@faable/auth-sdk 2.5.76 → 2.5.78

package/dist/api/types.d.ts

@@ -220,6 +220,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/flow/identify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Leave the identifier-first screen
+         * @description Records the identifier the user typed on the hosted `/flow/identify` screen and advances the login to the method chooser. `state` is the id the screen was opened with; it stays valid, so the chooser is reached with the same `?state=`.
+         */
+        post: operations["flow/identify"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/client": {
         parameters: {
             query?: never;
@@ -484,6 +504,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/user/{user_id}/passkey-prompt/reset": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Reset a user's passkey offer counter
+         * @description The post-login "create a passkey" offer stops after `login_methods.passkey_promotion_max_prompts` times and snoozes between them. This clears both, so the user is offered a passkey again on their next login — for "why does it keep asking" and "please ask me again" alike.
+         */
+        post: operations["user/resetPasskeyPrompt"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/identity": {
         parameters: {
             query?: never;
@@ -1100,6 +1140,175 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/loginflow/resolved": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * The graph this account (or client) runs right now
+         * @description What a login actually walks: the published graph of the bound flow, or the graph compiled from the settings when nothing is bound or published. With `client_id`, resolved for that client (its own flow, else the account's, else compiled from its overrides). The bound flow, if any, comes along with its draft so an editor can show both.
+         */
+        get: operations["loginflow/resolved"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/loginflow/materialize": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start a custom flow from what runs today
+         * @description Creates a login flow whose draft is the graph the account (or, with `client_id`, that client) currently runs — compiled from its settings — and binds it. Nothing changes for logins until the flow is published: a bound flow with no published graph keeps running the compiled one. Never a blank canvas: customising always starts from the tenant's own behaviour.
+         */
+        post: operations["loginflow/materialize"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/loginflow/{loginflow_id}/validate": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Check a draft against the rules a publish enforces */
+        post: operations["loginflow/validate"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/loginflow/{loginflow_id}/publish": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Make the draft the graph logins run
+         * @description Validates the draft and freezes it as `published` under its current revision; the previous published graph moves to `history`. Logins already in flight keep the revision they started on. Refused with the list of issues when the draft does not validate.
+         */
+        post: operations["loginflow/publish"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/loginflow/{loginflow_id}/rollback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Run a previously published revision again
+         * @description Makes the named revision from `history` the published graph; the one being replaced moves to `history`. The draft is not touched.
+         */
+        post: operations["loginflow/rollback"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/loginflow/{loginflow_id}/preview-token": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Try the draft on a real login, in your browser only
+         * @description Returns a short-lived token. Open `/authorize?…&flow_preview=<token>` (or the hosted login with the same parameter) and that login runs the DRAFT of this flow instead of what is published, for that browser only. Nothing is published.
