 	getProject: () => getProject,
+	getQueryGrantsUrl: () => getQueryGrantsUrl,
+	getQueryIdpsUrl: () => getQueryIdpsUrl,
 	getQueryProjectsUrl: () => getQueryProjectsUrl,
 	getQuerySessionsUrl: () => getQuerySessionsUrl,
 	getQueryTeamsUrl: () => getQueryTeamsUrl,
@@ -225,9 +241,11 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	getSetUserPasswordUrl: () => getSetUserPasswordUrl,
 	getSubmitFlowStepUrl: () => getSubmitFlowStepUrl,
 	getTeam: () => getTeam,
-	getUpdateFlowDefinitionUrl: () => getUpdateFlowDefinitionUrl,
 	getUpdateTeamUrl: () => getUpdateTeamUrl,
+	getUpdateVariablesUrl: () => getUpdateVariablesUrl,
 	getUserByID: () => getUserByID,
+	getVariable: () => getVariable,
+	getVariables: () => getVariables,
 	getVerifyChallengeProofUrl: () => getVerifyChallengeProofUrl,
 	initClaim: () => initClaim,
 	issueChallenge: () => issueChallenge,
@@ -235,11 +253,17 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	listEnvironments: () => listEnvironments,
 	listEvents: () => listEvents,
 	listFlowDefinitions: () => listFlowDefinitions,
+	listIdpRevisions: () => listIdpRevisions,
+	listMyProjects: () => listMyProjects,
 	listReleases: () => listReleases,
 	listSchemas: () => listSchemas,
 	listUserPasskeys: () => listUserPasskeys,
 	listUserTeams: () => listUserTeams,
+	patchMyUser: () => patchMyUser,
 	patchProject: () => patchProject,
+	patchUserByID: () => patchUserByID,
+	queryGrants: () => queryGrants,
+	queryIdps: () => queryIdps,
 	queryProjects: () => queryProjects,
 	querySessions: () => querySessions,
 	queryTeams: () => queryTeams,
@@ -248,8 +272,8 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	revokeSession: () => revokeSession,
 	setUserPassword: () => setUserPassword,
 	submitFlowStep: () => submitFlowStep,
-	updateFlowDefinition: () => updateFlowDefinition,
 	updateTeam: () => updateTeam,
+	updateVariables: () => updateVariables,
 	verifyChallengeProof: () => verifyChallengeProof
 });
 const getGetHealthUrl = () => {
@@ -319,9 +343,14 @@ const getQueryUsersUrl = () => {
 /**
 * Returns the users of a project, paginated with a cursor.
 
-The project comes from the credential, not from a parameter: the operation
-is bound to the token's own project by construction. This is why it takes
-no `project_id`, unlike the other query endpoints.
+The project comes from the credential, not from a parameter: the
+operation is bound to the credential's home project by construction
+(oauth2 secret or user-bound session). This is why it takes no
+`project_id`, unlike the other query endpoints.
+
+Accepts either a project secret (`oauth2`) or a user-bound Console
+session cookie (`nextgenSession`). CSRF/Origin for cookie mutations
+is a follow-up (#1140).
 
