@faable/auth-sdk 2.5.77 → 2.5.79

package/dist/api/types.d.ts

@@ -220,6 +220,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/login/identify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Leave the identifier-first screen
+         * @description Records the identifier the user typed on the hosted `/flow/identify` screen and advances the login to the method chooser. `state` is the id the screen was opened with; it stays valid, so the chooser is reached with the same `?state=`.
+         */
+        post: operations["login/identify"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/client": {
         parameters: {
             query?: never;
@@ -484,6 +504,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/user/{user_id}/passkey-prompt/reset": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Reset a user's passkey offer counter
+         * @description The post-login "create a passkey" offer stops after `login_methods.passkey_promotion_max_prompts` times and snoozes between them. This clears both, so the user is offered a passkey again on their next login — for "why does it keep asking" and "please ask me again" alike.
+         */
+        post: operations["user/resetPasskeyPrompt"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/identity": {
         parameters: {
             query?: never;
@@ -1100,6 +1140,175 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/loginflow/resolved": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * The graph this account (or client) runs right now
+         * @description What a login actually walks: the published graph of the bound flow, or the graph compiled from the settings when nothing is bound or published. With `client_id`, resolved for that client (its own flow, else the account's, else compiled from its overrides). The bound flow, if any, comes along with its draft so an editor can show both.
+         */
+        get: operations["loginflow/resolved"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/loginflow/materialize": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start a custom flow from what runs today
+         * @description Creates a login flow whose draft is the graph the account (or, with `client_id`, that client) currently runs — compiled from its settings — and binds it. Nothing changes for logins until the flow is published: a bound flow with no published graph keeps running the compiled one. Never a blank canvas: customising always starts from the tenant's own behaviour.
+         */
+        post: operations["loginflow/materialize"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/loginflow/{loginflow_id}/validate": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Check a draft against the rules a publish enforces */
+        post: operations["loginflow/validate"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/loginflow/{loginflow_id}/publish": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Make the draft the graph logins run
+         * @description Validates the draft and freezes it as `published` under its current revision; the previous published graph moves to `history`. Logins already in flight keep the revision they started on. Refused with the list of issues when the draft does not validate.
+         */
+        post: operations["loginflow/publish"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/loginflow/{loginflow_id}/rollback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Run a previously published revision again
+         * @description Makes the named revision from `history` the published graph; the one being replaced moves to `history`. The draft is not touched.
+         */
+        post: operations["loginflow/rollback"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/loginflow/{loginflow_id}/preview-token": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Try the draft on a real login, in your browser only
+         * @description Returns a short-lived token. Open `/authorize?…&flow_preview=<token>` (or the hosted login with the same parameter) and that login runs the DRAFT of this flow instead of what is published, for that browser only. Nothing is published.
+         */
+        post: operations["loginflow/previewToken"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/loginflow": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List Loginflows
+         * @description List Loginflows
+         */
+        get: operations["loginflow/list"];
+        put?: never;
+        /**
+         * Create Loginflow
+         * @description Create Loginflow
+         */
+        post: operations["loginflow/create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/loginflow/{loginflow_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get Loginflow
+         * @description Get Loginflow
+         */
+        get: operations["loginflow/get"];
+        put?: never;
+        /**
+         * Update Loginflow
+         * @description Update Loginflow
+         */
+        post: operations["loginflow/update"];
+        /**
+         * Delete Loginflow
+         * @description Delete Loginflow
+         */
+        delete: operations["loginflow/delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/notificationsubscription": {
         parameters: {
             query?: never;
@@ -1320,6 +1529,54 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/mfa/challenge/options": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * What the second-factor screen should offer
+         * @description For a login parked on the hosted challenge screen: which factors the user can answer with, in the order and with the default the login flow chose, and whether recovery codes are an option. Reads the state without consuming it.