+         */
+        post: operations["loginflow/previewToken"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/loginflow": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List Loginflows
+         * @description List Loginflows
+         */
+        get: operations["loginflow/list"];
+        put?: never;
+        /**
+         * Create Loginflow
+         * @description Create Loginflow
+         */
+        post: operations["loginflow/create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/loginflow/{loginflow_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get Loginflow
+         * @description Get Loginflow
+         */
+        get: operations["loginflow/get"];
+        put?: never;
+        /**
+         * Update Loginflow
+         * @description Update Loginflow
+         */
+        post: operations["loginflow/update"];
+        /**
+         * Delete Loginflow
+         * @description Delete Loginflow
+         */
+        delete: operations["loginflow/delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/notificationsubscription": {
         parameters: {
             query?: never;
@@ -1789,6 +1998,54 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/passkey/offer/skip": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Decline the post-login passkey offer
+         * @description Finishes a login the passkey offer parked without registering anything. `dismissed` is the user saying "not now" (starts the snooze); `unsupported` is the screen finding the browser cannot do WebAuthn (the prompt is given back); `failed` is a registration that errored. Returns where the login was going.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        state: string;
+                        reason: "dismissed" | "unsupported" | "failed";
+                    };
+                };
+            };
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            redirect_url: string;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/passkey/login/options": {
         parameters: {
             query?: never;
@@ -2442,7 +2699,15 @@ export interface components {
                 identifier_first?: boolean;
                 /** @description Surface the method the returning user chose last time. Defaults to false. */
                 remember_last_method?: boolean;
-            };
+                /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                passkey_promotion?: "off" | "offer";
+                /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                passkey_promotion_snooze_days?: number;
+                /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                passkey_promotion_max_prompts?: number;
+            };
+            /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
+            login_flow?: string | null;
             /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
             mfa_policy?: {
                 /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -2722,6 +2987,12 @@ export interface components {
                 identifier_first?: boolean;
                 /** @description Surface the method the returning user chose last time. Defaults to false. */
                 remember_last_method?: boolean;
+                /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                passkey_promotion?: "off" | "offer";
+                /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                passkey_promotion_snooze_days?: number;
+                /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                passkey_promotion_max_prompts?: number;
             };
             /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
             mfa_policy?: {
@@ -2732,6 +3003,8 @@ export interface components {
                 /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                 remember_device_days?: number;
             };
+            /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
+            login_flow?: string | null;
             /** @description Object is related with this account */
             account: string;
             /**
@@ -2815,6 +3088,12 @@ export interface components {
                 identifier_first?: boolean;
                 /** @description Surface the method the returning user chose last time. Defaults to false. */
                 remember_last_method?: boolean;
+                /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                passkey_promotion?: "off" | "offer";
+                /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                passkey_promotion_snooze_days?: number;
+                /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                passkey_promotion_max_prompts?: number;
             } | null;
             mfa_policy?: {
                 /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -2824,6 +3103,7 @@ export interface components {
                 /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                 remember_device_days?: number;
             } | null;
+            login_flow?: string | null;
             /**
              * @description Free-form client metadata. Replaces the whole object — send the full merged value, not a partial delta.
              * @default {}
@@ -2872,6 +3152,12 @@ export interface components {
             email_bounced_at?: string | null;
             /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
             welcome_sent_at?: string | null;
+            /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
+            passkey_prompted_at?: string | null;
+            /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
+            passkey_prompt_count?: number;
+            /** @description ISO 8601 timestamp of the last time the user chose "Not now" on the passkey offer, as opposed to closing the tab. */
+            passkey_prompt_dismissed_at?: string | null;
             /** @description contact phone number */
             phone?: string | null;
             /** @description phone is verified */
@@ -3602,6 +3888,147 @@ export interface components {
             /** @description Execution order */
             order?: number;
         };
+        /** @description LoginFlow */
+        LoginFlow: {
+            /** @description LoginFlow ID */
+            id: string;
+            name: string;
+            /** @enum {string} */
+            trigger: "login";
+            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+            graph: {
+                nodes: {
+                    id: string;
+                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                    config?: {
+                        [key: string]: unknown;
+                    };
+                }[];
+                edges: {
+                    from: string;
+                    handle: string;
+                    to: string;
+                }[];
+            };
+            /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+            revision: number;
+            published?: {
+                /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                graph: {
+                    nodes: {
+                        id: string;
+                        type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                        config?: {
+                            [key: string]: unknown;
+                        };
+                    }[];
+                    edges: {
+                        from: string;
+                        handle: string;
+                        to: string;
+                    }[];
+                };
+                revision: number;
+                published_at: string;
+            };
+            /** @description Previously published graphs, newest first, for rollback. */
+            history: {
