@zitadel/api 0.0.0 → 0.1.0-alpha.10

package/dist/{index-DlEenfQJ.d.mts → index-BGnjxx-b.d.mts}

@@ -629,7 +629,7 @@ type CreateFlow201Branding = {
   hero_url?: string;
 };
 //#endregion
-//#region src/generated/model/createFlow201StepActions.d.ts
+//#region src/generated/model/createFlow201StepActionsItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -638,24 +638,23 @@ type CreateFlow201Branding = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Unordered dictionary of available user actions. Keyed by action name.
-The LiquidJS template controls positioning and presentation.
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
 
  */
-type CreateFlow201StepActions = {
-  [key: string]: {
-    /** Marks this as the default/primary action. The runtime template uses
-    this hint to choose visual emphasis. At most one action per step
-    should be primary; this is not enforced here.
-    */
-    primary?: boolean;
-    /** Optional localization key override for the action's label. When
-    omitted, the engine derives a key from the step and action names.
-    Display text is resolved client-side from a locale dictionary, never
-    by the engine.
-    */
-    text_key?: string;
-  };
+type CreateFlow201StepActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+  text_key?: string;
 };
 //#endregion
 //#region src/generated/model/createFlow201StepChallengeMethod.d.ts
@@ -738,7 +737,7 @@ declare const CreateFlow201StepComplete: {
   readonly show: "show";
 };
 //#endregion
-//#region src/generated/model/createFlow201StepFieldsType.d.ts
+//#region src/generated/model/createFlow201StepFieldsItemType.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -747,14 +746,15 @@ declare const CreateFlow201StepComplete: {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * The input kind the client should render. Encodes the formats that
-have a matching HTML input type (email, url, date). For other
-formats (e.g. uuid) the type is `text` and `validation.format`
-carries the rule.
+ * The input kind the client should render. Encodes the formats and
+JSON types that map to a familiar HTML input: `email`, `url`,
+`date` come from `format`; `checkbox` from JSON `type: boolean`;
+`select` from a closed `enum`. For other formats (e.g. uuid) the
+type is `text` and `validation.format` carries the rule.
 
  */
-type CreateFlow201StepFieldsType = (typeof CreateFlow201StepFieldsType)[keyof typeof CreateFlow201StepFieldsType];
-declare const CreateFlow201StepFieldsType: {
+type CreateFlow201StepFieldsItemType = (typeof CreateFlow201StepFieldsItemType)[keyof typeof CreateFlow201StepFieldsItemType];
+declare const CreateFlow201StepFieldsItemType: {
   readonly text: "text";
   readonly email: "email";
   readonly password: "password";
@@ -763,9 +763,11 @@ declare const CreateFlow201StepFieldsType: {
   readonly url: "url";
   readonly date: "date";
   readonly hidden: "hidden";
+  readonly checkbox: "checkbox";
+  readonly select: "select";
 };
 //#endregion
-//#region src/generated/model/createFlow201StepFieldsValidationFormat.d.ts
+//#region src/generated/model/createFlow201StepFieldsItemValidationFormat.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -781,15 +783,15 @@ sufficient for client-side validation. When `type` is `text`
 (e.g. `format: uuid`), this key is the only signal.
 
  */
-type CreateFlow201StepFieldsValidationFormat = (typeof CreateFlow201StepFieldsValidationFormat)[keyof typeof CreateFlow201StepFieldsValidationFormat];
-declare const CreateFlow201StepFieldsValidationFormat: {
+type CreateFlow201StepFieldsItemValidationFormat = (typeof CreateFlow201StepFieldsItemValidationFormat)[keyof typeof CreateFlow201StepFieldsItemValidationFormat];
+declare const CreateFlow201StepFieldsItemValidationFormat: {
   readonly email: "email";
   readonly "date-time": "date-time";
   readonly uuid: "uuid";
   readonly uri: "uri";
 };
 //#endregion
-//#region src/generated/model/createFlow201StepFieldsValidation.d.ts
+//#region src/generated/model/createFlow201StepFieldsItemValidation.d.ts
 /**
  * Schema-derived rules the frontend SHOULD apply at input time. The
 server runs the same rules on submit and is the only authority on
@@ -801,14 +803,14 @@ Each key mirrors a JSON Schema keyword on the underlying user
 property; absent keys mean no rule.
 
  */
-type CreateFlow201StepFieldsValidation = {
+type CreateFlow201StepFieldsItemValidation = {
   /** Semantic format the value must match. Values mirror the user
   meta-schema. When `type` already encodes the format (email,
   url, date), this key is informative and the input type is
   sufficient for client-side validation. When `type` is `text`
   (e.g. `format: uuid`), this key is the only signal.
    */
-  format?: CreateFlow201StepFieldsValidationFormat;
+  format?: CreateFlow201StepFieldsItemValidationFormat;
   /**
    * Minimum length in characters (inclusive). Mirrors `minLength`.
    * @minimum 0
@@ -819,40 +821,47 @@ type CreateFlow201StepFieldsValidation = {
    * @minimum 0
    */
   max_length?: number;
+  /** Closed list of allowed values. Mirrors the JSON Schema `enum`
+  keyword on the underlying user property. When `type` is
+  `select` the client renders these as options; for other types
+  the rule still applies as a membership check.
+   */
+  enum?: string[];
 };
 //#endregion
-//#region src/generated/model/createFlow201StepFields.d.ts
+//#region src/generated/model/createFlow201StepFieldsItem.d.ts
 /**
- * Unordered dictionary of input fields to collect. Keyed by field name.
-The LiquidJS template controls which fields appear and in what order.
-Field metadata (type, validation) is resolved by the engine from the
-flow's user schema.
+ * A data input capability. Describes what the user must provide.
+Does not contain display text — only a `text_key` resolved client-side.
 
  */
-type CreateFlow201StepFields = {
-  [key: string]: {
-    /** The input kind the client should render. Encodes the formats that
-    have a matching HTML input type (email, url, date). For other
-    formats (e.g. uuid) the type is `text` and `validation.format`
-    carries the rule.
-    */
-    type: CreateFlow201StepFieldsType; /** Localization key for the field label. */
-    text_key: string;
-    /** The field MUST be present and non-empty on submit. Mirrors the
-    schema's top-level `required` array.
-    */
-    required?: boolean; /** Pre-filled value (e.g., an identifier carried over from a pivot). */
-    value?: unknown;
-    /** Schema-derived rules the frontend SHOULD apply at input time. The
-    server runs the same rules on submit and is the only authority on
-    whether the step advances — these rules are a UX hint to reduce
-    round trips, not a contract guarantee.
-       Omitted entirely when the field has no rules beyond its `type`.
-    Each key mirrors a JSON Schema keyword on the underlying user
-    property; absent keys mean no rule.
-    */
-    validation?: CreateFlow201StepFieldsValidation;
-  };
+type CreateFlow201StepFieldsItem = {
+  /** Field name, matching a property in the flow's user schema. Carries
+  the submitted value back to the engine.
+   */
+  name: string;
+  /** The input kind the client should render. Encodes the formats and
+  JSON types that map to a familiar HTML input: `email`, `url`,
+  `date` come from `format`; `checkbox` from JSON `type: boolean`;
+  `select` from a closed `enum`. For other formats (e.g. uuid) the
+  type is `text` and `validation.format` carries the rule.
+   */
+  type: CreateFlow201StepFieldsItemType; /** Localization key for the field label. */
+  text_key: string;
+  /** The field MUST be present and non-empty on submit. Mirrors the
+  schema's top-level `required` array.
+   */
+  required?: boolean; /** Pre-filled value (e.g., an identifier carried over from a pivot). */
+  value?: unknown;
+  /** Schema-derived rules the frontend SHOULD apply at input time. The
+  server runs the same rules on submit and is the only authority on
+  whether the step advances — these rules are a UX hint to reduce
+  round trips, not a contract guarantee.
+     Omitted entirely when the field has no rules beyond its `type`.
+  Each key mirrors a JSON Schema keyword on the underlying user
+  property; absent keys mean no rule.
+   */
+  validation?: CreateFlow201StepFieldsItemValidation;
 };
 //#endregion
 //#region src/generated/model/createFlow201StepGatesConfig.d.ts
@@ -954,9 +963,10 @@ type CreateFlow201StepTexts = {
 //#endregion
 //#region src/generated/model/createFlow201Step.d.ts
 /**
- * A step contains unordered capability dictionaries: what to collect (fields),
+ * A step contains ordered capability arrays: what to collect (fields),
 what the user can do (actions), and what security gates must be satisfied (gates).
-Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+and builds name-keyed indexes locally for lookup.
 