+         */
+        get: {
+            parameters: {
+                query: {
+                    state: string;
+                };
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @description The ways this user can answer, in the order the screen should offer them. Only factors the user actually has and the policy accepts. */
+                            factors: ("totp" | "webauthn")[];
+                            /** @description The one to mark as the default, when there are several. */
+                            preferred?: "totp" | "webauthn";
+                            /** @description Whether to offer the recovery-code way in: the flow allows it and the user has codes. */
+                            recovery: boolean;
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/mfa/verify": {
         parameters: {
             query?: never;
@@ -1789,6 +2046,54 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/passkey/offer/skip": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Decline the post-login passkey offer
+         * @description Finishes a login the passkey offer parked without registering anything. `dismissed` is the user saying "not now" (starts the snooze); `unsupported` is the screen finding the browser cannot do WebAuthn (the prompt is given back); `failed` is a registration that errored. Returns where the login was going.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        state: string;
+                        reason: "dismissed" | "unsupported" | "failed";
+                    };
+                };
+            };
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            redirect_url: string;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/passkey/login/options": {
         parameters: {
             query?: never;
@@ -1866,6 +2171,8 @@ export interface paths {
                         client_id: string;
                         redirect_to?: string;
                         state?: string;
+                        /** @description The "Remember me on this device" checkbox. Honoured only when the tenant shows one (`login_methods.remember_me: "optional"`). */
+                        remember_me?: boolean;
                     };
                 };
             };
@@ -2442,7 +2749,19 @@ export interface components {
                 identifier_first?: boolean;
                 /** @description Surface the method the returning user chose last time. Defaults to false. */
                 remember_last_method?: boolean;
-            };
+                /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                passkey_promotion?: "off" | "offer";
+                /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                passkey_promotion_snooze_days?: number;
+                /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                passkey_promotion_max_prompts?: number;
+                /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                remember_me?: "off" | "optional";
+                /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                remember_me_days?: number;
+            };
+            /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
+            login_flow?: string | null;
             /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
             mfa_policy?: {
                 /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -2722,6 +3041,16 @@ export interface components {
                 identifier_first?: boolean;
                 /** @description Surface the method the returning user chose last time. Defaults to false. */
                 remember_last_method?: boolean;
+                /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                passkey_promotion?: "off" | "offer";
+                /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                passkey_promotion_snooze_days?: number;
+                /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                passkey_promotion_max_prompts?: number;
+                /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                remember_me?: "off" | "optional";
+                /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                remember_me_days?: number;
             };
             /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
             mfa_policy?: {
@@ -2732,6 +3061,8 @@ export interface components {
                 /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                 remember_device_days?: number;
             };
+            /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
+            login_flow?: string | null;
             /** @description Object is related with this account */
             account: string;
             /**
@@ -2815,6 +3146,16 @@ export interface components {
                 identifier_first?: boolean;
                 /** @description Surface the method the returning user chose last time. Defaults to false. */
                 remember_last_method?: boolean;
+                /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                passkey_promotion?: "off" | "offer";
+                /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                passkey_promotion_snooze_days?: number;
+                /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                passkey_promotion_max_prompts?: number;
+                /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                remember_me?: "off" | "optional";
+                /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                remember_me_days?: number;
             } | null;
             mfa_policy?: {
                 /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -2824,6 +3165,7 @@ export interface components {
                 /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                 remember_device_days?: number;
             } | null;
+            login_flow?: string | null;
             /**
              * @description Free-form client metadata. Replaces the whole object — send the full merged value, not a partial delta.
              * @default {}
@@ -2872,6 +3214,12 @@ export interface components {
             email_bounced_at?: string | null;
             /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
             welcome_sent_at?: string | null;
+            /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
+            passkey_prompted_at?: string | null;
+            /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
+            passkey_prompt_count?: number;
+            /** @description ISO 8601 timestamp of the last time the user chose "Not now" on the passkey offer, as opposed to closing the tab. */
+            passkey_prompt_dismissed_at?: string | null;
             /** @description contact phone number */
             phone?: string | null;
             /** @description phone is verified */
@@ -3602,19 +3950,160 @@ export interface components {
             /** @description Execution order */
             order?: number;
         };
-        /** @description NotificationSubscription */
-        NotificationSubscription: {
-            /** @description NotificationSubscriptionEmail ID */
+        /** @description LoginFlow */
+        LoginFlow: {
+            /** @description LoginFlow ID */
             id: string;
-            events: string[];
+            name: string;
             /** @enum {string} */
-            channel: "email";
-            /** @description Whether the subscription is active */
-            active: boolean;
-            config: {
-                recipients: string[];
-            };
-            /** @description Object is related with this account */
+            trigger: "login";
+            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+            graph: {
+                nodes: {
+                    id: string;
+                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                    config?: {
+                        [key: string]: unknown;
+                    };
+                }[];
+                edges: {
