@zitadel/api 0.0.0 → 0.1.0-alpha.10

package/src/generated/endpoints/zitadelNextGen.zod.ts

@@ -585,6 +585,41 @@ export const GetUserByIDQueryParams = zod.strictObject({
 
 export const GetUserByIDResponse = zod.record(zod.string(), zod.unknown());
 
+/**
+ * @summary Set user password
+ */
+export const setUserPasswordPathUserIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+
+export const SetUserPasswordParams = zod.object({
+  user_id: zod.string().regex(setUserPasswordPathUserIdRegExp),
+});
+
+export const setUserPasswordQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const SetUserPasswordQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(setUserPasswordQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+export const SetUserPasswordBody = zod
+  .object({
+    password: zod.string().describe("The new password for the user."),
+    isChangeRequired: zod
+      .boolean()
+      .optional()
+      .describe(
+        "Whether the user is required to change their password on the next login.\nIf not provided, it will default to false.\n",
+      ),
+  })
+  .describe("Request to update the user's password.");
+
+/**
+ * @summary Get my user information
+ */
+export const GetMyUserResponse = zod.record(zod.string(), zod.unknown());
+
 /**
  * Resolves a flow definition based on purpose + audience context and returns
 the first capability step. Creates a new session implicitly unless
@@ -665,14 +700,14 @@ export const GetFlowStepParams = zod.object({
     ),
 });
 
-export const getFlowStepResponseStepFieldsRequiredDefault = false;
-export const getFlowStepResponseStepFieldsValidationMinLengthMin = 0;
+export const getFlowStepResponseStepFieldsItemRequiredDefault = false;
+export const getFlowStepResponseStepFieldsItemValidationMinLengthMin = 0;
 
-export const getFlowStepResponseStepFieldsValidationMaxLengthMin = 0;
+export const getFlowStepResponseStepFieldsItemValidationMaxLengthMin = 0;
 
-export const getFlowStepResponseStepFieldsDefault = {} as const;
-export const getFlowStepResponseStepActionsPrimaryDefault = false;
-export const getFlowStepResponseStepActionsDefault = {} as const;
+export const getFlowStepResponseStepFieldsDefault = [];
+export const getFlowStepResponseStepActionsItemPrimaryDefault = false;
+export const getFlowStepResponseStepActionsDefault = [];
 export const getFlowStepResponseStepGatesDefault = {} as const;
 export const getFlowStepResponseStepSsoProvidersDefault = [];
 export const getFlowStepResponseBrandingLayoutDefault = `centered`;
@@ -720,19 +755,34 @@ export const GetFlowStepResponse = zod.object({
         .optional()
         .describe("URL to navigate to (e.g., SSO provider redirect)."),
       fields: zod
-        .record(
-          zod.string(),
+        .array(
           zod
             .object({
+              name: zod
+                .string()
+                .describe(
+                  "Field name, matching a property in the flow's user schema. Carries\nthe submitted value back to the engine.\n",
+                ),
               type: zod
-                .enum(["text", "email", "password", "tel", "number", "url", "date", "hidden"])
+                .enum([
+                  "text",
+                  "email",
+                  "password",
+                  "tel",
+                  "number",
+                  "url",
+                  "date",
+                  "hidden",
+                  "checkbox",
+                  "select",
+                ])
                 .describe(
-                  "The input kind the client should render. Encodes the formats that\nhave a matching HTML input type (email, url, date). For other\nformats (e.g. uuid) the type is `text` and `validation.format`\ncarries the rule.\n",
+                  "The input kind the client should render. Encodes the formats and\nJSON types that map to a familiar HTML input: `email`, `url`,\n`date` come from `format`; `checkbox` from JSON `type: boolean`;\n`select` from a closed `enum`. For other formats (e.g. uuid) the\ntype is `text` and `validation.format` carries the rule.\n",
                 ),
               text_key: zod.string().describe("Localization key for the field label."),
               required: zod
                 .boolean()
-                .default(getFlowStepResponseStepFieldsRequiredDefault)
+                .default(getFlowStepResponseStepFieldsItemRequiredDefault)
                 .describe(
                   "The field MUST be present and non-empty on submit. Mirrors the\nschema's top-level `required` array.\n",
                 ),
@@ -750,14 +800,20 @@ export const GetFlowStepResponse = zod.object({
                     ),
                   min_length: zod
                     .number()
-                    .min(getFlowStepResponseStepFieldsValidationMinLengthMin)
+                    .min(getFlowStepResponseStepFieldsItemValidationMinLengthMin)
                     .optional()
                     .describe("Minimum length in characters (inclusive). Mirrors `minLength`."),
                   max_length: zod
                     .number()
-                    .min(getFlowStepResponseStepFieldsValidationMaxLengthMin)
+                    .min(getFlowStepResponseStepFieldsItemValidationMaxLengthMin)
                     .optional()
                     .describe("Maximum length in characters (inclusive). Mirrors `maxLength`."),
+                  enum: zod
+                    .array(zod.string())
+                    .optional()
+                    .describe(
+                      "Closed list of allowed values. Mirrors the JSON Schema `enum`\nkeyword on the underlying user property. When `type` is\n`select` the client renders these as options; for other types\nthe rule still applies as a membership check.\n",
+                    ),
                 })
                 .optional()
                 .describe(
@@ -770,16 +826,18 @@ export const GetFlowStepResponse = zod.object({
         )
         .default(getFlowStepResponseStepFieldsDefault)
         .describe(
-          "Unordered dictionary of input fields to collect. Keyed by field name.\nThe LiquidJS template controls which fields appear and in what order.\nField metadata (type, validation) is resolved by the engine from the\nflow's user schema.\n",
+          "Ordered list of input fields to collect. Field metadata (type, validation)\nis resolved by the engine from the flow's user schema. The LiquidJS\ntemplate iterates this array; for keyed lookup it builds a name-indexed\nmap locally.\n",
         ),
       actions: zod
-        .record(
-          zod.string(),
+        .array(
           zod
             .object({
+              name: zod
+                .string()
+                .describe("Action identifier. Sent back in the submit request as `action`."),
               primary: zod
                 .boolean()
-                .default(getFlowStepResponseStepActionsPrimaryDefault)
+                .default(getFlowStepResponseStepActionsItemPrimaryDefault)
                 .describe(
                   "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
                 ),
@@ -791,12 +849,12 @@ export const GetFlowStepResponse = zod.object({
                 ),
             })
             .describe(
-              "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
+              "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`.\n",
             ),
         )
         .default(getFlowStepResponseStepActionsDefault)
         .describe(
-          "Unordered dictionary of available user actions. Keyed by action name.\nThe LiquidJS template controls positioning and presentation.\n",
+          "Ordered list of available user actions. The LiquidJS template iterates\nthis array and builds a name-indexed map locally for keyed lookup.\n",
         ),
       gates: zod
         .record(
@@ -865,7 +923,7 @@ export const GetFlowStepResponse = zod.object({
         ),
     })
     .describe(
-      "A step contains unordered capability dictionaries: what to collect (fields),\nwhat the user can do (actions), and what security gates must be satisfied (gates).\nLayout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.\n",
+      "A step contains ordered capability arrays: what to collect (fields),\nwhat the user can do (actions), and what security gates must be satisfied (gates).\nThe LiquidJS template in `branding.liquid_template` iterates these arrays in order\nand builds name-keyed indexes locally for lookup.\n",
     ),
   branding: zod
     .object({
@@ -941,6 +999,15 @@ export const SubmitFlowStepParams = zod.object({
     ),
 });
 