  */
 type CreateFlow201Step = {
@@ -972,16 +982,16 @@ type CreateFlow201Step = {
    */
   complete?: CreateFlow201StepComplete; /** URL to navigate to (e.g., SSO provider redirect). */
   redirect_url?: string;
-  /** Unordered dictionary of input fields to collect. Keyed by field name.
-  The LiquidJS template controls which fields appear and in what order.
-  Field metadata (type, validation) is resolved by the engine from the
-  flow's user schema.
+  /** Ordered list of input fields to collect. Field metadata (type, validation)
+  is resolved by the engine from the flow's user schema. The LiquidJS
+  template iterates this array; for keyed lookup it builds a name-indexed
+  map locally.
    */
-  fields: CreateFlow201StepFields;
-  /** Unordered dictionary of available user actions. Keyed by action name.
-  The LiquidJS template controls positioning and presentation.
+  fields: CreateFlow201StepFieldsItem[];
+  /** Ordered list of available user actions. The LiquidJS template iterates
+  this array and builds a name-indexed map locally for keyed lookup.
    */
-  actions: CreateFlow201StepActions;
+  actions: CreateFlow201StepActionsItem[];
   /** Security gates that must be satisfied before the step can be submitted.
   The engine injects gates dynamically based on policy, even if they
   are not declared in the flow definition.
@@ -1007,9 +1017,10 @@ type CreateFlow201 = {
   id: string; /** Underlying session ID. Stable across all stacked flows. */
   session_id: string; /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */
   session_token?: string;
-  /** A step contains unordered capability dictionaries: what to collect (fields),
+  /** A step contains ordered capability arrays: what to collect (fields),
   what the user can do (actions), and what security gates must be satisfied (gates).
-  Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+  The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+  and builds name-keyed indexes locally for lookup.
    */
   step: CreateFlow201Step;
   /** Resolved branding configuration. Inherited from the app → team → project
@@ -1143,207 +1154,7 @@ type CreateFlowDefault = {
   details?: CreateFlowDefaultDetails;
 };
 //#endregion
-//#region src/generated/model/createFlowDefinition201.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type CreateFlowDefinition201 = {
-  /**
-     * Stable identifier for this flow, used as the target of cross-flow
-  `switch` and `pivot` transitions. Renaming is not supported — the
-  `name` is part of the public contract another definition may
-  reference. Acts as the human display label as well; no separate slug.
-        * @pattern ^[a-z][a-z0-9-]*$
-     */
-  name: string;
-  /** User schema this flow operates on. Step `fields` reference properties
-  defined in this schema. The engine resolves field types, validation,
-  and implicit outcomes from schema annotations at runtime.
-   */
-  user_schema: string;
-  /** Maps each purpose this definition handles to its entry-point step.
-  Keys are purpose names; values must match a `name` in `steps`. A
-  definition can serve multiple purposes (e.g. a combined login/register
-  flow) by listing one entry per purpose.
-   */
-  purposes: Partial<Record<"login" | "register" | "recovery" | "profiling" | "reauth" | "link_account", string>>;
-  /** Scopes which teams or apps this flow definition applies to. Empty or
-  omitted fields mean "no restriction"; when both are empty the definition
-  matches every request in the project. The engine picks the most specific
-  matching definition: app > team > project-wide.
-   */
-  audience?: {
-    /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
-    app_ids?: string[];
-  };
-  /**
-     * Ordered list of steps in this flow. The order is for human readability —
-  actual step sequencing is determined by transitions.
-        * @minItems 1
-     */
-  steps: {
-    /** Unique step identifier within this flow. Used as transition targets
-    and returned in the API response as `step.name`.
-    */
-    name: string;
-    /** Schema property names to collect from the user. Each entry references
-    a property in the flow's user schema. The engine resolves field type,
-    validation rules, and implicit outcomes from schema annotations
-    (e.g. a property with `x-unique` set implies a `user_not_found`
-    transition outcome).
-    */
-    fields?: string[];
-    /** Actions the user can take. Keyed by action name.
-    The action name is what the frontend sends back in the submit request.
-    If omitted, the engine provides a default `submit` action.
-    */
-    actions?: {
-      [key: string]: {
-        /** Marks this as the default/primary action. The runtime template uses
-        this hint to choose visual emphasis. At most one action per step
-        should be primary; this is not enforced here.
-        */
-        primary?: boolean;
-        /** Optional localization key override for the action's label. When
-        omitted, the engine derives a key from the step and action names.
-        Display text is resolved client-side from a locale dictionary, never
-        by the engine.
-        */
-        text_key?: string;
-      };
-    };
-    /** Security gates that must be satisfied before submission. Keyed by gate
-    name. Each gate selects a kind (e.g. "captcha") and provider-specific
-    configuration. The engine may also inject gates dynamically based on
-    policy.
-    */
-    gates?: {
-      [key: string]: {
-        /** The gate category. Only `captcha` is currently defined. Authenticator
-        ceremonies (e.g. passkey) are modelled as credential auth_attempts via
-        `x-credential` on a field, not as gates.
-        */
-        kind: "captcha";
-        /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
-        `hcaptcha`. The engine looks up an implementation in its provider
-        registry.
-        */
-        provider: string;
-        /** Provider-specific configuration consumed by the implementation when
-        issuing the per-render challenge. Opaque to the engine.
-        */
-        config?: {
-          [key: string]: unknown;
-        };
-      };
-    }; /** Available SSO identity providers for this step. */
-    sso_providers?: {
-      /** Provider instance identifier. */id: string; /** Display name for the provider. */
-      name: string; /** Template hint for rendering (logo, colors). */
-      template: string;
-    }[];
-    /** Server-side mutation to execute when this step completes successfully.
-    Runs after field validation passes, before the transition fires.
-       - create_user: creates the user record (registration flows)
-    */
-    on_success?: "create_user";
-    /** Marks this as a terminal step. Tells the frontend what to do:
-    - redirect: navigate to redirect_uri (OIDC/SAML callback done)
-    - show: render as a success/info screen
-    */
-    complete?: "redirect" | "show";
-    /** Maps action/outcome names to their transition descriptor.
-       Keys match action names from the `actions` dict. Additional keys
-    come from implicit outcomes based on schema annotations
-    (e.g. `user_not_found` from `x-unique` fields) and engine
-    events (e.g. `sso`, `callback`).
-    */
-    transitions?: {
-      [key: string]: {
-        /** Step name within this flow (when `action` is null), or the name
-        of another flow (when `action` is `switch` or `pivot`).
-        */
-        target: string;
-        /** How to interpret `target`:
-        - null (omitted): transition to a step in the current flow.
-        - switch: replace the current flow with the target flow.
-        No return — the current flow is discarded.
-        Example: login ↔ register.
-        - pivot: push the target flow onto the stack. The current flow
-        is paused and resumes when the target flow completes (auto-pop).
-        Example: login → recovery → back to login.
-        */
-        action?: "switch" | "pivot" | null;
-      };
-    };
-  }[];
-} & {
-  /** Unique identifier for the flow definition. */id: string; /** Identifier of the project this flow definition belongs to. */
-  project_id: string;
-  /** URI of the flow definition schema this definition was authored against.
-  If the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.
-   */
-  schema_uri: string; /** Status of the flow definition. */
-  status: string;
-  created_at: string;
-  updated_at: string;
-};
-//#endregion
-//#region src/generated/model/createFlowDefinition400Details.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Additional error-specific context.
- */
-type CreateFlowDefinition400Details = {
-  [key: string]: unknown;
-};
-//#endregion
-//#region src/generated/model/createFlowDefinition400.d.ts
-/**
- * Standard error payload returned for failed API requests.
- */
-type CreateFlowDefinition400 = {
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: CreateFlowDefinition400Details;
-};
-//#endregion
-//#region src/generated/model/createFlowDefinition409Details.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Additional error-specific context.
- */
-type CreateFlowDefinition409Details = {
-  [key: string]: unknown;
-};
-//#endregion
-//#region src/generated/model/createFlowDefinition409.d.ts
-/**
- * Standard error payload returned for failed API requests.
- */
-type CreateFlowDefinition409 = {
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: CreateFlowDefinition409Details;
-};
-//#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionAudience.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionAudience.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1358,12 +1169,12 @@ matches every request in the project. The engine picks the most specific
 matching definition: app > team > project-wide.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionAudience = {
+type CreateFlowDefinition201FlowDefinitionAudience = {
   /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
   app_ids?: string[];
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemActions.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemActionsItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1372,28 +1183,26 @@ type CreateFlowDefinitionBodyFlowDefinitionAudience = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Actions the user can take. Keyed by action name.
-The action name is what the frontend sends back in the submit request.
-If omitted, the engine provides a default `submit` action.
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemActions = {
-  [key: string]: {
-    /** Marks this as the default/primary action. The runtime template uses
-    this hint to choose visual emphasis. At most one action per step
-    should be primary; this is not enforced here.
-    */
-    primary?: boolean;
-    /** Optional localization key override for the action's label. When
-    omitted, the engine derives a key from the step and action names.
-    Display text is resolved client-side from a locale dictionary, never
-    by the engine.
-    */
-    text_key?: string;
-  };
+type CreateFlowDefinition201FlowDefinitionStepsItemActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+  text_key?: string;
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemComplete.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemComplete.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1407,13 +1216,13 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItemActions = {
 - show: render as a success/info screen
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete];
-declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete: {
+type CreateFlowDefinition201FlowDefinitionStepsItemComplete = (typeof CreateFlowDefinition201FlowDefinitionStepsItemComplete)[keyof typeof CreateFlowDefinition201FlowDefinitionStepsItemComplete];
+declare const CreateFlowDefinition201FlowDefinitionStepsItemComplete: {
   readonly redirect: "redirect";
   readonly show: "show";
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemGatesConfig.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1426,11 +1235,11 @@ declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete: {
 issuing the per-render challenge. Opaque to the engine.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig = {
+type CreateFlowDefinition201FlowDefinitionStepsItemGatesConfig = {
   [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGatesKind.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemGatesKind.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1444,12 +1253,12 @@ ceremonies (e.g. passkey) are modelled as credential auth_attempts via
 `x-credential` on a field, not as gates.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind];
-declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind: {
+type CreateFlowDefinition201FlowDefinitionStepsItemGatesKind = (typeof CreateFlowDefinition201FlowDefinitionStepsItemGatesKind)[keyof typeof CreateFlowDefinition201FlowDefinitionStepsItemGatesKind];
+declare const CreateFlowDefinition201FlowDefinitionStepsItemGatesKind: {
   readonly captcha: "captcha";
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGates.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemGates.d.ts
 /**
  * Security gates that must be satisfied before submission. Keyed by gate
 name. Each gate selects a kind (e.g. "captcha") and provider-specific
@@ -1457,13 +1266,13 @@ configuration. The engine may also inject gates dynamically based on
 policy.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemGates = {
+type CreateFlowDefinition201FlowDefinitionStepsItemGates = {
   [key: string]: {
     /** The gate category. Only `captcha` is currently defined. Authenticator
     ceremonies (e.g. passkey) are modelled as credential auth_attempts via
     `x-credential` on a field, not as gates.
     */
-    kind: CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind;
+    kind: CreateFlowDefinition201FlowDefinitionStepsItemGatesKind;
     /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
     `hcaptcha`. The engine looks up an implementation in its provider
     registry.
@@ -1472,11 +1281,11 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItemGates = {
     /** Provider-specific configuration consumed by the implementation when
     issuing the per-render challenge. Opaque to the engine.
     */
-    config?: CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig;
+    config?: CreateFlowDefinition201FlowDefinitionStepsItemGatesConfig;
   };
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemOnSuccess.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1491,12 +1300,12 @@ Runs after field validation passes, before the transition fires.
 - create_user: creates the user record (registration flows)
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess];
-declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess: {
+type CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess = (typeof CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess)[keyof typeof CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess];
+declare const CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess: {
   readonly create_user: "create_user";
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemSsoProvidersItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1507,13 +1316,13 @@ declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess: {
 /**
  * An available SSO identity provider.
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem = {
+type CreateFlowDefinition201FlowDefinitionStepsItemSsoProvidersItem = {
   /** Provider instance identifier. */id: string; /** Display name for the provider. */
   name: string; /** Template hint for rendering (logo, colors). */
   template: string;
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemTransitions.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemTransitions.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1524,13 +1333,13 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem = {
 /**
  * Maps action/outcome names to their transition descriptor.
 