+                    from: string;
+                    handle: string;
+                    to: string;
+                }[];
+            };
+            /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+            revision: number;
+            published?: {
+                /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                graph: {
+                    nodes: {
+                        id: string;
+                        type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                        config?: {
+                            [key: string]: unknown;
+                        };
+                    }[];
+                    edges: {
+                        from: string;
+                        handle: string;
+                        to: string;
+                    }[];
+                };
+                revision: number;
+                published_at: string;
+            };
+            /** @description Previously published graphs, newest first, for rollback. */
+            history: {
+                /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                graph: {
+                    nodes: {
+                        id: string;
+                        type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                        config?: {
+                            [key: string]: unknown;
+                        };
+                    }[];
+                    edges: {
+                        from: string;
+                        handle: string;
+                        to: string;
+                    }[];
+                };
+                revision: number;
+                published_at: string;
+            }[];
+            /** @description Node positions in the editor. Presentation only. */
+            layout?: {
+                [key: string]: {
+                    x: number;
+                    y: number;
+                };
+            };
+            /** @description Object is related with this account */
+            account: string;
+            /**
+             * @description LoginFlowMetadata
+             * @default {}
+             */
+            metadata: {
+                [key: string]: unknown;
+            };
+            /** @description LoginFlow creation date */
+            createdAt: string;
+            /** @description LoginFlow updated date */
+            updatedAt?: string;
+        };
+        /**
+         * @description LoginFlowMetadata
+         * @default {}
+         */
+        LoginFlowMetadata: {
+            [key: string]: unknown;
+        };
+        LoginFlowCreate: {
+            name: string;
+            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+            graph: {
+                nodes: {
+                    id: string;
+                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                    config?: {
+                        [key: string]: unknown;
+                    };
+                }[];
+                edges: {
+                    from: string;
+                    handle: string;
+                    to: string;
+                }[];
+            };
+            /** @description Node positions in the editor. Presentation only. */
+            layout?: {
+                [key: string]: {
+                    x: number;
+                    y: number;
+                };
+            };
+        };
+        LoginFlowUpdate: {
+            name?: string;
+            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+            graph?: {
+                nodes: {
+                    id: string;
+                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                    config?: {
+                        [key: string]: unknown;
+                    };
+                }[];
+                edges: {
+                    from: string;
+                    handle: string;
+                    to: string;
+                }[];
+            };
+            /** @description Node positions in the editor. Presentation only. */
+            layout?: {
+                [key: string]: {
+                    x: number;
+                    y: number;
+                };
+            };
+        };
+        /** @description NotificationSubscription */
+        NotificationSubscription: {
+            /** @description NotificationSubscriptionEmail ID */
+            id: string;
+            events: string[];
+            /** @enum {string} */
+            channel: "email";
+            /** @description Whether the subscription is active */
+            active: boolean;
+            config: {
+                recipients: string[];
+            };
+            /** @description Object is related with this account */
             account: string;
             /**
              * @description NotificationSubscriptionEmailMetadata
@@ -4089,6 +4578,16 @@ export interface components {
                 identifier_first?: boolean;
                 /** @description Surface the method the returning user chose last time. Defaults to false. */
                 remember_last_method?: boolean;
+                /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                passkey_promotion?: "off" | "offer";
+                /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                passkey_promotion_snooze_days?: number;
+                /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                passkey_promotion_max_prompts?: number;
+                /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                remember_me?: "off" | "optional";
+                /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                remember_me_days?: number;
             } | null;
             mfa_policy?: {
                 /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -4099,6 +4598,7 @@ export interface components {
                 remember_device_days?: number;
             } | null;
             webauthn_rp_id?: string | null;
+            login_flow?: string | null;
         };
         FactorSummary: {
             id: string;
@@ -4145,6 +4645,8 @@ export interface components {
             response_type?: string;
             /** @description Same-origin path to return the user to after authentication, instead of the OAuth client redirect. Used by first-party interactive flows (e.g. device-code confirm). Non same-origin values are ignored. */
             redirect_to?: string;
+            /** @description The "Remember me on this device" checkbox. Honoured only when the tenant shows one (`login_methods.remember_me: "optional"`): `true` keeps the session for `remember_me_days`, `false` ends it when the browser closes. */
+            remember_me?: boolean;
             client_id: string;
             /** @description Deprecated. Use connection_id */
             connection?: string;
@@ -4249,7 +4751,19 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
-                        };
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
+                            /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                            remember_me?: "off" | "optional";
+                            /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                            remember_me_days?: number;
+                        };
+                        /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
+                        login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -4387,7 +4901,19 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
-                        };
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
+                            /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                            remember_me?: "off" | "optional";
+                            /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                            remember_me_days?: number;
+                        };
+                        /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
+                        login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -4479,7 +5005,19 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