 * @summary Query users
 */
@@ -353,6 +382,28 @@ const getUserByID = async (userId, params, options) => {
 		method: "GET"
 	});
 };
+const getPatchUserByIDUrl = (userId) => {
+	return `${getProxyPath()}/users/${userId}`;
+};
+/**
+* Partially updates a user's schema-defined attributes, and optionally
+moves the user to another registered schema. The merged result is
+validated against the schema before commit. Concurrent writes are
+last-write-wins.
+
+* @summary Update user by ID
+*/
+const patchUserByID = async (userId, patchUserByIDBody, options) => {
+	return customFetch(getPatchUserByIDUrl(userId), {
+		...options,
+		method: "PATCH",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(patchUserByIDBody)
+	});
+};
 const getDeleteUserByIDUrl = (userId) => {
 	return `${getProxyPath()}/users/${userId}`;
 };
@@ -483,6 +534,52 @@ const getMyUser = async (options) => {
 		method: "GET"
 	});
 };
+const getPatchMyUserUrl = () => {
+	return `${getProxyPath()}/users/me`;
+};
+/**
+* Partially updates the caller's own schema-defined attributes. The merged
+result is validated against the user's schema before commit. Concurrent
+writes are last-write-wins.
+
+* @summary Update my user information
+*/
+const patchMyUser = async (patchMyUserBody, options) => {
+	return customFetch(getPatchMyUserUrl(), {
+		...options,
+		method: "PATCH",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(patchMyUserBody)
+	});
+};
+const getListMyProjectsUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/me/projects?${stringifiedParams}` : `${getProxyPath()}/users/me/projects`;
+};
+/**
+* The projects the signed-in user holds an active grant on, either directly or
+through a team they are a member of. Ordered by project id and paged with an
+opaque cursor.
+
+This is not the same question as `queryProjects`, which answers with the one
+project the calling credential is bound to. Here the session is the caller
+and the grants are the answer, so the list spans projects.
+
+* @summary List the projects I can act on
+*/
+const listMyProjects = async (params, options) => {
+	return customFetch(getListMyProjectsUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
 const getCreateFlowUrl = () => {
 	return `${getProxyPath()}/flow`;
 };
@@ -789,7 +886,11 @@ const getGetClaimStatusUrl = (projectId, params) => {
 * Polled by the CLI while a browser completes the claim. Authorized by the
 project secret that initiated the challenge. Returns `pending`, or
 `completed` with the owning team, the claim timestamp, and the dashboard
-URL once the browser leg has finished.
+URL once the project is claimed. The claim grant, not the polled
+challenge, is the source of truth: a project claimed through another
+concurrent challenge also reports `completed`, and a completed claim
+keeps reporting `completed` past this challenge's expiry and past the
+project's claim window.
 
 * @summary Get claim status
 */
@@ -821,6 +922,30 @@ const completeClaim = async (projectId, completeClaimBody, options) => {
 		body: JSON.stringify(completeClaimBody)
 	});
 };
+const getGetClaimWindowUrl = (projectId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/projects/${projectId}/claim/window?${stringifiedParams}` : `${getProxyPath()}/projects/${projectId}/claim/window`;
+};
+/**
+* Read by the claim page in the browser to show how long is left to claim the
+project. Unauthenticated by design: the claim page runs this before the
+developer has signed in, and holding the `challenge_id` from the claim URL
+is the authorization — the same capability `claim/complete` accepts. It
+reveals only the window, never the project itself, and unlike
+`claim/complete` it spends nothing, so a reload is free.
+
+* @summary Get the claim window for a project
+*/
+const getClaimWindow = async (projectId, params, options) => {
+	return customFetch(getGetClaimWindowUrl(projectId, params), {
+		...options,
+		method: "GET"
+	});
+};
 const getCreateSessionUrl = () => {
 	return `${getProxyPath()}/sessions`;
 };
@@ -1082,12 +1207,17 @@ const getCreateFlowDefinitionUrl = () => {
 	return `${getProxyPath()}/flow_definitions`;
 };
 /**
-* Creates a new flow definition.
+* Publishes a new flow definition revision.
 Flow definitions are templates that define the sequence of steps (capabilities)
 for a particular user journey (e.g., registration, login, password reset).
 
 Flow definitions are created based on the flow definition schema, which includes the flow's purpose, audience, and the steps involved.
 
+Every call allocates a new opaque id. Revisions of one flow share its
+`name`; posting a definition under an existing `name` publishes a new
+revision of that flow, it is not a conflict. List with `name` to see a
+flow's revisions, newest by creation time first.
+
 * @summary Create a new flow definition
 */
 const createFlowDefinition = async (createFlowDefinitionBody, options) => {
@@ -1110,8 +1240,9 @@ const getListFlowDefinitionsUrl = (params) => {
 	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions?${stringifiedParams}` : `${getProxyPath()}/flow_definitions`;
 };
 /**
-* Retrieves a list of all flow definitions.
+* Retrieves a list of all flow definitions, newest by creation time first.
 This endpoint can be used to view existing flow definitions and their configurations.
+Filter by `name` to list the revisions of one flow.
 