-Keys match action names from the `actions` dict. Additional keys
+Keys match action names from the `actions` array. Additional keys
 come from implicit outcomes based on schema annotations
 (e.g. `user_not_found` from `x-unique` fields) and engine
 events (e.g. `sso`, `callback`).
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions = {
+type CreateFlowDefinition201FlowDefinitionStepsItemTransitions = {
   [key: string]: {
     /** Step name within this flow (when `action` is null), or the name
     of another flow (when `action` is `switch` or `pivot`).
@@ -1549,7 +1358,7 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions = {
   };
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItem.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItem.d.ts
 /**
  * A step in a flow definition. This is the admin-authored configuration,
 not the runtime payload sent to the frontend.
@@ -1562,7 +1371,7 @@ A step with only `complete` set is a terminal step. All other steps are
 rendered to the frontend as capability payloads.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItem = {
+type CreateFlowDefinition201FlowDefinitionStepsItem = {
   /** Unique step identifier within this flow. Used as transition targets
   and returned in the API response as `step.name`.
    */
@@ -1574,38 +1383,38 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItem = {
   transition outcome).
    */
   fields?: string[];
-  /** Actions the user can take. Keyed by action name.
-  The action name is what the frontend sends back in the submit request.
-  If omitted, the engine provides a default `submit` action.
+  /** Ordered list of actions the user can take. The action name is what the
+  frontend sends back in the submit request. If omitted, the engine
+  provides a default `submit` action.
    */
-  actions?: CreateFlowDefinitionBodyFlowDefinitionStepsItemActions;
+  actions?: CreateFlowDefinition201FlowDefinitionStepsItemActionsItem[];
   /** Security gates that must be satisfied before submission. Keyed by gate
   name. Each gate selects a kind (e.g. "captcha") and provider-specific
   configuration. The engine may also inject gates dynamically based on
   policy.
    */
-  gates?: CreateFlowDefinitionBodyFlowDefinitionStepsItemGates; /** Available SSO identity providers for this step. */
-  sso_providers?: CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem[];
+  gates?: CreateFlowDefinition201FlowDefinitionStepsItemGates; /** Available SSO identity providers for this step. */
+  sso_providers?: CreateFlowDefinition201FlowDefinitionStepsItemSsoProvidersItem[];
   /** Server-side mutation to execute when this step completes successfully.
   Runs after field validation passes, before the transition fires.
      - create_user: creates the user record (registration flows)
    */
-  on_success?: CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess;
+  on_success?: CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess;
   /** Marks this as a terminal step. Tells the frontend what to do:
   - redirect: navigate to redirect_uri (OIDC/SAML callback done)
   - show: render as a success/info screen
    */
-  complete?: CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete;
+  complete?: CreateFlowDefinition201FlowDefinitionStepsItemComplete;
   /** Maps action/outcome names to their transition descriptor.
-     Keys match action names from the `actions` dict. Additional keys
+     Keys match action names from the `actions` array. Additional keys
   come from implicit outcomes based on schema annotations
   (e.g. `user_not_found` from `x-unique` fields) and engine
   events (e.g. `sso`, `callback`).
    */
-  transitions?: CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions;
+  transitions?: CreateFlowDefinition201FlowDefinitionStepsItemTransitions;
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinition.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinition.d.ts
 /**
  * A flow definition is the server-side configuration that describes a complete
 authentication or identity flow. It is NOT sent to the frontend — the flow
@@ -1617,7 +1426,7 @@ configuration hierarchy. The engine selects the matching definition based on
 the purpose + audience when a flow is created via POST /flow.
 