+                /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                graph: {
+                    nodes: {
+                        id: string;
+                        type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                        config?: {
+                            [key: string]: unknown;
+                        };
+                    }[];
+                    edges: {
+                        from: string;
+                        handle: string;
+                        to: string;
+                    }[];
+                };
+                revision: number;
+                published_at: string;
+            }[];
+            /** @description Node positions in the editor. Presentation only. */
+            layout?: {
+                [key: string]: {
+                    x: number;
+                    y: number;
+                };
+            };
+            /** @description Object is related with this account */
+            account: string;
+            /**
+             * @description LoginFlowMetadata
+             * @default {}
+             */
+            metadata: {
+                [key: string]: unknown;
+            };
+            /** @description LoginFlow creation date */
+            createdAt: string;
+            /** @description LoginFlow updated date */
+            updatedAt?: string;
+        };
+        /**
+         * @description LoginFlowMetadata
+         * @default {}
+         */
+        LoginFlowMetadata: {
+            [key: string]: unknown;
+        };
+        LoginFlowCreate: {
+            name: string;
+            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+            graph: {
+                nodes: {
+                    id: string;
+                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                    config?: {
+                        [key: string]: unknown;
+                    };
+                }[];
+                edges: {
+                    from: string;
+                    handle: string;
+                    to: string;
+                }[];
+            };
+            /** @description Node positions in the editor. Presentation only. */
+            layout?: {
+                [key: string]: {
+                    x: number;
+                    y: number;
+                };
+            };
+        };
+        LoginFlowUpdate: {
+            name?: string;
+            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+            graph?: {
+                nodes: {
+                    id: string;
+                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                    config?: {
+                        [key: string]: unknown;
+                    };
+                }[];
+                edges: {
+                    from: string;
+                    handle: string;
+                    to: string;
+                }[];
+            };
+            /** @description Node positions in the editor. Presentation only. */
+            layout?: {
+                [key: string]: {
+                    x: number;
+                    y: number;
+                };
+            };
+        };
         /** @description NotificationSubscription */
         NotificationSubscription: {
             /** @description NotificationSubscriptionEmail ID */
@@ -4089,6 +4516,12 @@ export interface components {
                 identifier_first?: boolean;
                 /** @description Surface the method the returning user chose last time. Defaults to false. */
                 remember_last_method?: boolean;
+                /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                passkey_promotion?: "off" | "offer";
+                /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                passkey_promotion_snooze_days?: number;
+                /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                passkey_promotion_max_prompts?: number;
             } | null;
             mfa_policy?: {
                 /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -4099,6 +4532,7 @@ export interface components {
                 remember_device_days?: number;
             } | null;
             webauthn_rp_id?: string | null;
+            login_flow?: string | null;
         };
         FactorSummary: {
             id: string;
@@ -4249,7 +4683,15 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
-                        };
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
+                        };
+                        /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
+                        login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -4387,7 +4829,15 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
-                        };
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
+                        };
+                        /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
+                        login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -4479,7 +4929,15 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
-                        };
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
+                        };
+                        /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
+                        login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -4543,6 +5001,12 @@ export interface operations {
                         identifier_first?: boolean;
                         /** @description Surface the method the returning user chose last time. Defaults to false. */
                         remember_last_method?: boolean;
+                        /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                        passkey_promotion?: "off" | "offer";
+                        /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                        passkey_promotion_snooze_days?: number;
+                        /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                        passkey_promotion_max_prompts?: number;
                     } | null;
                     mfa_policy?: {
                         /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -4553,6 +5017,7 @@ export interface operations {
                         remember_device_days?: number;
                     } | null;
                     webauthn_rp_id?: string | null;
+                    login_flow?: string | null;
                 };
             };
         };
@@ -4614,7 +5079,15 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
-                        };
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
+                        };
+                        /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
+                        login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -4715,7 +5188,15 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
-                        };
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
+                        };
+                        /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
+                        login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -5231,6 +5712,10 @@ export interface operations {
         parameters: {
             query?: {
                 client_id?: string;
+                /** @description The login state the screen was opened with. When the flow put an identifier-first screen before this one, the identifier the user typed comes back as `identifier`. */
+                state?: string;
+                /** @description The method key (`passkey` or a connection id) this browser used last time, as remembered by the hosted UI. Honoured only when the tenant enabled `remember_last_method`: that method is moved first and echoed as `last_used`. */
+                last_used?: string;
             };
             header?: never;
             path?: never;
@@ -5259,6 +5744,10 @@ export interface operations {