-                        };
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
+                            /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                            remember_me?: "off" | "optional";
+                            /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                            remember_me_days?: number;
+                        };
+                        /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
+                        login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -4543,6 +5081,16 @@ export interface operations {
                         identifier_first?: boolean;
                         /** @description Surface the method the returning user chose last time. Defaults to false. */
                         remember_last_method?: boolean;
+                        /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                        passkey_promotion?: "off" | "offer";
+                        /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                        passkey_promotion_snooze_days?: number;
+                        /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                        passkey_promotion_max_prompts?: number;
+                        /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                        remember_me?: "off" | "optional";
+                        /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                        remember_me_days?: number;
                     } | null;
                     mfa_policy?: {
                         /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -4553,6 +5101,7 @@ export interface operations {
                         remember_device_days?: number;
                     } | null;
                     webauthn_rp_id?: string | null;
+                    login_flow?: string | null;
                 };
             };
         };
@@ -4614,7 +5163,19 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
-                        };
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
+                            /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                            remember_me?: "off" | "optional";
+                            /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                            remember_me_days?: number;
+                        };
+                        /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
+                        login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -4715,7 +5276,19 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
-                        };
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
+                            /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                            remember_me?: "off" | "optional";
+                            /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                            remember_me_days?: number;
+                        };
+                        /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
+                        login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -5231,6 +5804,10 @@ export interface operations {
         parameters: {
             query?: {
                 client_id?: string;
+                /** @description The login state the screen was opened with. When the flow put an identifier-first screen before this one, the identifier the user typed comes back as `identifier`. */
+                state?: string;
+                /** @description The method key (`passkey` or a connection id) this browser used last time, as remembered by the hosted UI. Honoured only when the tenant enabled `remember_last_method`: that method is moved first and echoed as `last_used`. */
+                last_used?: string;
             };
             header?: never;
             path?: never;
@@ -5259,6 +5836,12 @@ export interface operations {
                         } | null;
                         identifier_first: boolean;
                         remember_last_method: boolean;
+                        /** @description Render a "Remember me on this device" checkbox on the password and email-code forms, and send its value as `remember_me` when posting the credential. */
+                        remember_me: boolean;
+                        /** @description What the user typed on the identifier-first screen, when the flow has one. Prefill the email field with it. */
+                        identifier?: string;
+                        /** @description The method key that was moved first because this browser used it last time (`remember_last_method`). Absent otherwise. */
+                        last_used?: string;
                         /** @description Already filtered and ordered. Render them in this order; do not re-sort or re-filter client-side. */
                         methods: components["schemas"]["LoginOptionMethod"][];
                     };
@@ -5266,6 +5849,35 @@ export interface operations {
             };
         };
     };
+    "login/identify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    state: string;
+                    identifier: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ok: boolean;
+                    };
+                };
+            };
+        };
+    };
     "client/list": {
         parameters: {
             query?: {
@@ -5376,6 +5988,16 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
+                            /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                            remember_me?: "off" | "optional";
+                            /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                            remember_me_days?: number;
                         };
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
@@ -5386,6 +6008,8 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
+                        login_flow?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -5467,6 +6091,16 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
+                            /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                            remember_me?: "off" | "optional";
+                            /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                            remember_me_days?: number;
                         };
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
@@ -5477,6 +6111,8 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
+                        login_flow?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -5552,6 +6188,16 @@ export interface operations {
                         identifier_first?: boolean;
                         /** @description Surface the method the returning user chose last time. Defaults to false. */
                         remember_last_method?: boolean;
+                        /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                        passkey_promotion?: "off" | "offer";
+                        /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                        passkey_promotion_snooze_days?: number;
+                        /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                        passkey_promotion_max_prompts?: number;
+                        /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                        remember_me?: "off" | "optional";
+                        /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                        remember_me_days?: number;
                     } | null;
                     mfa_policy?: {
                         /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -5561,6 +6207,7 @@ export interface operations {
                         /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                         remember_device_days?: number;
                     } | null;
+                    login_flow?: string | null;
                     /**
                      * @description Free-form client metadata. Replaces the whole object — send the full merged value, not a partial delta.