  */
-type CreateFlowDefinitionBodyFlowDefinition = {
+type CreateFlowDefinition201FlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
   `switch` and `pivot` transitions. Renaming is not supported — the
@@ -1642,23 +1451,20 @@ type CreateFlowDefinitionBodyFlowDefinition = {
   matches every request in the project. The engine picks the most specific
   matching definition: app > team > project-wide.
    */
-  audience?: CreateFlowDefinitionBodyFlowDefinitionAudience;
+  audience?: CreateFlowDefinition201FlowDefinitionAudience;
   /**
      * Ordered list of steps in this flow. The order is for human readability —
   actual step sequencing is determined by transitions.
         * @minItems 1
      */
-  steps: CreateFlowDefinitionBodyFlowDefinitionStepsItem[];
+  steps: CreateFlowDefinition201FlowDefinitionStepsItem[];
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBody.d.ts
-type CreateFlowDefinitionBody = {
-  /** @pattern ^[a-zA-Z0-9_-]+$ */project_id: string;
-  /** URI of the server-published flow definition schema this definition was
-  authored against. The server uses this to validate the definition.
-  If not provided, the engine will use the latest schema version for validation.
-   */
-  schema_uri?: string;
+//#region src/generated/model/createFlowDefinition201.d.ts
+type CreateFlowDefinition201 = {
+  /** Unique identifier for the flow definition. */id: string; /** Identifier of the project this flow definition belongs to. */
+  project_id: string; /** Status of the flow definition. */
+  status: string;
   /** A flow definition is the server-side configuration that describes a complete
   authentication or identity flow. It is NOT sent to the frontend — the flow
   engine evaluates it and produces FlowResponse payloads (steps with capability
@@ -1667,10 +1473,12 @@ type CreateFlowDefinitionBody = {
   configuration hierarchy. The engine selects the matching definition based on
   the purpose + audience when a flow is created via POST /flow.
    */
-  flow_definition: CreateFlowDefinitionBodyFlowDefinition;
+  flow_definition: CreateFlowDefinition201FlowDefinition;
+  created_at: string;
+  updated_at: string;
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionDefaultDetails.d.ts
+//#region src/generated/model/createFlowDefinition400Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1681,21 +1489,21 @@ type CreateFlowDefinitionBody = {
 /**
  * Additional error-specific context.
  */
-type CreateFlowDefinitionDefaultDetails = {
+type CreateFlowDefinition400Details = {
   [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionDefault.d.ts
+//#region src/generated/model/createFlowDefinition400.d.ts
 /**
  * Standard error payload returned for failed API requests.
  */
-type CreateFlowDefinitionDefault = {
+type CreateFlowDefinition400 = {
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: CreateFlowDefinitionDefaultDetails;
+  details?: CreateFlowDefinition400Details;
 };
 //#endregion
-//#region src/generated/model/createHandoff200.d.ts
+//#region src/generated/model/createFlowDefinition409Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1704,69 +1512,23 @@ type CreateFlowDefinitionDefault = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * The handoff token and metadata for session exchange.
-
-This is a short-lived credential (TTL ≤ 60 seconds) that the client must exchange
-at POST /sessions/exchange to receive the final session and session_token.
-The handoff token is single-use and audience-bound to the project.
-
+ * Additional error-specific context.
  */
-type CreateHandoff200 = {
-  /** The short-lived handoff token for session exchange.
-     Exchange at: POST /sessions/exchange
-     Requirements:
-  - Single-use (atomic GETDEL on exchange)
-  - TTL ≤ 60 seconds
-  - Audience-bound to project (exchange requires sk_proj_… for matching project)
-  - Idempotency-safe (Category B, 5-minute window)
-   */
-  handoff_token: string; /** When this handoff token expires */
-  expires_at: string;
+type CreateFlowDefinition409Details = {
+  [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/createHandoffDefault.d.ts
+//#region src/generated/model/createFlowDefinition409.d.ts
 /**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
+ * Standard error payload returned for failed API requests.
  */
-type CreateHandoffDefault = ({
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: {
-    [key: string]: unknown;
-  };
-} & {
-  code: "att.not_found";
-}) | ({
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: {
-    [key: string]: unknown;
-  };
-} & {
-  code: "att.invalid_state";
-}) | ({
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: {
-    [key: string]: unknown;
-  };
-} & {
-  code: "att.not_completed";
-}) | ({
+type CreateFlowDefinition409 = {
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: {
-    [key: string]: unknown;
-  };
-} & {
-  code: "internal";
-});
+  details?: CreateFlowDefinition409Details;
+};
 //#endregion
-//#region src/generated/model/createProject201.d.ts
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionAudience.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1774,7 +1536,428 @@ type CreateHandoffDefault = ({
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type CreateProject201 = {
+/**
+ * Scopes which teams or apps this flow definition applies to. Empty or
+omitted fields mean "no restriction"; when both are empty the definition
+matches every request in the project. The engine picks the most specific
+matching definition: app > team > project-wide.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionAudience = {
+  /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
+  app_ids?: string[];
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemActionsItem.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+  text_key?: string;
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemComplete.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Marks this as a terminal step. Tells the frontend what to do:
+- redirect: navigate to redirect_uri (OIDC/SAML callback done)
+- show: render as a success/info screen
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete];
+declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete: {
+  readonly redirect: "redirect";
+  readonly show: "show";
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Provider-specific configuration consumed by the implementation when
+issuing the per-render challenge. Opaque to the engine.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGatesKind.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The gate category. Only `captcha` is currently defined. Authenticator
+ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+`x-credential` on a field, not as gates.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind];
+declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind: {
+  readonly captcha: "captcha";
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGates.d.ts
+/**
+ * Security gates that must be satisfied before submission. Keyed by gate
+name. Each gate selects a kind (e.g. "captcha") and provider-specific
+configuration. The engine may also inject gates dynamically based on
+policy.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemGates = {
+  [key: string]: {
+    /** The gate category. Only `captcha` is currently defined. Authenticator
+    ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+    `x-credential` on a field, not as gates.
+    */
+    kind: CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind;
+    /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
+    `hcaptcha`. The engine looks up an implementation in its provider
+    registry.
+    */
+    provider: string;
+    /** Provider-specific configuration consumed by the implementation when
+    issuing the per-render challenge. Opaque to the engine.
+    */
+    config?: CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig;
+  };
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Server-side mutation to execute when this step completes successfully.
+Runs after field validation passes, before the transition fires.
+
+- create_user: creates the user record (registration flows)
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess];
+declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess: {
+  readonly create_user: "create_user";
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * An available SSO identity provider.
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem = {
+  /** Provider instance identifier. */id: string; /** Display name for the provider. */
+  name: string; /** Template hint for rendering (logo, colors). */
+  template: string;
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemTransitions.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Maps action/outcome names to their transition descriptor.
+
+Keys match action names from the `actions` array. Additional keys
+come from implicit outcomes based on schema annotations
+(e.g. `user_not_found` from `x-unique` fields) and engine
+events (e.g. `sso`, `callback`).
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions = {
+  [key: string]: {
+    /** Step name within this flow (when `action` is null), or the name
+    of another flow (when `action` is `switch` or `pivot`).
+    */
+    target: string;
+    /** How to interpret `target`:
+    - null (omitted): transition to a step in the current flow.
+    - switch: replace the current flow with the target flow.
+    No return — the current flow is discarded.
+    Example: login ↔ register.
+    - pivot: push the target flow onto the stack. The current flow
+    is paused and resumes when the target flow completes (auto-pop).
+    Example: login → recovery → back to login.
+    */
+    action?: "switch" | "pivot" | null;
+  };
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItem.d.ts
+/**
+ * A step in a flow definition. This is the admin-authored configuration,
+not the runtime payload sent to the frontend.
+
+Steps are schema-driven: `fields` references properties from the flow's
+user schema, and the engine resolves field metadata (type, validation,
+implicit outcomes) from schema annotations at runtime.
+
+A step with only `complete` set is a terminal step. All other steps are
+rendered to the frontend as capability payloads.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItem = {
+  /** Unique step identifier within this flow. Used as transition targets
+  and returned in the API response as `step.name`.
+   */
+  name: string;
+  /** Schema property names to collect from the user. Each entry references
+  a property in the flow's user schema. The engine resolves field type,
+  validation rules, and implicit outcomes from schema annotations
+  (e.g. a property with `x-unique` set implies a `user_not_found`
+  transition outcome).
+   */
+  fields?: string[];
+  /** Ordered list of actions the user can take. The action name is what the
+  frontend sends back in the submit request. If omitted, the engine
+  provides a default `submit` action.
+   */
+  actions?: CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItem[];
+  /** Security gates that must be satisfied before submission. Keyed by gate
+  name. Each gate selects a kind (e.g. "captcha") and provider-specific
+  configuration. The engine may also inject gates dynamically based on
+  policy.
+   */
+  gates?: CreateFlowDefinitionBodyFlowDefinitionStepsItemGates; /** Available SSO identity providers for this step. */
+  sso_providers?: CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem[];
+  /** Server-side mutation to execute when this step completes successfully.
+  Runs after field validation passes, before the transition fires.
+     - create_user: creates the user record (registration flows)
+   */
+  on_success?: CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess;
+  /** Marks this as a terminal step. Tells the frontend what to do:
+  - redirect: navigate to redirect_uri (OIDC/SAML callback done)
+  - show: render as a success/info screen
+   */
+  complete?: CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete;
+  /** Maps action/outcome names to their transition descriptor.
+     Keys match action names from the `actions` array. Additional keys
+  come from implicit outcomes based on schema annotations
+  (e.g. `user_not_found` from `x-unique` fields) and engine
+  events (e.g. `sso`, `callback`).
+   */
+  transitions?: CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions;
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinition.d.ts
+/**
+ * A flow definition is the server-side configuration that describes a complete
+authentication or identity flow. It is NOT sent to the frontend — the flow
+engine evaluates it and produces FlowResponse payloads (steps with capability
+dictionaries) for the client.
+
+Flow definitions are created by administrators and stored in the project/team
+configuration hierarchy. The engine selects the matching definition based on
+the purpose + audience when a flow is created via POST /flow.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinition = {
+  /**
+     * Stable identifier for this flow, used as the target of cross-flow
+  `switch` and `pivot` transitions. Renaming is not supported — the
+  `name` is part of the public contract another definition may
+  reference. Acts as the human display label as well; no separate slug.
+        * @pattern ^[a-z][a-z0-9-]*$
+     */
+  name: string;
+  /** User schema this flow operates on. Step `fields` reference properties
+  defined in this schema. The engine resolves field types, validation,
+  and implicit outcomes from schema annotations at runtime.
+   */
+  user_schema: string;
+  /** Maps each purpose this definition handles to its entry-point step.
+  Keys are purpose names; values must match a `name` in `steps`. A
+  definition can serve multiple purposes (e.g. a combined login/register
+  flow) by listing one entry per purpose.
+   */
+  purposes: Partial<Record<"login" | "register" | "recovery" | "profiling" | "reauth" | "link_account", string>>;
+  /** Scopes which teams or apps this flow definition applies to. Empty or
+  omitted fields mean "no restriction"; when both are empty the definition
+  matches every request in the project. The engine picks the most specific
+  matching definition: app > team > project-wide.
+   */
+  audience?: CreateFlowDefinitionBodyFlowDefinitionAudience;
+  /**
+     * Ordered list of steps in this flow. The order is for human readability —
+  actual step sequencing is determined by transitions.
+        * @minItems 1
+     */
+  steps: CreateFlowDefinitionBodyFlowDefinitionStepsItem[];
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBody.d.ts
+type CreateFlowDefinitionBody = {
+  /** @pattern ^[a-zA-Z0-9_-]+$ */project_id: string;
+  /** URI of the server-published flow definition schema this definition was
+  authored against. The server uses this to validate the definition.
+  If not provided, the engine will use the latest schema version for validation.
+   */
+  schema_uri?: string;
+  /** A flow definition is the server-side configuration that describes a complete
+  authentication or identity flow. It is NOT sent to the frontend — the flow
+  engine evaluates it and produces FlowResponse payloads (steps with capability
+  dictionaries) for the client.
+     Flow definitions are created by administrators and stored in the project/team
+  configuration hierarchy. The engine selects the matching definition based on
+  the purpose + audience when a flow is created via POST /flow.
+   */
+  flow_definition: CreateFlowDefinitionBodyFlowDefinition;
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type CreateFlowDefinitionDefaultDetails = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionDefault.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type CreateFlowDefinitionDefault = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: CreateFlowDefinitionDefaultDetails;
+};
+//#endregion
+//#region src/generated/model/createHandoff200.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The handoff token and metadata for session exchange.
+
+This is a short-lived credential (TTL ≤ 60 seconds) that the client must exchange
+at POST /sessions/exchange to receive the final session and session_token.
+The handoff token is single-use and audience-bound to the project.
+
+ */
+type CreateHandoff200 = {
+  /** The short-lived handoff token for session exchange.
+     Exchange at: POST /sessions/exchange
+     Requirements:
+  - Single-use (atomic GETDEL on exchange)
+  - TTL ≤ 60 seconds
+  - Audience-bound to project (exchange requires sk_proj_… for matching project)
+  - Idempotency-safe (Category B, 5-minute window)
+   */
+  handoff_token: string; /** When this handoff token expires */
+  expires_at: string;
+};
+//#endregion
+//#region src/generated/model/createHandoffDefault.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type CreateHandoffDefault = ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
+} & {
+  code: "att.not_found";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
+} & {
+  code: "att.invalid_state";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
+} & {
+  code: "att.not_completed";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
+} & {
+  code: "internal";
+});
+//#endregion
+//#region src/generated/model/createProject201.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type CreateProject201 = {
   /** The unique identifier of the project. */id: string;
   /** Secret which can be used for authentication when modifying the project.
    */
@@ -2603,7 +2786,7 @@ type CreateUserParams = {
   team_id?: string;
 };
 //#endregion
-//#region src/generated/model/deleteFlowDefinition404Details.d.ts
+//#region src/generated/model/deleteFlowDefinitionDefaultDetails.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2614,21 +2797,21 @@ type CreateUserParams = {
 /**
  * Additional error-specific context.
  */
-type DeleteFlowDefinition404Details = {
+type DeleteFlowDefinitionDefaultDetails = {
   [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/deleteFlowDefinition404.d.ts
+//#region src/generated/model/deleteFlowDefinitionDefault.d.ts