                         } | null;
                         identifier_first: boolean;
                         remember_last_method: boolean;
+                        /** @description What the user typed on the identifier-first screen, when the flow has one. Prefill the email field with it. */
+                        identifier?: string;
+                        /** @description The method key that was moved first because this browser used it last time (`remember_last_method`). Absent otherwise. */
+                        last_used?: string;
                         /** @description Already filtered and ordered. Render them in this order; do not re-sort or re-filter client-side. */
                         methods: components["schemas"]["LoginOptionMethod"][];
                     };
@@ -5266,6 +5755,35 @@ export interface operations {
             };
         };
     };
+    "flow/identify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    state: string;
+                    identifier: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ok: boolean;
+                    };
+                };
+            };
+        };
+    };
     "client/list": {
         parameters: {
             query?: {
@@ -5376,6 +5894,12 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
                         };
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
@@ -5386,6 +5910,8 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
+                        login_flow?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -5467,6 +5993,12 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
                         };
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
@@ -5477,6 +6009,8 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
+                        login_flow?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -5552,6 +6086,12 @@ export interface operations {
                         identifier_first?: boolean;
                         /** @description Surface the method the returning user chose last time. Defaults to false. */
                         remember_last_method?: boolean;
+                        /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                        passkey_promotion?: "off" | "offer";
+                        /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                        passkey_promotion_snooze_days?: number;
+                        /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                        passkey_promotion_max_prompts?: number;
                     } | null;
                     mfa_policy?: {
                         /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -5561,6 +6101,7 @@ export interface operations {
                         /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                         remember_device_days?: number;
                     } | null;
+                    login_flow?: string | null;
                     /**
                      * @description Free-form client metadata. Replaces the whole object — send the full merged value, not a partial delta.
                      * @default {}
@@ -5624,6 +6165,12 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
                         };
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
@@ -5634,6 +6181,8 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
+                        login_flow?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -5715,6 +6264,12 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
                         };
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
@@ -5725,6 +6280,8 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
+                        login_flow?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -5806,6 +6363,12 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
                         };
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
@@ -5816,6 +6379,8 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
+                        login_flow?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -5961,6 +6526,12 @@ export interface operations {
                         email_bounced_at?: string | null;
                         /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
                         welcome_sent_at?: string | null;
+                        /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
+                        passkey_prompted_at?: string | null;
+                        /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
+                        passkey_prompt_count?: number;
+                        /** @description ISO 8601 timestamp of the last time the user chose "Not now" on the passkey offer, as opposed to closing the tab. */
+                        passkey_prompt_dismissed_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -6095,6 +6666,12 @@ export interface operations {
                         email_bounced_at?: string | null;
                         /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
                         welcome_sent_at?: string | null;
+                        /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
+                        passkey_prompted_at?: string | null;
+                        /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
+                        passkey_prompt_count?: number;
+                        /** @description ISO 8601 timestamp of the last time the user chose "Not now" on the passkey offer, as opposed to closing the tab. */
+                        passkey_prompt_dismissed_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -6269,6 +6846,12 @@ export interface operations {
                         email_bounced_at?: string | null;
                         /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
                         welcome_sent_at?: string | null;
+                        /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
+                        passkey_prompted_at?: string | null;
+                        /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
+                        passkey_prompt_count?: number;
+                        /** @description ISO 8601 timestamp of the last time the user chose "Not now" on the passkey offer, as opposed to closing the tab. */
+                        passkey_prompt_dismissed_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -6403,6 +6986,12 @@ export interface operations {
                         email_bounced_at?: string | null;
                         /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
                         welcome_sent_at?: string | null;
+                        /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
+                        passkey_prompted_at?: string | null;
+                        /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
+                        passkey_prompt_count?: number;
+                        /** @description ISO 8601 timestamp of the last time the user chose "Not now" on the passkey offer, as opposed to closing the tab. */
+                        passkey_prompt_dismissed_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -6681,6 +7270,30 @@ export interface operations {
             };
         };
     };
+    "user/resetPasskeyPrompt": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        reset: boolean;
+                    };
+                };
+            };
+        };
+    };
     "identity/list": {
         parameters: {
             query?: {
@@ -9246,6 +9859,986 @@ export interface operations {
             };
         };
     };
+    "loginflow/resolved": {
+        parameters: {
+            query?: {
+                client_id?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        source: "compiled" | "published";
+                        flow_id: string | null;