+export const SubmitFlowStepHeader = zod.strictObject({
+  Origin: zod
+    .url()
+    .optional()
+    .describe(
+      "Standard browser `Origin` header. When a step issues a passkey\nchallenge, the server derives the WebAuthn relying-party id and the\nallowed origin from this value. Browsers send it automatically on the\nfetch POST; no client action is required.\n",
+    ),
+});
+
 export const SubmitFlowStepBody = zod.object({
   session_token: zod
     .string()
@@ -994,14 +1061,14 @@ export const SubmitFlowStepBody = zod.object({
     ),
 });
 
-export const submitFlowStepResponseStepFieldsRequiredDefault = false;
-export const submitFlowStepResponseStepFieldsValidationMinLengthMin = 0;
+export const submitFlowStepResponseStepFieldsItemRequiredDefault = false;
+export const submitFlowStepResponseStepFieldsItemValidationMinLengthMin = 0;
 
-export const submitFlowStepResponseStepFieldsValidationMaxLengthMin = 0;
+export const submitFlowStepResponseStepFieldsItemValidationMaxLengthMin = 0;
 
-export const submitFlowStepResponseStepFieldsDefault = {} as const;
-export const submitFlowStepResponseStepActionsPrimaryDefault = false;
-export const submitFlowStepResponseStepActionsDefault = {} as const;
+export const submitFlowStepResponseStepFieldsDefault = [];
+export const submitFlowStepResponseStepActionsItemPrimaryDefault = false;
+export const submitFlowStepResponseStepActionsDefault = [];
 export const submitFlowStepResponseStepGatesDefault = {} as const;
 export const submitFlowStepResponseStepSsoProvidersDefault = [];
 export const submitFlowStepResponseBrandingLayoutDefault = `centered`;
@@ -1049,19 +1116,34 @@ export const SubmitFlowStepResponse = zod.object({
         .optional()
         .describe("URL to navigate to (e.g., SSO provider redirect)."),
       fields: zod
-        .record(
-          zod.string(),
+        .array(
           zod
             .object({
+              name: zod
+                .string()
+                .describe(
+                  "Field name, matching a property in the flow's user schema. Carries\nthe submitted value back to the engine.\n",
+                ),
               type: zod
-                .enum(["text", "email", "password", "tel", "number", "url", "date", "hidden"])
+                .enum([
+                  "text",
+                  "email",
+                  "password",
+                  "tel",
+                  "number",
+                  "url",
+                  "date",
+                  "hidden",
+                  "checkbox",
+                  "select",
+                ])
                 .describe(
-                  "The input kind the client should render. Encodes the formats that\nhave a matching HTML input type (email, url, date). For other\nformats (e.g. uuid) the type is `text` and `validation.format`\ncarries the rule.\n",
+                  "The input kind the client should render. Encodes the formats and\nJSON types that map to a familiar HTML input: `email`, `url`,\n`date` come from `format`; `checkbox` from JSON `type: boolean`;\n`select` from a closed `enum`. For other formats (e.g. uuid) the\ntype is `text` and `validation.format` carries the rule.\n",
                 ),
               text_key: zod.string().describe("Localization key for the field label."),
               required: zod
                 .boolean()
-                .default(submitFlowStepResponseStepFieldsRequiredDefault)
+                .default(submitFlowStepResponseStepFieldsItemRequiredDefault)
                 .describe(
                   "The field MUST be present and non-empty on submit. Mirrors the\nschema's top-level `required` array.\n",
                 ),
@@ -1079,14 +1161,20 @@ export const SubmitFlowStepResponse = zod.object({
                     ),
                   min_length: zod
                     .number()
-                    .min(submitFlowStepResponseStepFieldsValidationMinLengthMin)
+                    .min(submitFlowStepResponseStepFieldsItemValidationMinLengthMin)
                     .optional()
                     .describe("Minimum length in characters (inclusive). Mirrors `minLength`."),
                   max_length: zod
                     .number()
-                    .min(submitFlowStepResponseStepFieldsValidationMaxLengthMin)
+                    .min(submitFlowStepResponseStepFieldsItemValidationMaxLengthMin)
                     .optional()
                     .describe("Maximum length in characters (inclusive). Mirrors `maxLength`."),
+                  enum: zod
+                    .array(zod.string())
+                    .optional()
+                    .describe(
+                      "Closed list of allowed values. Mirrors the JSON Schema `enum`\nkeyword on the underlying user property. When `type` is\n`select` the client renders these as options; for other types\nthe rule still applies as a membership check.\n",
+                    ),
                 })
                 .optional()
                 .describe(
@@ -1099,16 +1187,18 @@ export const SubmitFlowStepResponse = zod.object({
         )
         .default(submitFlowStepResponseStepFieldsDefault)
         .describe(
-          "Unordered dictionary of input fields to collect. Keyed by field name.\nThe LiquidJS template controls which fields appear and in what order.\nField metadata (type, validation) is resolved by the engine from the\nflow's user schema.\n",
+          "Ordered list of input fields to collect. Field metadata (type, validation)\nis resolved by the engine from the flow's user schema. The LiquidJS\ntemplate iterates this array; for keyed lookup it builds a name-indexed\nmap locally.\n",
         ),
       actions: zod
-        .record(
-          zod.string(),
+        .array(
           zod
             .object({
+              name: zod
+                .string()
+                .describe("Action identifier. Sent back in the submit request as `action`."),
               primary: zod