 * @summary List flow definitions
 */
@@ -1134,42 +1265,6 @@ const getFlowDefinition = async (id, options) => {
 		method: "GET"
 	});
 };
-const getUpdateFlowDefinitionUrl = (id) => {
-	return `${getProxyPath()}/flow_definitions/${id}`;
-};
-/**
-* Update a flow definition by id. This endpoint replaces the existing flow definition.
-If `flow_definition.status` is omitted, the current status is preserved
-
-* @summary Update a flow definition by id
-*/
-const updateFlowDefinition = async (id, updateFlowDefinitionBody, options) => {
-	return customFetch(getUpdateFlowDefinitionUrl(id), {
-		...options,
-		method: "PUT",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(updateFlowDefinitionBody)
-	});
-};
-const getDeleteFlowDefinitionUrl = (id) => {
-	return `${getProxyPath()}/flow_definitions/${id}`;
-};
-/**
-* Delete a flow definition by id.
-If the flow definition is currently being used by a flow, the deletion will fail.
-If the flow definition is the last active flow definition for a given purpose, the deletion will fail to prevent disruption of new flows being started for that purpose.
-
-* @summary Delete a flow definition by id
-*/
-const deleteFlowDefinition = async (id, options) => {
-	return customFetch(getDeleteFlowDefinitionUrl(id), {
-		...options,
-		method: "DELETE"
-	});
-};
 const getCreateTeamUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
@@ -1243,6 +1338,11 @@ users whose lifecycle it owns are deactivated with it.
 The request is idempotent. Deleting a team that is already deactivated
 or doesn't exist succeeds without changing anything.
 
+A team that still owns a project is refused with `409
+team.owns_project`: deactivating it would leave the project owned by a
+dead team and so unmanageable. No endpoint releases that ownership yet,
+so such a team cannot currently be deactivated through the API.
+
 * @summary Delete team
 */
 const deleteTeam = async (teamId, options) => {
@@ -1322,8 +1422,7 @@ const getCreateBrandingUrl = (params) => {
 /**
 * Publishes a new immutable branding revision for the project. Branding
 revisions cannot be updated or deleted; every edit publishes a new
-revision, and flow responses resolve the latest revision per project
-(see ADR 040).
+revision, and flow responses resolve the latest revision per project.
 
 The `liquid_template` is validated lexically on save (size, encoding,
 banned patterns such as `<script>` tags, inline event handlers, and the
@@ -1354,9 +1453,9 @@ const getListBrandingUrl = (params) => {
 /**
 * Lists branding revisions for the project, newest first, capped at the
 100 most recent. The first entry is the revision flow responses
-currently resolve. Deliberately unpaginated in v1 — list endpoints
-gain a real query mechanism together (ADR 031); advertising pagination
-parameters the server ignores would be worse than none.
+currently resolve. Deliberately unpaginated in v1 — list endpoints gain a
+real query mechanism together; advertising pagination parameters the
+server ignores would be worse than none.
 