+                        revision: number;
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        bound: {
+                            flow_id: string;
+                            bound_to: "account" | "client";
+                            name: string;
+                            revision: number;
+                            published_revision: number | null;
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            draft: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            /** @description Node positions in the editor. Presentation only. */
+                            layout?: {
+                                [key: string]: {
+                                    x: number;
+                                    y: number;
+                                };
+                            };
+                            history: number[];
+                        } | null;
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/materialize": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    client_id?: string;
+                    name?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description LoginFlow */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description LoginFlow ID */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        trigger: "login";
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+                        revision: number;
+                        published?: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        };
+                        /** @description Previously published graphs, newest first, for rollback. */
+                        history: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        }[];
+                        /** @description Node positions in the editor. Presentation only. */
+                        layout?: {
+                            [key: string]: {
+                                x: number;
+                                y: number;
+                            };
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description LoginFlowMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description LoginFlow creation date */
+                        createdAt: string;
+                        /** @description LoginFlow updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/validate": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                loginflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    client_id?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ok: boolean;
+                        issues: {
+                            code: string;
+                            node?: string;
+                            handle?: string;
+                            message: string;
+                        }[];
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/publish": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                loginflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    client_id?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description LoginFlow */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description LoginFlow ID */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        trigger: "login";
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+                        revision: number;
+                        published?: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        };
+                        /** @description Previously published graphs, newest first, for rollback. */
+                        history: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        }[];
+                        /** @description Node positions in the editor. Presentation only. */
+                        layout?: {
+                            [key: string]: {
+                                x: number;
+                                y: number;
+                            };
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description LoginFlowMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description LoginFlow creation date */
+                        createdAt: string;
+                        /** @description LoginFlow updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /** @description Default Response */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        error: string;
+                        issues: {
+                            code: string;
+                            node?: string;
+                            handle?: string;
+                            message: string;
+                        }[];
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/rollback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                loginflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    revision: number;
+                };
+            };
+        };
+        responses: {
+            /** @description LoginFlow */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description LoginFlow ID */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        trigger: "login";
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+                        revision: number;
+                        published?: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        };
+                        /** @description Previously published graphs, newest first, for rollback. */
+                        history: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        }[];
+                        /** @description Node positions in the editor. Presentation only. */
+                        layout?: {
+                            [key: string]: {
+                                x: number;
+                                y: number;
+                            };
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description LoginFlowMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description LoginFlow creation date */
+                        createdAt: string;
+                        /** @description LoginFlow updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/previewToken": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                loginflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        token: string;
+                        expires_in: number;
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/list": {
+        parameters: {
+            query?: {
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
+                cursor?: string;
+                /** @description Cursor returned by the previous page */
+                next?: string;
+                /** @description Filter using a FaableQL query */
+                query?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        next: string | null;
+                        results: components["schemas"]["LoginFlow"][];
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/create": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    name: string;
+                    /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                    graph: {
+                        nodes: {
+                            id: string;
+                            type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                            config?: {
+                                [key: string]: unknown;
+                            };
+                        }[];
+                        edges: {
+                            from: string;
+                            handle: string;
+                            to: string;
+                        }[];
+                    };
+                    /** @description Node positions in the editor. Presentation only. */
+                    layout?: {
+                        [key: string]: {
+                            x: number;
+                            y: number;
+                        };