                 .boolean()
-                .default(submitFlowStepResponseStepActionsPrimaryDefault)
+                .default(submitFlowStepResponseStepActionsItemPrimaryDefault)
                 .describe(
                   "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
                 ),
@@ -1120,12 +1210,12 @@ export const SubmitFlowStepResponse = zod.object({
                 ),
             })
             .describe(
-              "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
+              "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`.\n",
             ),
         )
         .default(submitFlowStepResponseStepActionsDefault)
         .describe(
-          "Unordered dictionary of available user actions. Keyed by action name.\nThe LiquidJS template controls positioning and presentation.\n",
+          "Ordered list of available user actions. The LiquidJS template iterates\nthis array and builds a name-indexed map locally for keyed lookup.\n",
         ),
       gates: zod
         .record(
@@ -1194,7 +1284,7 @@ export const SubmitFlowStepResponse = zod.object({
         ),
     })
     .describe(
-      "A step contains unordered capability dictionaries: what to collect (fields),\nwhat the user can do (actions), and what security gates must be satisfied (gates).\nLayout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.\n",
+      "A step contains ordered capability arrays: what to collect (fields),\nwhat the user can do (actions), and what security gates must be satisfied (gates).\nThe LiquidJS template in `branding.liquid_template` iterates these arrays in order\nand builds name-keyed indexes locally for lookup.\n",
     ),
   branding: zod
     .object({
@@ -2927,8 +3017,8 @@ Flow definitions are created based on the flow meta schema, which includes the f
 export const createFlowDefinitionBodyProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const createFlowDefinitionBodyFlowDefinitionNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
 export const createFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault = [];
-export const createFlowDefinitionBodyFlowDefinitionStepsItemActionsPrimaryDefault = false;
-export const createFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault = {} as const;
+export const createFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault = false;
+export const createFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault = [];
 export const createFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault = {} as const;
 export const createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault = [];
 
@@ -2991,14 +3081,18 @@ export const CreateFlowDefinitionBody = zod.object({
                   "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
                 ),
               actions: zod
-                .record(
-                  zod.string(),
+                .array(
                   zod
                     .object({
+                      name: zod
+                        .string()
+                        .describe(
+                          "Action identifier. Sent back in the submit request as `action`.",
+                        ),
                       primary: zod
                         .boolean()
                         .default(
-                          createFlowDefinitionBodyFlowDefinitionStepsItemActionsPrimaryDefault,
+                          createFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault,
                         )
                         .describe(
                           "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
@@ -3011,12 +3105,12 @@ export const CreateFlowDefinitionBody = zod.object({
                         ),
                     })
                     .describe(
-                      "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
+                      "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`.\n",
                     ),
                 )
                 .default(createFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault)
                 .describe(
-                  "Actions the user can take. Keyed by action name.\nThe action name is what the frontend sends back in the submit request.\nIf omitted, the engine provides a default `submit` action.\n",
+                  "Ordered list of actions the user can take. The action name is what the\nfrontend sends back in the submit request. If omitted, the engine\nprovides a default `submit` action.\n",
                 ),
               gates: zod
                 .record(
@@ -3093,7 +3187,7 @@ export const CreateFlowDefinitionBody = zod.object({
                 )
                 .optional()
                 .describe(
-                  "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` dict. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
+                  "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
                 ),
             })
             .describe(
@@ -3137,7 +3231,7 @@ export const ListFlowDefinitionsQueryParams = zod.strictObject({
   project_id: zod
     .string()
     .regex(listFlowDefinitionsQueryProjectIdRegExp)
-    .describe("The unique identifier of the project"),
+    .describe("The project id to filter by."),
   purpose: zod
     .enum(["login", "register", "recovery", "profiling", "reauth", "link_account"])
     .optional()
@@ -3162,6 +3256,7 @@ export const ListFlowDefinitionsResponse = zod.object({
           .describe("Identifier of the project this flow definition belongs to."),
         schema_uri: zod
           .url()
+          .optional()
           .describe(
             "URI of the flow definition schema this definition was authored against.\nIf the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.\n",
           ),
@@ -3191,388 +3286,236 @@ export const GetFlowDefinitionParams = zod.object({
   id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
 });
 
-export const getFlowDefinitionResponseOneNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
-export const getFlowDefinitionResponseOneStepsItemFieldsDefault = [];
-export const getFlowDefinitionResponseOneStepsItemActionsPrimaryDefault = false;
-export const getFlowDefinitionResponseOneStepsItemActionsDefault = {} as const;
-export const getFlowDefinitionResponseOneStepsItemGatesDefault = {} as const;
-export const getFlowDefinitionResponseOneStepsItemSsoProvidersDefault = [];
+export const getFlowDefinitionQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 
-export const GetFlowDefinitionResponse = zod
-  .object({
-    name: zod
-      .string()
-      .regex(getFlowDefinitionResponseOneNameRegExp)
-      .describe(
-        "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
-      ),
-    user_schema: zod
-      .url()
-      .describe(
-        "User schema this flow operates on. Step `fields` reference properties\ndefined in this schema. The engine resolves field types, validation,\nand implicit outcomes from schema annotations at runtime.\n",
-      ),
-    purposes: zod
-      .record(zod.string(), zod.string())
-      .describe(
-        "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login\/register\nflow) by listing one entry per purpose.\n",
-      ),
-    audience: zod
-      .object({
-        team_ids: zod
-          .array(zod.string())
-          .optional()
-          .describe("Restrict to specific teams (organizations). Empty means no team restriction."),
-        app_ids: zod
-          .array(zod.string())
-          .optional()
-          .describe("Restrict to specific applications. Empty means no app restriction."),
-      })
-      .optional()
-      .describe(
-        'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
-      ),
-    steps: zod
-      .array(
-        zod
-          .object({
-            name: zod
-              .string()
-              .describe(
-                "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
-              ),
-            fields: zod
-              .array(zod.string())
-              .default(getFlowDefinitionResponseOneStepsItemFieldsDefault)
-              .describe(
-                "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
-              ),
-            actions: zod
-              .record(
-                zod.string(),
-                zod
-                  .object({
-                    primary: zod
-                      .boolean()
-                      .default(getFlowDefinitionResponseOneStepsItemActionsPrimaryDefault)
-                      .describe(
-                        "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
-                      ),
-                    text_key: zod
-                      .string()
-                      .optional()
-                      .describe(
-                        "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
-                      ),
-                  })
-                  .describe(
-                    "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
-                  ),
-              )
-              .default(getFlowDefinitionResponseOneStepsItemActionsDefault)
-              .describe(
-                "Actions the user can take. Keyed by action name.\nThe action name is what the frontend sends back in the submit request.\nIf omitted, the engine provides a default `submit` action.\n",
-              ),
-            gates: zod
-              .record(
-                zod.string(),
-                zod
-                  .object({
-                    kind: zod
-                      .enum(["captcha"])
-                      .describe(
-                        "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
-                      ),
-                    provider: zod
-                      .string()
-                      .describe(
-                        "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
-                      ),
-                    config: zod
-                      .record(zod.string(), zod.unknown())
-                      .optional()
-                      .describe(
-                        "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
-                      ),
-                  })
-                  .describe(
-                    "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
-                  ),
-              )
-              .default(getFlowDefinitionResponseOneStepsItemGatesDefault)
-              .describe(
-                'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
-              ),
-            sso_providers: zod
-              .array(
-                zod
-                  .object({
-                    id: zod.string().describe("Provider instance identifier."),
-                    name: zod.string().describe("Display name for the provider."),
-                    template: zod.string().describe("Template hint for rendering (logo, colors)."),
-                  })
-                  .describe("An available SSO identity provider."),
-              )
-              .default(getFlowDefinitionResponseOneStepsItemSsoProvidersDefault)
-              .describe("Available SSO identity providers for this step."),
-            on_success: zod
-              .enum(["create_user"])
-              .optional()
-              .describe(
-                "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
-              ),
-            complete: zod
-              .enum(["redirect", "show"])
-              .optional()
-              .describe(
-                "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
-              ),
-            transitions: zod
-              .record(
-                zod.string(),
-                zod.object({
-                  target: zod
-                    .string()
-                    .describe(
-                      "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
-                    ),
-                  action: zod
-                    .union([zod.enum(["switch", "pivot"]), zod.null()])
-                    .optional()
-                    .describe(
-                      "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
-                    ),
-                }),
-              )
-              .optional()
-              .describe(
-                "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` dict. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
-              ),
-          })
-          .describe(
-            "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
-          ),
-      )
-      .min(1)
-      .describe(
-        "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
-      ),
-  })
-  .describe(
-    "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project\/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST \/flow.\n",
-  )
-  .and(
-    zod.object({
-      id: zod.string().describe("Unique identifier for the flow definition."),
-      project_id: zod
+export const GetFlowDefinitionQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(getFlowDefinitionQueryProjectIdRegExp)
+    .describe("The project id to filter by."),
+});
+
+export const getFlowDefinitionResponseFlowDefinitionNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
+export const getFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault = [];
+export const getFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault = false;
+export const getFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault = [];