                      * @default {}
@@ -5624,6 +6271,16 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
+                            /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                            remember_me?: "off" | "optional";
+                            /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                            remember_me_days?: number;
                         };
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
@@ -5634,6 +6291,8 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
+                        login_flow?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -5715,6 +6374,16 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
+                            /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                            remember_me?: "off" | "optional";
+                            /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                            remember_me_days?: number;
                         };
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
@@ -5725,6 +6394,8 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
+                        login_flow?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -5806,6 +6477,16 @@ export interface operations {
                             identifier_first?: boolean;
                             /** @description Surface the method the returning user chose last time. Defaults to false. */
                             remember_last_method?: boolean;
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
+                            /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                            remember_me?: "off" | "optional";
+                            /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                            remember_me_days?: number;
                         };
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
@@ -5816,6 +6497,8 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
+                        login_flow?: string | null;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -5961,6 +6644,12 @@ export interface operations {
                         email_bounced_at?: string | null;
                         /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
                         welcome_sent_at?: string | null;
+                        /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
+                        passkey_prompted_at?: string | null;
+                        /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
+                        passkey_prompt_count?: number;
+                        /** @description ISO 8601 timestamp of the last time the user chose "Not now" on the passkey offer, as opposed to closing the tab. */
+                        passkey_prompt_dismissed_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -6095,6 +6784,12 @@ export interface operations {
                         email_bounced_at?: string | null;
                         /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
                         welcome_sent_at?: string | null;
+                        /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
+                        passkey_prompted_at?: string | null;
+                        /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
+                        passkey_prompt_count?: number;
+                        /** @description ISO 8601 timestamp of the last time the user chose "Not now" on the passkey offer, as opposed to closing the tab. */
+                        passkey_prompt_dismissed_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -6269,6 +6964,12 @@ export interface operations {
                         email_bounced_at?: string | null;
                         /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
                         welcome_sent_at?: string | null;
+                        /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
+                        passkey_prompted_at?: string | null;
+                        /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
+                        passkey_prompt_count?: number;
+                        /** @description ISO 8601 timestamp of the last time the user chose "Not now" on the passkey offer, as opposed to closing the tab. */
+                        passkey_prompt_dismissed_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -6403,6 +7104,12 @@ export interface operations {
                         email_bounced_at?: string | null;
                         /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
                         welcome_sent_at?: string | null;
+                        /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
+                        passkey_prompted_at?: string | null;
+                        /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
+                        passkey_prompt_count?: number;
+                        /** @description ISO 8601 timestamp of the last time the user chose "Not now" on the passkey offer, as opposed to closing the tab. */
+                        passkey_prompt_dismissed_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -6681,6 +7388,30 @@ export interface operations {
             };
         };
     };
+    "user/resetPasskeyPrompt": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        reset: boolean;
+                    };
+                };
+            };
+        };
+    };
     "identity/list": {
         parameters: {
             query?: {
@@ -9246,6 +9977,986 @@ export interface operations {
             };
         };
     };
+    "loginflow/resolved": {
+        parameters: {
+            query?: {
+                client_id?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        source: "compiled" | "published";
+                        flow_id: string | null;
+                        revision: number;
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        bound: {
+                            flow_id: string;
+                            bound_to: "account" | "client";
+                            name: string;
+                            revision: number;
+                            published_revision: number | null;
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            draft: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            /** @description Node positions in the editor. Presentation only. */
+                            layout?: {
+                                [key: string]: {
+                                    x: number;
+                                    y: number;
+                                };
+                            };
+                            history: number[];
+                        } | null;
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/materialize": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    client_id?: string;
+                    name?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description LoginFlow */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description LoginFlow ID */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        trigger: "login";
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+                        revision: number;
+                        published?: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        };
+                        /** @description Previously published graphs, newest first, for rollback. */
+                        history: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        }[];
+                        /** @description Node positions in the editor. Presentation only. */
+                        layout?: {
+                            [key: string]: {
+                                x: number;
+                                y: number;
+                            };
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description LoginFlowMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description LoginFlow creation date */
+                        createdAt: string;
+                        /** @description LoginFlow updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/validate": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                loginflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    client_id?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ok: boolean;