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description LoginFlow */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description LoginFlow ID */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        trigger: "login";
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+                        revision: number;
+                        published?: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        };
+                        /** @description Previously published graphs, newest first, for rollback. */
+                        history: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        }[];
+                        /** @description Node positions in the editor. Presentation only. */
+                        layout?: {
+                            [key: string]: {
+                                x: number;
+                                y: number;
+                            };
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description LoginFlowMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description LoginFlow creation date */
+                        createdAt: string;
+                        /** @description LoginFlow updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/get": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                loginflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description LoginFlow */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description LoginFlow ID */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        trigger: "login";
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+                        revision: number;
+                        published?: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        };
+                        /** @description Previously published graphs, newest first, for rollback. */
+                        history: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        }[];
+                        /** @description Node positions in the editor. Presentation only. */
+                        layout?: {
+                            [key: string]: {
+                                x: number;
+                                y: number;
+                            };
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description LoginFlowMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description LoginFlow creation date */
+                        createdAt: string;
+                        /** @description LoginFlow updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                loginflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    name?: string;
+                    /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                    graph?: {
+                        nodes: {
+                            id: string;
+                            type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                            config?: {
+                                [key: string]: unknown;
+                            };
+                        }[];
+                        edges: {
+                            from: string;
+                            handle: string;
+                            to: string;
+                        }[];
+                    };
+                    /** @description Node positions in the editor. Presentation only. */
+                    layout?: {
+                        [key: string]: {
+                            x: number;
+                            y: number;
+                        };
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description LoginFlow */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description LoginFlow ID */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        trigger: "login";
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+                        revision: number;
+                        published?: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        };
+                        /** @description Previously published graphs, newest first, for rollback. */
+                        history: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        }[];
+                        /** @description Node positions in the editor. Presentation only. */
+                        layout?: {
+                            [key: string]: {
+                                x: number;
+                                y: number;
+                            };
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description LoginFlowMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description LoginFlow creation date */
+                        createdAt: string;
+                        /** @description LoginFlow updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/delete": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                loginflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description LoginFlow */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description LoginFlow ID */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        trigger: "login";
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+                        revision: number;
+                        published?: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        };
+                        /** @description Previously published graphs, newest first, for rollback. */
+                        history: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        }[];
+                        /** @description Node positions in the editor. Presentation only. */
+                        layout?: {
+                            [key: string]: {
+                                x: number;
+                                y: number;
+                            };
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description LoginFlowMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description LoginFlow creation date */
+                        createdAt: string;
+                        /** @description LoginFlow updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
     "notificationsubscription/list": {
         parameters: {
             query?: {
@@ -10154,6 +11747,12 @@ export interface operations {
                         email_bounced_at?: string | null;
                         /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
                         welcome_sent_at?: string | null;
+                        /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
+                        passkey_prompted_at?: string | null;
+                        /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
+                        passkey_prompt_count?: number;
+                        /** @description ISO 8601 timestamp of the last time the user chose "Not now" on the passkey offer, as opposed to closing the tab. */
+                        passkey_prompt_dismissed_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -10288,6 +11887,8 @@ export interface operations {
                 connection_scope?: string;
                 /** @description Link mode: attach the resulting provider identity to the ACTIVE session user instead of signing in or up. Requires a session; incompatible with prompt=login/consent. */
                 link?: boolean;
+                /** @description Preview token from `POST /loginflow/:id/preview-token`. This login runs the DRAFT of that flow, for this browser only; nothing is published. Invalid or expired tokens are ignored. */
+                flow_preview?: string;
                 /** @description Single-use ticket from `POST /oauth/link_ticket`. With `link=true`, establishes the cookie session for the ticket’s user before linking — for Relying Parties that hold tokens but no cookie session (direct grants such as passwordless OTP). Invalid or expired tickets are ignored. */
                 link_ticket?: string;
                 client_id: string;