+export const getFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault = {} as const;
+export const getFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault = [];
+
+export const GetFlowDefinitionResponse = zod.object({
+  id: zod.string().describe("Unique identifier for the flow definition."),
+  project_id: zod.string().describe("Identifier of the project this flow definition belongs to."),
+  status: zod.string().describe("Status of the flow definition."),
+  flow_definition: zod
+    .object({
+      name: zod
         .string()
-        .describe("Identifier of the project this flow definition belongs to."),
-      schema_uri: zod
+        .regex(getFlowDefinitionResponseFlowDefinitionNameRegExp)
+        .describe(
+          "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
+        ),
+      user_schema: zod
         .url()
         .describe(
-          "URI of the flow definition schema this definition was authored against.\nIf the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.\n",
+          "User schema this flow operates on. Step `fields` reference properties\ndefined in this schema. The engine resolves field types, validation,\nand implicit outcomes from schema annotations at runtime.\n",
         ),
-      status: zod.string().describe("Status of the flow definition."),
-      created_at: zod.iso.datetime({ offset: true }),
-      updated_at: zod.iso.datetime({ offset: true }),
-    }),
-  );
-
-/**
- * Update a flow definition by id
- * @summary Update a flow definition by id
- */
-export const UpdateFlowDefinitionParams = zod.object({
-  id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
-});
-
-export const updateFlowDefinitionBodyStepsItemFieldsDefault = [];
-export const updateFlowDefinitionBodyStepsItemActionsPrimaryDefault = false;
-export const updateFlowDefinitionBodyStepsItemActionsDefault = {} as const;
-export const updateFlowDefinitionBodyStepsItemGatesDefault = {} as const;
-export const updateFlowDefinitionBodyStepsItemSsoProvidersDefault = [];
-
-export const UpdateFlowDefinitionBody = zod
-  .object({
-    user_schema: zod
-      .url()
-      .optional()
-      .describe("User schema this flow operates on. Replaces the current value if provided.\n"),
-    purposes: zod
-      .record(zod.string(), zod.string())
-      .optional()
-      .describe(
-        "Replaces the full purpose-to-entry-step map if provided. Keys are\npurpose names; values must match a `name` in `steps`.\n",
-      ),
-    audience: zod
-      .object({
-        team_ids: zod
-          .array(zod.string())
-          .optional()
-          .describe("Restrict to specific teams (organizations). Empty means no team restriction."),
-        app_ids: zod
-          .array(zod.string())
-          .optional()
-          .describe("Restrict to specific applications. Empty means no app restriction."),
-      })
-      .optional()
-      .describe(
-        'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
-      ),
-    steps: zod
-      .array(
-        zod
-          .object({
-            name: zod
-              .string()
-              .describe(
-                "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
-              ),
-            fields: zod
-              .array(zod.string())
-              .default(updateFlowDefinitionBodyStepsItemFieldsDefault)
-              .describe(
-                "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
-              ),
-            actions: zod
-              .record(
-                zod.string(),
-                zod
-                  .object({
-                    primary: zod
-                      .boolean()
-                      .default(updateFlowDefinitionBodyStepsItemActionsPrimaryDefault)
-                      .describe(
-                        "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
-                      ),
-                    text_key: zod
-                      .string()
-                      .optional()
-                      .describe(
-                        "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
-                      ),
-                  })
-                  .describe(
-                    "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
-                  ),
-              )
-              .default(updateFlowDefinitionBodyStepsItemActionsDefault)
-              .describe(
-                "Actions the user can take. Keyed by action name.\nThe action name is what the frontend sends back in the submit request.\nIf omitted, the engine provides a default `submit` action.\n",
-              ),
-            gates: zod
-              .record(
-                zod.string(),
-                zod
-                  .object({
-                    kind: zod
-                      .enum(["captcha"])
-                      .describe(
-                        "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
-                      ),
-                    provider: zod
+      purposes: zod
+        .record(zod.string(), zod.string())
+        .describe(
+          "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login\/register\nflow) by listing one entry per purpose.\n",
+        ),
+      audience: zod
+        .object({
+          team_ids: zod
+            .array(zod.string())
+            .optional()
+            .describe(
+              "Restrict to specific teams (organizations). Empty means no team restriction.",
+            ),
+          app_ids: zod
+            .array(zod.string())
+            .optional()
+            .describe("Restrict to specific applications. Empty means no app restriction."),
+        })
+        .optional()
+        .describe(
+          'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
+        ),
+      steps: zod
+        .array(
+          zod
+            .object({
+              name: zod
+                .string()
+                .describe(
+                  "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
+                ),
+              fields: zod
+                .array(zod.string())
+                .default(getFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault)
+                .describe(
+                  "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
+                ),
+              actions: zod
+                .array(
+                  zod
+                    .object({
+                      name: zod
+                        .string()
+                        .describe(
+                          "Action identifier. Sent back in the submit request as `action`.",
+                        ),
+                      primary: zod
+                        .boolean()
+                        .default(
+                          getFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault,
+                        )
+                        .describe(
+                          "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
+                        ),
+                      text_key: zod
+                        .string()
+                        .optional()
+                        .describe(
+                          "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
+                        ),
+                    })
+                    .describe(
+                      "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`.\n",
+                    ),
+                )
+                .default(getFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault)
+                .describe(