 * @summary List branding revisions
 */
@@ -1379,6 +1478,142 @@ const getBrandingById = async (id, options) => {
 		method: "GET"
 	});
 };
+const getCreateIdpUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/idps?${stringifiedParams}` : `${getProxyPath()}/idps`;
+};
+/**
+* Creates or revises a connection document. If the slug does not already
+exist, a new connection is created. If a connection with that slug already
+exists, a revision is created.
+
+A revision gets a new `revision_id` and does not modify the connection
+`id`, so identity links that reference the connection keep resolving while
+releases and auth attempts stay pinned to the revision they captured.
+
+Identity fields are fixed for the life of the connection and a revision
+that changes one is rejected: `protocol`, `subject_claim`, and the
+endpoints that name the authority (`issuer` for OIDC, `token_endpoint`
+and `userinfo_endpoint` for OAuth 2.0). Their values decide which provider
+account a stored subject belongs to, so changing one would silently
+repoint existing identities at a different provider.
+
+`subject_claim` is optional for OIDC and required for OAuth 2.0. For an
+OIDC connection, `sub` is used as the default value. If a revision updates
+`subject_claim` to a different value than the one set during creation, the
+request is rejected.
+
+The document is validated against the `idp-connection.json` schema before
+anything is stored.
+
+* @summary Create or revise an identity provider connection
+*/
+const createIdp = async (createIdpBody, params, options) => {
+	return customFetch(getCreateIdpUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createIdpBody)
+	});
+};
+const getQueryIdpsUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/idps/query?${stringifiedParams}` : `${getProxyPath()}/idps/query`;
+};
+/**
+* Returns the identity provider connections of a project, paginated with a
+cursor. One row per connection, carrying its newest revision.
+
+* @summary Query identity provider connections
+*/
+const queryIdps = async (queryIdpsBody, params, options) => {
+	return customFetch(getQueryIdpsUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(queryIdpsBody)
+	});
+};
+const getGetIdpByIdUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/idps/${id}?${stringifiedParams}` : `${getProxyPath()}/idps/${id}`;
+};
+/**
+* Reads a connection by its id, at its newest revision.
+`GET /idps/{id}/revisions` lists every revision of the connection.
+
+The lookup is scoped to the project in `project_id`.
+
+* @summary Get an identity provider connection by id
+*/
+const getIdpById = async (id, params, options) => {
+	return customFetch(getGetIdpByIdUrl(id, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getListIdpRevisionsUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/idps/${id}/revisions?${stringifiedParams}` : `${getProxyPath()}/idps/${id}/revisions`;
+};
+/**
+* Returns every revision of one connection, newest first, paginated with a
+cursor. The order is fixed, so there is no `sorting`.
+
+The lookup is scoped to the project in `project_id`.
+
+* @summary List the revisions of an identity provider connection
+*/
+const listIdpRevisions = async (id, params, options) => {
+	return customFetch(getListIdpRevisionsUrl(id, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetIdpRevisionByIdUrl = (revisionId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/idps/revisions/${revisionId}?${stringifiedParams}` : `${getProxyPath()}/idps/revisions/${revisionId}`;
+};
+/**
+* Reads one revision of a connection by its `revision_id`, the value an auth
+attempt or a release pins.
+
+The lookup is scoped to the project in `project_id`.
+
+* @summary Get one revision of an identity provider connection
+*/
+const getIdpRevisionById = async (revisionId, params, options) => {
+	return customFetch(getGetIdpRevisionByIdUrl(revisionId, params), {
+		...options,
+		method: "GET"
+	});
+};
 const getCreateReleaseUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
@@ -1478,10 +1713,23 @@ const getCreateGrantUrl = (params) => {
 /**
 * Bind a user or team to `project.viewer`, `project.editor`, or
 `project.admin` on the project identified by the `project-id` header.
-IDs are `asgn_<opaque>`. Owning-team (`project.team`) grants are not
-created here — claim owns that path. An unrevoked grant with the same
-principal and relation occupies the unique key even after `expires_at`;
-DELETE it before re-creating.
+Name the principal with `user` (`user_id` or `identifier`) or `team`
+(`team_id` or `name`). IDs are `asgn_<opaque>`. Owning-team
+(`project.team`) grants are not created here — claim owns that path. An
+unrevoked grant with the same principal and relation occupies the unique
+key even after `expires_at`; DELETE it before re-creating.
+Create does not accept `expand`. The `user_id` and team locators
+return 201, whose `user` / `team` carry only `user_id` / `team_id`,
+and still 404 / 409 when the principal is missing or the tuple
+already exists. Creating by `user.identifier` answers 202 with no
+body on every outcome. Granting the session caller's own user is
+`grant.invalid` on either user locator. Read the grant back for
+identifier and display.
+
+Accepts either a project secret (`oauth2`) or a user-bound Console
+session cookie (`nextgenSession`). Session callers are authorized as
+the human against the target project (home may differ). CSRF/Origin
+for cookie mutations is a follow-up (#1140).
 