 /**
  * Standard error payload returned for failed API requests.
  */
-type DeleteFlowDefinition404 = {
+type DeleteFlowDefinitionDefault = {
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: DeleteFlowDefinition404Details;
+  details?: DeleteFlowDefinitionDefaultDetails;
 };
 //#endregion
-//#region src/generated/model/deleteFlowDefinitionDefaultDetails.d.ts
+//#region src/generated/model/deleteFlowDefinitionParams.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2636,21 +2819,12 @@ type DeleteFlowDefinition404 = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
-type DeleteFlowDefinitionDefaultDetails = {
-  [key: string]: unknown;
-};
-//#endregion
-//#region src/generated/model/deleteFlowDefinitionDefault.d.ts
-/**
- * Standard error payload returned for failed API requests.
- */
-type DeleteFlowDefinitionDefault = {
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: DeleteFlowDefinitionDefaultDetails;
+type DeleteFlowDefinitionParams = {
+  /**
+   * The project id to filter by.
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
 };
 //#endregion
 //#region src/generated/model/endSession400Details.d.ts
@@ -3369,15 +3543,279 @@ type GetAuthAttemptDefault = ({
   code: "internal";
 });
 //#endregion
-//#region src/generated/model/getFlowDefinition200.d.ts
+//#region src/generated/model/getFlowDefinition200FlowDefinitionAudience.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Scopes which teams or apps this flow definition applies to. Empty or
+omitted fields mean "no restriction"; when both are empty the definition
+matches every request in the project. The engine picks the most specific
+matching definition: app > team > project-wide.
+
+ */
+type GetFlowDefinition200FlowDefinitionAudience = {
+  /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
+  app_ids?: string[];
+};
+//#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemActionsItem.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+  text_key?: string;
+};
+//#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemComplete.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Marks this as a terminal step. Tells the frontend what to do:
+- redirect: navigate to redirect_uri (OIDC/SAML callback done)
+- show: render as a success/info screen
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemComplete = (typeof GetFlowDefinition200FlowDefinitionStepsItemComplete)[keyof typeof GetFlowDefinition200FlowDefinitionStepsItemComplete];
+declare const GetFlowDefinition200FlowDefinitionStepsItemComplete: {
+  readonly redirect: "redirect";
+  readonly show: "show";
+};
+//#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemGatesConfig.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Provider-specific configuration consumed by the implementation when
+issuing the per-render challenge. Opaque to the engine.
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemGatesConfig = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemGatesKind.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The gate category. Only `captcha` is currently defined. Authenticator
+ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+`x-credential` on a field, not as gates.
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemGatesKind = (typeof GetFlowDefinition200FlowDefinitionStepsItemGatesKind)[keyof typeof GetFlowDefinition200FlowDefinitionStepsItemGatesKind];
+declare const GetFlowDefinition200FlowDefinitionStepsItemGatesKind: {
+  readonly captcha: "captcha";
+};
+//#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemGates.d.ts
+/**
+ * Security gates that must be satisfied before submission. Keyed by gate
+name. Each gate selects a kind (e.g. "captcha") and provider-specific
+configuration. The engine may also inject gates dynamically based on
+policy.
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemGates = {
+  [key: string]: {
+    /** The gate category. Only `captcha` is currently defined. Authenticator
+    ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+    `x-credential` on a field, not as gates.
+    */
+    kind: GetFlowDefinition200FlowDefinitionStepsItemGatesKind;
+    /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
+    `hcaptcha`. The engine looks up an implementation in its provider
+    registry.
+    */
+    provider: string;
+    /** Provider-specific configuration consumed by the implementation when
+    issuing the per-render challenge. Opaque to the engine.
+    */
+    config?: GetFlowDefinition200FlowDefinitionStepsItemGatesConfig;
+  };
+};
+//#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemOnSuccess.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Server-side mutation to execute when this step completes successfully.
+Runs after field validation passes, before the transition fires.
+
+- create_user: creates the user record (registration flows)
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemOnSuccess = (typeof GetFlowDefinition200FlowDefinitionStepsItemOnSuccess)[keyof typeof GetFlowDefinition200FlowDefinitionStepsItemOnSuccess];
+declare const GetFlowDefinition200FlowDefinitionStepsItemOnSuccess: {
+  readonly create_user: "create_user";
+};
+//#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * An available SSO identity provider.
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem = {
+  /** Provider instance identifier. */id: string; /** Display name for the provider. */
+  name: string; /** Template hint for rendering (logo, colors). */
+  template: string;
+};
+//#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemTransitions.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Maps action/outcome names to their transition descriptor.
+
+Keys match action names from the `actions` array. Additional keys
+come from implicit outcomes based on schema annotations
+(e.g. `user_not_found` from `x-unique` fields) and engine
+events (e.g. `sso`, `callback`).
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemTransitions = {
+  [key: string]: {
+    /** Step name within this flow (when `action` is null), or the name
+    of another flow (when `action` is `switch` or `pivot`).
+    */
+    target: string;
+    /** How to interpret `target`:
+    - null (omitted): transition to a step in the current flow.
+    - switch: replace the current flow with the target flow.
+    No return — the current flow is discarded.
+    Example: login ↔ register.
+    - pivot: push the target flow onto the stack. The current flow
+    is paused and resumes when the target flow completes (auto-pop).
+    Example: login → recovery → back to login.
+    */
+    action?: "switch" | "pivot" | null;
+  };
+};
+//#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItem.d.ts
+/**
+ * A step in a flow definition. This is the admin-authored configuration,
+not the runtime payload sent to the frontend.
+
+Steps are schema-driven: `fields` references properties from the flow's
+user schema, and the engine resolves field metadata (type, validation,
+implicit outcomes) from schema annotations at runtime.
+
+A step with only `complete` set is a terminal step. All other steps are
+rendered to the frontend as capability payloads.
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItem = {
+  /** Unique step identifier within this flow. Used as transition targets
+  and returned in the API response as `step.name`.
+   */
+  name: string;
+  /** Schema property names to collect from the user. Each entry references
+  a property in the flow's user schema. The engine resolves field type,
+  validation rules, and implicit outcomes from schema annotations
+  (e.g. a property with `x-unique` set implies a `user_not_found`
+  transition outcome).
+   */
+  fields?: string[];
+  /** Ordered list of actions the user can take. The action name is what the
+  frontend sends back in the submit request. If omitted, the engine
+  provides a default `submit` action.
+   */
+  actions?: GetFlowDefinition200FlowDefinitionStepsItemActionsItem[];
+  /** Security gates that must be satisfied before submission. Keyed by gate
+  name. Each gate selects a kind (e.g. "captcha") and provider-specific
+  configuration. The engine may also inject gates dynamically based on
+  policy.
+   */
+  gates?: GetFlowDefinition200FlowDefinitionStepsItemGates; /** Available SSO identity providers for this step. */
+  sso_providers?: GetFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem[];
+  /** Server-side mutation to execute when this step completes successfully.
+  Runs after field validation passes, before the transition fires.
+     - create_user: creates the user record (registration flows)
+   */
+  on_success?: GetFlowDefinition200FlowDefinitionStepsItemOnSuccess;
+  /** Marks this as a terminal step. Tells the frontend what to do:
+  - redirect: navigate to redirect_uri (OIDC/SAML callback done)
+  - show: render as a success/info screen
+   */
+  complete?: GetFlowDefinition200FlowDefinitionStepsItemComplete;
+  /** Maps action/outcome names to their transition descriptor.
+     Keys match action names from the `actions` array. Additional keys
+  come from implicit outcomes based on schema annotations
+  (e.g. `user_not_found` from `x-unique` fields) and engine
+  events (e.g. `sso`, `callback`).
+   */
+  transitions?: GetFlowDefinition200FlowDefinitionStepsItemTransitions;
+};
+//#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinition.d.ts
 /**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
+ * A flow definition is the server-side configuration that describes a complete
+authentication or identity flow. It is NOT sent to the frontend — the flow
+engine evaluates it and produces FlowResponse payloads (steps with capability
+dictionaries) for the client.
+
+Flow definitions are created by administrators and stored in the project/team
+configuration hierarchy. The engine selects the matching definition based on
+the purpose + audience when a flow is created via POST /flow.
+
  */
-type GetFlowDefinition200 = {
+type GetFlowDefinition200FlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
   `switch` and `pivot` transitions. Renaming is not supported — the
@@ -3402,124 +3840,34 @@ type GetFlowDefinition200 = {
   matches every request in the project. The engine picks the most specific
   matching definition: app > team > project-wide.
    */
-  audience?: {
-    /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
-    app_ids?: string[];
-  };
+  audience?: GetFlowDefinition200FlowDefinitionAudience;
   /**
      * Ordered list of steps in this flow. The order is for human readability —
   actual step sequencing is determined by transitions.
         * @minItems 1
      */
-  steps: {
-    /** Unique step identifier within this flow. Used as transition targets
-    and returned in the API response as `step.name`.
-    */
-    name: string;
-    /** Schema property names to collect from the user. Each entry references
-    a property in the flow's user schema. The engine resolves field type,
-    validation rules, and implicit outcomes from schema annotations
-    (e.g. a property with `x-unique` set implies a `user_not_found`
-    transition outcome).
-    */
-    fields?: string[];
-    /** Actions the user can take. Keyed by action name.
-    The action name is what the frontend sends back in the submit request.
-    If omitted, the engine provides a default `submit` action.
-    */
-    actions?: {
-      [key: string]: {
-        /** Marks this as the default/primary action. The runtime template uses
-        this hint to choose visual emphasis. At most one action per step
-        should be primary; this is not enforced here.
-        */
-        primary?: boolean;
-        /** Optional localization key override for the action's label. When
-        omitted, the engine derives a key from the step and action names.
-        Display text is resolved client-side from a locale dictionary, never
-        by the engine.
-        */
-        text_key?: string;
-      };
-    };
-    /** Security gates that must be satisfied before submission. Keyed by gate
-    name. Each gate selects a kind (e.g. "captcha") and provider-specific
-    configuration. The engine may also inject gates dynamically based on
-    policy.
-    */
-    gates?: {
-      [key: string]: {
-        /** The gate category. Only `captcha` is currently defined. Authenticator
-        ceremonies (e.g. passkey) are modelled as credential auth_attempts via
-        `x-credential` on a field, not as gates.
-        */
-        kind: "captcha";
-        /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
-        `hcaptcha`. The engine looks up an implementation in its provider
-        registry.
-        */
-        provider: string;
-        /** Provider-specific configuration consumed by the implementation when
-        issuing the per-render challenge. Opaque to the engine.
-        */
-        config?: {
-          [key: string]: unknown;
-        };
-      };
-    }; /** Available SSO identity providers for this step. */
-    sso_providers?: {
-      /** Provider instance identifier. */id: string; /** Display name for the provider. */
-      name: string; /** Template hint for rendering (logo, colors). */
-      template: string;
-    }[];
-    /** Server-side mutation to execute when this step completes successfully.
-    Runs after field validation passes, before the transition fires.
-       - create_user: creates the user record (registration flows)
-    */
-    on_success?: "create_user";
-    /** Marks this as a terminal step. Tells the frontend what to do:
-    - redirect: navigate to redirect_uri (OIDC/SAML callback done)
-    - show: render as a success/info screen
-    */
-    complete?: "redirect" | "show";
-    /** Maps action/outcome names to their transition descriptor.
-       Keys match action names from the `actions` dict. Additional keys
-    come from implicit outcomes based on schema annotations
-    (e.g. `user_not_found` from `x-unique` fields) and engine
-    events (e.g. `sso`, `callback`).
-    */
-    transitions?: {
-      [key: string]: {
-        /** Step name within this flow (when `action` is null), or the name
-        of another flow (when `action` is `switch` or `pivot`).
-        */
-        target: string;
-        /** How to interpret `target`:
-        - null (omitted): transition to a step in the current flow.
-        - switch: replace the current flow with the target flow.
-        No return — the current flow is discarded.
-        Example: login ↔ register.
-        - pivot: push the target flow onto the stack. The current flow
-        is paused and resumes when the target flow completes (auto-pop).
-        Example: login → recovery → back to login.
-        */
-        action?: "switch" | "pivot" | null;
-      };
-    };
-  }[];
-} & {
+  steps: GetFlowDefinition200FlowDefinitionStepsItem[];
+};
+//#endregion
+//#region src/generated/model/getFlowDefinition200.d.ts
+type GetFlowDefinition200 = {
   /** Unique identifier for the flow definition. */id: string; /** Identifier of the project this flow definition belongs to. */
-  project_id: string;
-  /** URI of the flow definition schema this definition was authored against.
-  If the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.
-   */
-  schema_uri: string; /** Status of the flow definition. */
+  project_id: string; /** Status of the flow definition. */
   status: string;
+  /** A flow definition is the server-side configuration that describes a complete
+  authentication or identity flow. It is NOT sent to the frontend — the flow
+  engine evaluates it and produces FlowResponse payloads (steps with capability
+  dictionaries) for the client.
+     Flow definitions are created by administrators and stored in the project/team
+  configuration hierarchy. The engine selects the matching definition based on
+  the purpose + audience when a flow is created via POST /flow.
+   */
+  flow_definition: GetFlowDefinition200FlowDefinition;
   created_at: string;
   updated_at: string;
 };
 //#endregion
-//#region src/generated/model/getFlowDefinition404Details.d.ts
+//#region src/generated/model/getFlowDefinitionDefaultDetails.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3530,21 +3878,21 @@ type GetFlowDefinition200 = {
 /**
  * Additional error-specific context.
  */
-type GetFlowDefinition404Details = {
+type GetFlowDefinitionDefaultDetails = {
   [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/getFlowDefinition404.d.ts
+//#region src/generated/model/getFlowDefinitionDefault.d.ts
 /**
  * Standard error payload returned for failed API requests.
  */
-type GetFlowDefinition404 = {
+type GetFlowDefinitionDefault = {
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: GetFlowDefinition404Details;
+  details?: GetFlowDefinitionDefaultDetails;
 };
 //#endregion
-//#region src/generated/model/getFlowDefinitionDefaultDetails.d.ts
+//#region src/generated/model/getFlowDefinitionParams.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3552,21 +3900,12 @@ type GetFlowDefinition404 = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
-type GetFlowDefinitionDefaultDetails = {
-  [key: string]: unknown;
-};
-//#endregion
-//#region src/generated/model/getFlowDefinitionDefault.d.ts
-/**
- * Standard error payload returned for failed API requests.
- */
-type GetFlowDefinitionDefault = {
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: GetFlowDefinitionDefaultDetails;
+type GetFlowDefinitionParams = {
+  /**
+   * The project id to filter by.
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
 };
 //#endregion
 //#region src/generated/model/getFlowStep200BrandingLayout.d.ts
@@ -3612,7 +3951,7 @@ type GetFlowStep200Branding = {
   hero_url?: string;
 };
 //#endregion
-//#region src/generated/model/getFlowStep200StepActions.d.ts
+//#region src/generated/model/getFlowStep200StepActionsItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3621,24 +3960,23 @@ type GetFlowStep200Branding = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Unordered dictionary of available user actions. Keyed by action name.
-The LiquidJS template controls positioning and presentation.
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
 