+                        issues: {
+                            code: string;
+                            node?: string;
+                            handle?: string;
+                            message: string;
+                        }[];
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/publish": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                loginflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    client_id?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description LoginFlow */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description LoginFlow ID */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        trigger: "login";
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+                        revision: number;
+                        published?: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        };
+                        /** @description Previously published graphs, newest first, for rollback. */
+                        history: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        }[];
+                        /** @description Node positions in the editor. Presentation only. */
+                        layout?: {
+                            [key: string]: {
+                                x: number;
+                                y: number;
+                            };
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description LoginFlowMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description LoginFlow creation date */
+                        createdAt: string;
+                        /** @description LoginFlow updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /** @description Default Response */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        error: string;
+                        issues: {
+                            code: string;
+                            node?: string;
+                            handle?: string;
+                            message: string;
+                        }[];
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/rollback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                loginflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    revision: number;
+                };
+            };
+        };
+        responses: {
+            /** @description LoginFlow */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description LoginFlow ID */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        trigger: "login";
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+                        revision: number;
+                        published?: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        };
+                        /** @description Previously published graphs, newest first, for rollback. */
+                        history: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        }[];
+                        /** @description Node positions in the editor. Presentation only. */
+                        layout?: {
+                            [key: string]: {
+                                x: number;
+                                y: number;
+                            };
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description LoginFlowMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description LoginFlow creation date */
+                        createdAt: string;
+                        /** @description LoginFlow updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/previewToken": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                loginflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        token: string;
+                        expires_in: number;
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/list": {
+        parameters: {
+            query?: {
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
+                cursor?: string;
+                /** @description Cursor returned by the previous page */
+                next?: string;
+                /** @description Filter using a FaableQL query */
+                query?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        next: string | null;
+                        results: components["schemas"]["LoginFlow"][];
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/create": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    name: string;
+                    /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                    graph: {
+                        nodes: {
+                            id: string;
+                            type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                            config?: {
+                                [key: string]: unknown;
+                            };
+                        }[];
+                        edges: {
+                            from: string;
+                            handle: string;
+                            to: string;
+                        }[];
+                    };
+                    /** @description Node positions in the editor. Presentation only. */
+                    layout?: {
+                        [key: string]: {
+                            x: number;
+                            y: number;
+                        };
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description LoginFlow */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description LoginFlow ID */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        trigger: "login";
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+                        revision: number;
+                        published?: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        };
+                        /** @description Previously published graphs, newest first, for rollback. */
+                        history: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        }[];
+                        /** @description Node positions in the editor. Presentation only. */
+                        layout?: {
+                            [key: string]: {
+                                x: number;
+                                y: number;
+                            };
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description LoginFlowMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description LoginFlow creation date */
+                        createdAt: string;
+                        /** @description LoginFlow updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/get": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                loginflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description LoginFlow */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description LoginFlow ID */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        trigger: "login";
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+                        revision: number;
+                        published?: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        };
+                        /** @description Previously published graphs, newest first, for rollback. */
+                        history: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        }[];
+                        /** @description Node positions in the editor. Presentation only. */
+                        layout?: {
+                            [key: string]: {
+                                x: number;
+                                y: number;
+                            };
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description LoginFlowMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description LoginFlow creation date */
+                        createdAt: string;
+                        /** @description LoginFlow updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                loginflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    name?: string;
+                    /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                    graph?: {
+                        nodes: {
+                            id: string;
+                            type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                            config?: {