 * @summary Create grant
 */
@@ -1496,6 +1744,45 @@ const createGrant = async (createGrantBody, params, options) => {
 		body: JSON.stringify(createGrantBody)
 	});
 };
+const getQueryGrantsUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/grants/query?${stringifiedParams}` : `${getProxyPath()}/grants/query`;
+};
+/**
+* Returns the collaboration grants of a project, paginated with a cursor.
+Only unrevoked grants this API manages are listed (user or team bound to
+viewer, editor, or admin), including expired grants so a client can
+DELETE before re-granting. Project-secret setup (`sk_proj`) and
+owning-team (`relation=team`) rows are not returned. Grants are not in
+`resource_scope_index`; project scope is required on the query (same as
+get). Requires `project.read`. `expand: ["principal"]` adds envelope
+fields on `user` / `team` and additionally requires `user.read` and
+`team.read` for project secrets (documented on the expand enum; those
+scopes cannot be ANDed onto this security block because they are
+body-conditional). A user-bound Console session that already passed
+the project Check may expand without those scopes.
+
+Accepts either a project secret (`oauth2`) or a user-bound Console
+session cookie (`nextgenSession`). CSRF/Origin for cookie mutations
+is a follow-up (#1140).
+
+* @summary Query grants
+*/
+const queryGrants = async (queryGrantsBody, params, options) => {
+	return customFetch(getQueryGrantsUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(queryGrantsBody)
+	});
+};
 const getGetGrantUrl = (id, params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
@@ -1513,6 +1800,14 @@ still ignores expired grants. Grants are not registered in
 `resource_scope_index`; project scope is required on the query (same as
 events). Misses, revoked rows, project-secret setup (`sk_proj`),
 owning-team (`relation=team`) rows, and cross-project ids return 404.
+`expand=principal` adds envelope fields on `user` or `team` and requires
+`user.read` and `team.read` in addition to `project.read` for project
+secrets. A user-bound Console session that already passed the project
+Check may expand without those scopes.
+
+Accepts either a project secret (`oauth2`) or a user-bound Console
+session cookie (`nextgenSession`). CSRF/Origin for cookie mutations
+is a follow-up (#1140).
 
 * @summary Get grant
 */
@@ -1536,6 +1831,10 @@ Already-revoked, missing, project-secret setup, and owning-team grants
 return 404. The row is not un-revoked. Expired grants can still be
 revoked so the unique binding can be reused.
 