  */
-type GetFlowStep200StepActions = {
-  [key: string]: {
-    /** Marks this as the default/primary action. The runtime template uses
-    this hint to choose visual emphasis. At most one action per step
-    should be primary; this is not enforced here.
-    */
-    primary?: boolean;
-    /** Optional localization key override for the action's label. When
-    omitted, the engine derives a key from the step and action names.
-    Display text is resolved client-side from a locale dictionary, never
-    by the engine.
-    */
-    text_key?: string;
-  };
+type GetFlowStep200StepActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+  text_key?: string;
 };
 //#endregion
 //#region src/generated/model/getFlowStep200StepChallengeMethod.d.ts
@@ -3721,7 +4059,7 @@ declare const GetFlowStep200StepComplete: {
   readonly show: "show";
 };
 //#endregion
-//#region src/generated/model/getFlowStep200StepFieldsType.d.ts
+//#region src/generated/model/getFlowStep200StepFieldsItemType.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3730,14 +4068,15 @@ declare const GetFlowStep200StepComplete: {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * The input kind the client should render. Encodes the formats that
-have a matching HTML input type (email, url, date). For other
-formats (e.g. uuid) the type is `text` and `validation.format`
-carries the rule.
+ * The input kind the client should render. Encodes the formats and
+JSON types that map to a familiar HTML input: `email`, `url`,
+`date` come from `format`; `checkbox` from JSON `type: boolean`;
+`select` from a closed `enum`. For other formats (e.g. uuid) the
+type is `text` and `validation.format` carries the rule.
 