+                                [key: string]: unknown;
+                            };
+                        }[];
+                        edges: {
+                            from: string;
+                            handle: string;
+                            to: string;
+                        }[];
+                    };
+                    /** @description Node positions in the editor. Presentation only. */
+                    layout?: {
+                        [key: string]: {
+                            x: number;
+                            y: number;
+                        };
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description LoginFlow */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description LoginFlow ID */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        trigger: "login";
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+                        revision: number;
+                        published?: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        };
+                        /** @description Previously published graphs, newest first, for rollback. */
+                        history: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        }[];
+                        /** @description Node positions in the editor. Presentation only. */
+                        layout?: {
+                            [key: string]: {
+                                x: number;
+                                y: number;
+                            };
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description LoginFlowMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description LoginFlow creation date */
+                        createdAt: string;
+                        /** @description LoginFlow updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "loginflow/delete": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                loginflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description LoginFlow */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description LoginFlow ID */
+                        id: string;
+                        name: string;
+                        /** @enum {string} */
+                        trigger: "login";
+                        /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                        graph: {
+                            nodes: {
+                                id: string;
+                                type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                config?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                            edges: {
+                                from: string;
+                                handle: string;
+                                to: string;
+                            }[];
+                        };
+                        /** @description Monotonic edit counter, bumped on every update. A publish freezes the graph under the revision it had; a login in flight pins the revision it started on. */
+                        revision: number;
+                        published?: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        };
+                        /** @description Previously published graphs, newest first, for rollback. */
+                        history: {
+                            /** @description A login flow graph: typed nodes joined by named handles. See the validation rules on publish. */
+                            graph: {
+                                nodes: {
+                                    id: string;
+                                    type: "start" | "identify" | "methods" | "credential" | "action" | "mfa_gate" | "mfa_challenge" | "mfa_enroll" | "passkey_offer" | "condition" | "deny" | "end" | "consent" | "set_data";
+                                    config?: {
+                                        [key: string]: unknown;
+                                    };
+                                }[];
+                                edges: {
+                                    from: string;
+                                    handle: string;
+                                    to: string;
+                                }[];
+                            };
+                            revision: number;
+                            published_at: string;
+                        }[];
+                        /** @description Node positions in the editor. Presentation only. */
+                        layout?: {
+                            [key: string]: {
+                                x: number;
+                                y: number;
+                            };
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description LoginFlowMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description LoginFlow creation date */
+                        createdAt: string;
+                        /** @description LoginFlow updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
     "notificationsubscription/list": {
         parameters: {
             query?: {
@@ -10059,6 +11770,8 @@ export interface operations {
                     otp: string;
                     /** @description Same-origin path to return the user to after authentication, instead of the OAuth client redirect. Used by first-party interactive flows (e.g. device-code confirm). Non same-origin values are ignored. */
                     redirect_to?: string;
+                    /** @description The "Remember me on this device" checkbox. Honoured only when the tenant shows one (`login_methods.remember_me: "optional"`). */
+                    remember_me?: boolean;
                 };
             };
         };
@@ -10154,6 +11867,12 @@ export interface operations {
                         email_bounced_at?: string | null;
                         /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
                         welcome_sent_at?: string | null;
+                        /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
+                        passkey_prompted_at?: string | null;
+                        /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
+                        passkey_prompt_count?: number;
+                        /** @description ISO 8601 timestamp of the last time the user chose "Not now" on the passkey offer, as opposed to closing the tab. */
+                        passkey_prompt_dismissed_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -10288,6 +12007,8 @@ export interface operations {
                 connection_scope?: string;
                 /** @description Link mode: attach the resulting provider identity to the ACTIVE session user instead of signing in or up. Requires a session; incompatible with prompt=login/consent. */
                 link?: boolean;
+                /** @description Preview token from `POST /loginflow/:id/preview-token`. This login runs the DRAFT of that flow, for this browser only; nothing is published. Invalid or expired tokens are ignored. */
+                flow_preview?: string;
                 /** @description Single-use ticket from `POST /oauth/link_ticket`. With `link=true`, establishes the cookie session for the ticket’s user before linking — for Relying Parties that hold tokens but no cookie session (direct grants such as passwordless OTP). Invalid or expired tickets are ignored. */
                 link_ticket?: string;
                 client_id: string;
@@ -10879,6 +12600,8 @@ export interface operations {
                     response_type?: string;
                     /** @description Same-origin path to return the user to after authentication, instead of the OAuth client redirect. Used by first-party interactive flows (e.g. device-code confirm). Non same-origin values are ignored. */
                     redirect_to?: string;
+                    /** @description The "Remember me on this device" checkbox. Honoured only when the tenant shows one (`login_methods.remember_me: "optional"`): `true` keeps the session for `remember_me_days`, `false` ends it when the browser closes. */
+                    remember_me?: boolean;
                     client_id: string;
                     /** @description Deprecated. Use connection_id */
                     connection?: string;