+Accepts either a project secret (`oauth2`) or a user-bound Console
+session cookie (`nextgenSession`). CSRF/Origin for cookie mutations
+is a follow-up (#1140).
+
 * @summary Revoke grant
 */
 const deleteGrant = async (id, params, options) => {
@@ -1602,6 +1901,122 @@ const getEvent = async (id, params, options) => {
 		method: "GET"
 	});
 };
+const getGetVariablesUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/variables?${stringifiedParams}` : `${getProxyPath()}/variables`;
+};
+/**
+* Returns the variables entered at the owner this request addresses, keyed by
+name — one environment of the project with `environment_name`, the project
+level itself without it.
+
+Owners are separate, not a ladder: an environment does not inherit the
+project's variables and the project does not see its environments'. Reading
+everything a project holds therefore means reading each owner in turn.
+
+Secret values are not returned. A secret appears as `{"secret": true}`,
+which says a value is held without disclosing it.
+
+* @summary Get variables
+*/
+const getVariables = async (params, options) => {
+	return customFetch(getGetVariablesUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getUpdateVariablesUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/variables?${stringifiedParams}` : `${getProxyPath()}/variables`;
+};
+/**
+* Enters, replaces and removes variables at the owner this request
+addresses.
+
+Every name in the body is applied at exactly that owner — the project, or
+the environment named by `environment_name` — and reaches no other. Names
+not in the body are untouched.
+
+A bare scalar enters a non-secret value. `{"value": …, "secret": true}`
+stores the value encrypted under the project's active `secret` key, after
+which it can be referenced but not read back. `null` removes the name from
+this owner (RFC 7386), which is how several variables are removed in one
+request; removing a name this owner does not hold is a no-op rather than an
+error.
+
+The body is applied whole or not at all, so a rejected request leaves the
+owner exactly as it was. Writing the same name and owner twice replaces the
+value rather than duplicating it, which makes a retry safe.
+
+* @summary Update variables
+*/
+const updateVariables = async (updateVariablesBody, params, options) => {
+	return customFetch(getUpdateVariablesUrl(params), {
+		...options,
+		method: "PATCH",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(updateVariablesBody)
+	});
+};
+const getGetVariableUrl = (variableName, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/variables/${variableName}?${stringifiedParams}` : `${getProxyPath()}/variables/${variableName}`;
+};
+/**
+* Reads one variable by name from the owner this request addresses — one
+environment of the project with `environment_name`, the project level
+itself without it.
+
+A name that owner has not entered answers `var.not_found`, even when
+another owner of the same project holds it: nothing is inherited. A secret
+is found but not disclosed: the response is `{"secret": true}`.
+
+* @summary Get a variable
+*/
+const getVariable = async (variableName, params, options) => {
+	return customFetch(getGetVariableUrl(variableName, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getDeleteVariableUrl = (variableName, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/variables/${variableName}?${stringifiedParams}` : `${getProxyPath()}/variables/${variableName}`;
+};
+/**
+* Removes the variable this owner entered under this name.
+
+A variable is deletable only by the owner that entered it. Deleting a name
+another owner of the same project holds answers `var.not_found` and leaves
+that owner's value standing.
+
+* @summary Delete a variable
+*/
+const deleteVariable = async (variableName, params, options) => {
+	return customFetch(getDeleteVariableUrl(variableName, params), {
+		...options,
+		method: "DELETE"
+	});
+};
 //#endregion
 //#region ../api/dist/runtime/api-factory.mjs
 /**
@@ -1645,7 +2060,7 @@ function createZitadelClient(opts) {
 	} });
 }
 //#endregion
-//#region ../config/dist/defaults-DPq0o3iU.mjs
+//#region ../config/dist/defaults-DV6hY2KT.mjs
 var default_human_user_default = {
 	title: "DefaultHumanUserSchema",
 	$schema: "https://json-schema.org/draft/2020-12/schema",
@@ -1681,29 +2096,19 @@ var default_login_default = {
 		{
 			"name": "identifier",
 			"fields": ["email"],
-			"actions": [
-				{
-					"name": "submit",
-					"kind": "submit",
-					"primary": true,
-					"text_key": "identifier.action.continue"
-				},
-				{
-					"name": "passkey",
-					"kind": "passkey",
-					"primary": false,
-					"text_key": "identifier.action.passkey"
-				},
-				{
-					"name": "register",
-					"kind": "navigate",
-					"primary": false,
-					"text_key": "identifier.action.register.link"
-				}
-			],
+			"actions": [{
+				"name": "submit",
+				"kind": "submit",
+				"primary": true,
+				"text_key": "identifier.action.continue"
+			}, {
+				"name": "register",
+				"kind": "navigate",
+				"primary": false,
+				"text_key": "identifier.action.register.link"
+			}],
 			"transitions": {
 				"submit": { "target": "password" },
-				"passkey": { "target": "done" },
 				"user_not_found": { "target": "register" },
 				"register": {
 					"target": "register",
@@ -1719,43 +2124,25 @@ var default_login_default = {
 				"kind": "submit",
 				"primary": true,
 				"text_key": "password.action.signin"
-			}, {
-				"name": "passkey",
-				"kind": "passkey",
-				"primary": false,
-				"text_key": "password.action.passkey"
 			}],
-			"transitions": {
-				"submit": { "target": "done" },
-				"passkey": { "target": "done" }
-			}
+			"transitions": { "submit": { "target": "done" } }
 		},
 		{
 			"name": "register",
 			"fields": ["email"],
-			"actions": [
-				{
-					"name": "submit",
-					"kind": "submit",
-					"primary": true,
-					"text_key": "register.action.password"
-				},
-				{
-					"name": "passkey_register",
-					"kind": "passkey_register",
-					"primary": false,
-					"text_key": "register.action.passkey"
-				},
-				{
-					"name": "sign_in",
-					"kind": "navigate",
-					"primary": false,
-					"text_key": "register.action.sign_in.link"
-				}
-			],
+			"actions": [{
+				"name": "submit",
+				"kind": "submit",
+				"primary": true,
+				"text_key": "register.action.password"
+			}, {
+				"name": "sign_in",
+				"kind": "navigate",
+				"primary": false,
+				"text_key": "register.action.sign_in.link"
+			}],
 			"transitions": {
 				"submit": { "target": "register-password" },
-				"passkey_register": { "target": "done" },
 				"user_already_exists": { "target": "password" },
 				"sign_in": {
 					"target": "identifier",
@@ -2655,4 +3042,4 @@ Object.defineProperty(exports, "startLocalZitadel", {
 	}
 });
 
-//# sourceMappingURL=src-DtCJTEId.cjs.map
+//# sourceMappingURL=src-CFX_ayWr.cjs.map