  */
-type GetFlowStep200StepFieldsType = (typeof GetFlowStep200StepFieldsType)[keyof typeof GetFlowStep200StepFieldsType];
-declare const GetFlowStep200StepFieldsType: {
+type GetFlowStep200StepFieldsItemType = (typeof GetFlowStep200StepFieldsItemType)[keyof typeof GetFlowStep200StepFieldsItemType];
+declare const GetFlowStep200StepFieldsItemType: {
   readonly text: "text";
   readonly email: "email";
   readonly password: "password";
@@ -3746,9 +4085,11 @@ declare const GetFlowStep200StepFieldsType: {
   readonly url: "url";
   readonly date: "date";
   readonly hidden: "hidden";
+  readonly checkbox: "checkbox";
+  readonly select: "select";
 };
 //#endregion
-//#region src/generated/model/getFlowStep200StepFieldsValidationFormat.d.ts
+//#region src/generated/model/getFlowStep200StepFieldsItemValidationFormat.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3764,15 +4105,15 @@ sufficient for client-side validation. When `type` is `text`
 (e.g. `format: uuid`), this key is the only signal.
 
  */
-type GetFlowStep200StepFieldsValidationFormat = (typeof GetFlowStep200StepFieldsValidationFormat)[keyof typeof GetFlowStep200StepFieldsValidationFormat];
-declare const GetFlowStep200StepFieldsValidationFormat: {
+type GetFlowStep200StepFieldsItemValidationFormat = (typeof GetFlowStep200StepFieldsItemValidationFormat)[keyof typeof GetFlowStep200StepFieldsItemValidationFormat];
+declare const GetFlowStep200StepFieldsItemValidationFormat: {
   readonly email: "email";
   readonly "date-time": "date-time";
   readonly uuid: "uuid";
   readonly uri: "uri";
 };
 //#endregion
-//#region src/generated/model/getFlowStep200StepFieldsValidation.d.ts
+//#region src/generated/model/getFlowStep200StepFieldsItemValidation.d.ts
 /**
  * Schema-derived rules the frontend SHOULD apply at input time. The
 server runs the same rules on submit and is the only authority on
@@ -3784,14 +4125,14 @@ Each key mirrors a JSON Schema keyword on the underlying user
 property; absent keys mean no rule.
 
  */
-type GetFlowStep200StepFieldsValidation = {
+type GetFlowStep200StepFieldsItemValidation = {
   /** Semantic format the value must match. Values mirror the user
   meta-schema. When `type` already encodes the format (email,
   url, date), this key is informative and the input type is
   sufficient for client-side validation. When `type` is `text`
   (e.g. `format: uuid`), this key is the only signal.
    */
-  format?: GetFlowStep200StepFieldsValidationFormat;
+  format?: GetFlowStep200StepFieldsItemValidationFormat;
   /**
    * Minimum length in characters (inclusive). Mirrors `minLength`.
    * @minimum 0
@@ -3802,40 +4143,47 @@ type GetFlowStep200StepFieldsValidation = {
    * @minimum 0
    */
   max_length?: number;
+  /** Closed list of allowed values. Mirrors the JSON Schema `enum`
+  keyword on the underlying user property. When `type` is
+  `select` the client renders these as options; for other types
+  the rule still applies as a membership check.
+   */
+  enum?: string[];
 };
 //#endregion
-//#region src/generated/model/getFlowStep200StepFields.d.ts
+//#region src/generated/model/getFlowStep200StepFieldsItem.d.ts
 /**
- * Unordered dictionary of input fields to collect. Keyed by field name.
-The LiquidJS template controls which fields appear and in what order.
-Field metadata (type, validation) is resolved by the engine from the
-flow's user schema.
+ * A data input capability. Describes what the user must provide.
+Does not contain display text — only a `text_key` resolved client-side.
 