+                  "Ordered list of actions the user can take. The action name is what the\nfrontend sends back in the submit request. If omitted, the engine\nprovides a default `submit` action.\n",
+                ),
+              gates: zod
+                .record(
+                  zod.string(),
+                  zod
+                    .object({
+                      kind: zod
+                        .enum(["captcha"])
+                        .describe(
+                          "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
+                        ),
+                      provider: zod
+                        .string()
+                        .describe(
+                          "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                        ),
+                      config: zod
+                        .record(zod.string(), zod.unknown())
+                        .optional()
+                        .describe(
+                          "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                        ),
+                    })
+                    .describe(
+                      "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
+                    ),
+                )
+                .default(getFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault)
+                .describe(
+                  'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
+                ),
+              sso_providers: zod
+                .array(
+                  zod
+                    .object({
+                      id: zod.string().describe("Provider instance identifier."),
+                      name: zod.string().describe("Display name for the provider."),
+                      template: zod
+                        .string()
+                        .describe("Template hint for rendering (logo, colors)."),
+                    })
+                    .describe("An available SSO identity provider."),
+                )
+                .default(getFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault)
+                .describe("Available SSO identity providers for this step."),
+              on_success: zod
+                .enum(["create_user"])
+                .optional()
+                .describe(
+                  "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
+                ),
+              complete: zod
+                .enum(["redirect", "show"])
+                .optional()
+                .describe(
+                  "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
+                ),
+              transitions: zod
+                .record(
+                  zod.string(),
+                  zod.object({
+                    target: zod
                       .string()
                       .describe(
-                        "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                        "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
                       ),
-                    config: zod
-                      .record(zod.string(), zod.unknown())
+                    action: zod
+                      .union([zod.enum(["switch", "pivot"]), zod.null()])
                       .optional()
                       .describe(
-                        "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                        "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
                       ),
-                  })
-                  .describe(
-                    "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
-                  ),
-              )
-              .default(updateFlowDefinitionBodyStepsItemGatesDefault)
-              .describe(
-                'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
-              ),
-            sso_providers: zod
-              .array(
-                zod
-                  .object({
-                    id: zod.string().describe("Provider instance identifier."),
-                    name: zod.string().describe("Display name for the provider."),
-                    template: zod.string().describe("Template hint for rendering (logo, colors)."),
-                  })
-                  .describe("An available SSO identity provider."),
-              )
-              .default(updateFlowDefinitionBodyStepsItemSsoProvidersDefault)
-              .describe("Available SSO identity providers for this step."),
-            on_success: zod
-              .enum(["create_user"])
-              .optional()
-              .describe(
-                "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
-              ),
-            complete: zod
-              .enum(["redirect", "show"])
-              .optional()
-              .describe(
-                "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
-              ),
-            transitions: zod
-              .record(
-                zod.string(),
-                zod.object({
-                  target: zod
-                    .string()
-                    .describe(
-                      "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
-                    ),
-                  action: zod
-                    .union([zod.enum(["switch", "pivot"]), zod.null()])
-                    .optional()
-                    .describe(
-                      "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
-                    ),
-                }),
-              )
-              .optional()
-              .describe(
-                "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` dict. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
-              ),
-          })
-          .describe(
-            "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
-          ),
-      )
-      .min(1)
-      .optional()
-      .describe(
-        "Replaces the full steps array if provided. Partial step lists are not\nsupported — supply all steps when updating this field.\n",
-      ),
-  })
-  .describe(
-    "Partial update for a flow definition. Only provided fields are replaced;\nomitted fields retain their current server-side values.\n\nCollection fields (`steps`, `purposes`) are treated atomically: if\nprovided, the entire array\/object is replaced. If omitted, the current\nvalue is preserved unchanged.\n\n`name` is a stable identifier and cannot be changed after creation.\n",
-  );
+                  }),
+                )
+                .optional()
+                .describe(
+                  "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
+                ),
+            })
+            .describe(
+              "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
+            ),
+        )
+        .min(1)
+        .describe(
+          "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
+        ),
+    })
+    .describe(
+      "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project\/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST \/flow.\n",
+    ),
+  created_at: zod.iso.datetime({ offset: true }),
+  updated_at: zod.iso.datetime({ offset: true }),
+});
+
+/**
+ * Update a flow definition by id
+ * @summary Update a flow definition by id
+ */
+export const UpdateFlowDefinitionParams = zod.object({
+  id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
+});
+
+export const updateFlowDefinitionQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const UpdateFlowDefinitionQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(updateFlowDefinitionQueryProjectIdRegExp)
+    .describe("The project id to filter by."),
+});
 
-export const updateFlowDefinitionResponseOneNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
-export const updateFlowDefinitionResponseOneStepsItemFieldsDefault = [];
-export const updateFlowDefinitionResponseOneStepsItemActionsPrimaryDefault = false;
-export const updateFlowDefinitionResponseOneStepsItemActionsDefault = {} as const;
-export const updateFlowDefinitionResponseOneStepsItemGatesDefault = {} as const;
-export const updateFlowDefinitionResponseOneStepsItemSsoProvidersDefault = [];
+export const updateFlowDefinitionBodyStepsItemFieldsDefault = [];
+export const updateFlowDefinitionBodyStepsItemActionsItemPrimaryDefault = false;
+export const updateFlowDefinitionBodyStepsItemActionsDefault = [];
+export const updateFlowDefinitionBodyStepsItemGatesDefault = {} as const;
+export const updateFlowDefinitionBodyStepsItemSsoProvidersDefault = [];
 
-export const UpdateFlowDefinitionResponse = zod
+export const UpdateFlowDefinitionBody = zod
   .object({
-    name: zod
-      .string()
-      .regex(updateFlowDefinitionResponseOneNameRegExp)
-      .describe(
-        "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
-      ),
     user_schema: zod
       .url()
-      .describe(
-        "User schema this flow operates on. Step `fields` reference properties\ndefined in this schema. The engine resolves field types, validation,\nand implicit outcomes from schema annotations at runtime.\n",
-      ),
+      .optional()
+      .describe("User schema this flow operates on. Replaces the current value if provided.\n"),
     purposes: zod
       .record(zod.string(), zod.string())
+      .optional()
       .describe(
-        "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login\/register\nflow) by listing one entry per purpose.\n",
+        "Replaces the full purpose-to-entry-step map if provided. Keys are\npurpose names; values must match a `name` in `steps`.\n",
       ),
     audience: zod
       .object({
@@ -3600,18 +3543,20 @@ export const UpdateFlowDefinitionResponse = zod
               ),
             fields: zod
               .array(zod.string())
-              .default(updateFlowDefinitionResponseOneStepsItemFieldsDefault)
+              .default(updateFlowDefinitionBodyStepsItemFieldsDefault)
               .describe(
                 "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
               ),
             actions: zod
-              .record(
-                zod.string(),
+              .array(
                 zod
                   .object({
+                    name: zod
+                      .string()
+                      .describe("Action identifier. Sent back in the submit request as `action`."),
                     primary: zod
                       .boolean()
-                      .default(updateFlowDefinitionResponseOneStepsItemActionsPrimaryDefault)
+                      .default(updateFlowDefinitionBodyStepsItemActionsItemPrimaryDefault)
                       .describe(
                         "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
                       ),
@@ -3623,12 +3568,12 @@ export const UpdateFlowDefinitionResponse = zod
                       ),
                   })
                   .describe(
-                    "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
+                    "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`.\n",
                   ),
               )
-              .default(updateFlowDefinitionResponseOneStepsItemActionsDefault)
+              .default(updateFlowDefinitionBodyStepsItemActionsDefault)
               .describe(
-                "Actions the user can take. Keyed by action name.\nThe action name is what the frontend sends back in the submit request.\nIf omitted, the engine provides a default `submit` action.\n",
+                "Ordered list of actions the user can take. The action name is what the\nfrontend sends back in the submit request. If omitted, the engine\nprovides a default `submit` action.\n",
               ),
             gates: zod
               .record(
@@ -3656,7 +3601,7 @@ export const UpdateFlowDefinitionResponse = zod
                     "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
                   ),
               )
-              .default(updateFlowDefinitionResponseOneStepsItemGatesDefault)
+              .default(updateFlowDefinitionBodyStepsItemGatesDefault)
               .describe(
                 'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
               ),
@@ -3670,7 +3615,7 @@ export const UpdateFlowDefinitionResponse = zod
                   })
                   .describe("An available SSO identity provider."),
               )
-              .default(updateFlowDefinitionResponseOneStepsItemSsoProvidersDefault)
+              .default(updateFlowDefinitionBodyStepsItemSsoProvidersDefault)
               .describe("Available SSO identity providers for this step."),
             on_success: zod
               .enum(["create_user"])
@@ -3703,7 +3648,7 @@ export const UpdateFlowDefinitionResponse = zod
               )
               .optional()
               .describe(
-                "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` dict. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
+                "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
               ),
           })
           .describe(
@@ -3711,29 +3656,203 @@ export const UpdateFlowDefinitionResponse = zod
           ),
       )
       .min(1)
+      .optional()
       .describe(
-        "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
+        "Replaces the full steps array if provided. Partial step lists are not\nsupported — supply all steps when updating this field.\n",
       ),
   })
   .describe(
-    "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project\/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST \/flow.\n",
-  )
-  .and(
-    zod.object({
-      id: zod.string().describe("Unique identifier for the flow definition."),
-      project_id: zod
+    "Partial update for a flow definition. Only provided fields are replaced;\nomitted fields retain their current server-side values.\n\nCollection fields (`steps`, `purposes`) are treated atomically: if\nprovided, the entire array\/object is replaced. If omitted, the current\nvalue is preserved unchanged.\n\n`name` is a stable identifier and cannot be changed after creation.\n",
+  );
+
+export const updateFlowDefinitionResponseFlowDefinitionNameRegExp = new RegExp(
+  "^[a-z][a-z0-9-]\*$",
+);
+export const updateFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault = [];
+export const updateFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault = false;
+export const updateFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault = [];
+export const updateFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault = {} as const;
+export const updateFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault = [];
+
+export const UpdateFlowDefinitionResponse = zod.object({
+  id: zod.string().describe("Unique identifier for the flow definition."),
+  project_id: zod.string().describe("Identifier of the project this flow definition belongs to."),
+  status: zod.string().describe("Status of the flow definition."),
+  flow_definition: zod
+    .object({
+      name: zod
         .string()
-        .describe("Identifier of the project this flow definition belongs to."),
-      schema_uri: zod
+        .regex(updateFlowDefinitionResponseFlowDefinitionNameRegExp)
+        .describe(
+          "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
+        ),
+      user_schema: zod
         .url()
         .describe(
-          "URI of the flow definition schema this definition was authored against.\nIf the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.\n",
+          "User schema this flow operates on. Step `fields` reference properties\ndefined in this schema. The engine resolves field types, validation,\nand implicit outcomes from schema annotations at runtime.\n",
         ),
-      status: zod.string().describe("Status of the flow definition."),
-      created_at: zod.iso.datetime({ offset: true }),
-      updated_at: zod.iso.datetime({ offset: true }),
-    }),
-  );
+      purposes: zod
+        .record(zod.string(), zod.string())
+        .describe(
+          "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login\/register\nflow) by listing one entry per purpose.\n",
+        ),
+      audience: zod
+        .object({
+          team_ids: zod
+            .array(zod.string())
+            .optional()
+            .describe(
+              "Restrict to specific teams (organizations). Empty means no team restriction.",
+            ),
+          app_ids: zod
+            .array(zod.string())
+            .optional()
+            .describe("Restrict to specific applications. Empty means no app restriction."),
+        })
+        .optional()
+        .describe(
+          'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
+        ),
+      steps: zod
+        .array(
+          zod
+            .object({
+              name: zod
+                .string()
+                .describe(
+                  "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
+                ),
+              fields: zod
+                .array(zod.string())
+                .default(updateFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault)
+                .describe(
+                  "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
+                ),
+              actions: zod
+                .array(
+                  zod
+                    .object({
+                      name: zod
+                        .string()
+                        .describe(
+                          "Action identifier. Sent back in the submit request as `action`.",
+                        ),
+                      primary: zod
+                        .boolean()
+                        .default(
+                          updateFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault,
+                        )
+                        .describe(
+                          "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
+                        ),
+                      text_key: zod
+                        .string()
+                        .optional()
+                        .describe(
+                          "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
+                        ),
+                    })
+                    .describe(
+                      "Configuration for a user-invokable action on a step. The `name` is sent\nback in the submit request as `action`.\n",
+                    ),
+                )
+                .default(updateFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault)
+                .describe(
+                  "Ordered list of actions the user can take. The action name is what the\nfrontend sends back in the submit request. If omitted, the engine\nprovides a default `submit` action.\n",
+                ),
+              gates: zod
+                .record(
+                  zod.string(),
+                  zod
+                    .object({
+                      kind: zod
+                        .enum(["captcha"])
+                        .describe(
+                          "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
+                        ),
+                      provider: zod
+                        .string()
+                        .describe(
+                          "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                        ),
+                      config: zod
+                        .record(zod.string(), zod.unknown())
+                        .optional()
+                        .describe(
+                          "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                        ),
+                    })
+                    .describe(
+                      "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
+                    ),
+                )
+                .default(updateFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault)
+                .describe(
+                  'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
+                ),
+              sso_providers: zod
+                .array(
+                  zod
+                    .object({
+                      id: zod.string().describe("Provider instance identifier."),
+                      name: zod.string().describe("Display name for the provider."),
+                      template: zod
+                        .string()
+                        .describe("Template hint for rendering (logo, colors)."),
+                    })
+                    .describe("An available SSO identity provider."),
+                )
+                .default(updateFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault)
+                .describe("Available SSO identity providers for this step."),
+              on_success: zod
+                .enum(["create_user"])
+                .optional()
+                .describe(
+                  "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
+                ),
+              complete: zod
+                .enum(["redirect", "show"])
+                .optional()
+                .describe(
+                  "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
+                ),
+              transitions: zod
+                .record(
+                  zod.string(),
+                  zod.object({
+                    target: zod
+                      .string()
+                      .describe(
+                        "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
+                      ),
+                    action: zod
+                      .union([zod.enum(["switch", "pivot"]), zod.null()])
+                      .optional()
+                      .describe(
+                        "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
+                      ),
+                  }),
+                )
+                .optional()
+                .describe(
+                  "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
+                ),
+            })
+            .describe(
+              "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
+            ),
+        )
+        .min(1)
+        .describe(
+          "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
+        ),
+    })
+    .describe(
+      "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project\/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST \/flow.\n",
+    ),
+  created_at: zod.iso.datetime({ offset: true }),
+  updated_at: zod.iso.datetime({ offset: true }),
+});
 
 /**
  * Delete a flow definition by id
@@ -3743,6 +3862,15 @@ export const DeleteFlowDefinitionParams = zod.object({
   id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
 });
 
+export const deleteFlowDefinitionQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const DeleteFlowDefinitionQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(deleteFlowDefinitionQueryProjectIdRegExp)
+    .describe("The project id to filter by."),
+});
+
 /**
  * @summary Create team
  */