  */
-type GetFlowStep200StepFields = {
-  [key: string]: {
-    /** The input kind the client should render. Encodes the formats that
-    have a matching HTML input type (email, url, date). For other
-    formats (e.g. uuid) the type is `text` and `validation.format`
-    carries the rule.
-    */
-    type: GetFlowStep200StepFieldsType; /** Localization key for the field label. */
-    text_key: string;
-    /** The field MUST be present and non-empty on submit. Mirrors the
-    schema's top-level `required` array.
-    */
-    required?: boolean; /** Pre-filled value (e.g., an identifier carried over from a pivot). */
-    value?: unknown;
-    /** Schema-derived rules the frontend SHOULD apply at input time. The
-    server runs the same rules on submit and is the only authority on
-    whether the step advances — these rules are a UX hint to reduce
-    round trips, not a contract guarantee.
-       Omitted entirely when the field has no rules beyond its `type`.
-    Each key mirrors a JSON Schema keyword on the underlying user
-    property; absent keys mean no rule.
-    */
-    validation?: GetFlowStep200StepFieldsValidation;
-  };
+type GetFlowStep200StepFieldsItem = {
+  /** Field name, matching a property in the flow's user schema. Carries
+  the submitted value back to the engine.
+   */
+  name: string;
+  /** The input kind the client should render. Encodes the formats and
+  JSON types that map to a familiar HTML input: `email`, `url`,
+  `date` come from `format`; `checkbox` from JSON `type: boolean`;
+  `select` from a closed `enum`. For other formats (e.g. uuid) the
+  type is `text` and `validation.format` carries the rule.
+   */
+  type: GetFlowStep200StepFieldsItemType; /** Localization key for the field label. */
+  text_key: string;
+  /** The field MUST be present and non-empty on submit. Mirrors the
+  schema's top-level `required` array.
+   */
+  required?: boolean; /** Pre-filled value (e.g., an identifier carried over from a pivot). */
+  value?: unknown;
+  /** Schema-derived rules the frontend SHOULD apply at input time. The
+  server runs the same rules on submit and is the only authority on
+  whether the step advances — these rules are a UX hint to reduce
+  round trips, not a contract guarantee.
+     Omitted entirely when the field has no rules beyond its `type`.
+  Each key mirrors a JSON Schema keyword on the underlying user
+  property; absent keys mean no rule.
+   */
+  validation?: GetFlowStep200StepFieldsItemValidation;
 };
 //#endregion
 //#region src/generated/model/getFlowStep200StepGatesConfig.d.ts
@@ -3937,9 +4285,10 @@ type GetFlowStep200StepTexts = {
 //#endregion
 //#region src/generated/model/getFlowStep200Step.d.ts
 /**
- * A step contains unordered capability dictionaries: what to collect (fields),
+ * A step contains ordered capability arrays: what to collect (fields),
 what the user can do (actions), and what security gates must be satisfied (gates).
-Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+and builds name-keyed indexes locally for lookup.
 
  */
 type GetFlowStep200Step = {
@@ -3955,16 +4304,16 @@ type GetFlowStep200Step = {
    */
   complete?: GetFlowStep200StepComplete; /** URL to navigate to (e.g., SSO provider redirect). */
   redirect_url?: string;
-  /** Unordered dictionary of input fields to collect. Keyed by field name.
-  The LiquidJS template controls which fields appear and in what order.
-  Field metadata (type, validation) is resolved by the engine from the
-  flow's user schema.
+  /** Ordered list of input fields to collect. Field metadata (type, validation)
+  is resolved by the engine from the flow's user schema. The LiquidJS
+  template iterates this array; for keyed lookup it builds a name-indexed
+  map locally.
    */
-  fields: GetFlowStep200StepFields;
-  /** Unordered dictionary of available user actions. Keyed by action name.
-  The LiquidJS template controls positioning and presentation.
+  fields: GetFlowStep200StepFieldsItem[];
+  /** Ordered list of available user actions. The LiquidJS template iterates
+  this array and builds a name-indexed map locally for keyed lookup.
    */
-  actions: GetFlowStep200StepActions;
+  actions: GetFlowStep200StepActionsItem[];
   /** Security gates that must be satisfied before the step can be submitted.
   The engine injects gates dynamically based on policy, even if they
   are not declared in the flow definition.
@@ -3990,9 +4339,10 @@ type GetFlowStep200 = {
   id: string; /** Underlying session ID. Stable across all stacked flows. */
   session_id: string; /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */
   session_token?: string;
-  /** A step contains unordered capability dictionaries: what to collect (fields),
+  /** A step contains ordered capability arrays: what to collect (fields),
   what the user can do (actions), and what security gates must be satisfied (gates).
-  Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+  The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+  and builds name-keyed indexes locally for lookup.
    */
   step: GetFlowStep200Step;
   /** Resolved branding configuration. Inherited from the app → team → project
@@ -4515,6 +4865,92 @@ type GetMySessionDefault = {
   details?: GetMySessionDefaultDetails;
 };
 //#endregion
+//#region src/generated/model/getMyUser200.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type GetMyUser200 = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/getMyUser401Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type GetMyUser401Details = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/getMyUser401.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type GetMyUser401 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: GetMyUser401Details;
+};
+//#endregion
+//#region src/generated/model/getMyUser404.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * User not found
+
+Error code: user.not_found
+
+ */
+type GetMyUser404 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
+} & {
+  code: "user.not_found";
+};
+//#endregion
+//#region src/generated/model/getMyUserDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type GetMyUserDefaultDetails = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/getMyUserDefault.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type GetMyUserDefault = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: GetMyUserDefaultDetails;
+};
+//#endregion
 //#region src/generated/model/getOpenIDConfiguration4xxDetails.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -5955,7 +6391,7 @@ type ListFlowDefinitions200FlowDefinitionsItem = {
   /** URI of the flow definition schema this definition was authored against.
   If the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.
    */
-  schema_uri: string; /** Status of the flow definition. */
+  schema_uri?: string; /** Status of the flow definition. */
   status: string; /** Timestamp when the flow definition was created. */
   created_at: string; /** Timestamp when the flow definition was last updated. */
   updated_at: string;
@@ -6051,7 +6487,7 @@ type ListFlowDefinitionsParams = {
     */
   page_token?: string;
   /**
-   * The unique identifier of the project
+   * The project id to filter by.
    * @pattern ^[a-zA-Z0-9_-]+$
    */
   project_id: string;
@@ -6696,7 +7132,111 @@ type RevokeSessionDefault = {
   details?: RevokeSessionDefaultDetails;
 };
 //#endregion
-//#region src/generated/model/revokeSessionParams.d.ts
+//#region src/generated/model/revokeSessionParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type RevokeSessionParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+};
+//#endregion
+//#region src/generated/model/revokeToken4xxDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type RevokeToken4xxDetails = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/revokeToken4xx.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type RevokeToken4xx = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: RevokeToken4xxDetails;
+};
+//#endregion
+//#region src/generated/model/revokeTokenBody.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type RevokeTokenBody = {
+  /** The token to revoke (access token or refresh token) */token?: string; /** Optional hint about the type of the token being revoked (access_token or refresh_token) */
+  token_type_hint?: string;
+};
+//#endregion
+//#region src/generated/model/revokeTokenDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type RevokeTokenDefaultDetails = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/revokeTokenDefault.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type RevokeTokenDefault = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: RevokeTokenDefaultDetails;
+};
+//#endregion
+//#region src/generated/model/setUserPassword400Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type SetUserPassword400Details = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/setUserPassword400.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type SetUserPassword400 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: SetUserPassword400Details;
+};
+//#endregion
+//#region src/generated/model/setUserPassword404Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6704,15 +7244,24 @@ type RevokeSessionDefault = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type RevokeSessionParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
+/**
+ * Additional error-specific context.
+ */
+type SetUserPassword404Details = {
+  [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/revokeToken4xxDetails.d.ts
+//#region src/generated/model/setUserPassword404.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type SetUserPassword404 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: SetUserPassword404Details;
+};
+//#endregion
+//#region src/generated/model/setUserPassword500Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6723,21 +7272,21 @@ type RevokeSessionParams = {
 /**
  * Additional error-specific context.
  */
-type RevokeToken4xxDetails = {
+type SetUserPassword500Details = {
   [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/revokeToken4xx.d.ts
+//#region src/generated/model/setUserPassword500.d.ts
 /**
  * Standard error payload returned for failed API requests.
  */
-type RevokeToken4xx = {
+type SetUserPassword500 = {
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: RevokeToken4xxDetails;
+  details?: SetUserPassword500Details;
 };
 //#endregion
-//#region src/generated/model/revokeTokenBody.d.ts
+//#region src/generated/model/setUserPasswordBody.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6745,12 +7294,18 @@ type RevokeToken4xx = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type RevokeTokenBody = {
-  /** The token to revoke (access token or refresh token) */token?: string; /** Optional hint about the type of the token being revoked (access_token or refresh_token) */
-  token_type_hint?: string;
+/**
+ * Request to update the user's password.
+ */
+type SetUserPasswordBody = {
+  /** The new password for the user. */password: string;
+  /** Whether the user is required to change their password on the next login.
+  If not provided, it will default to false.
+   */
+  isChangeRequired?: boolean;
 };
 //#endregion
-//#region src/generated/model/revokeTokenDefaultDetails.d.ts
+//#region src/generated/model/setUserPasswordDefaultDetails.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6761,18 +7316,34 @@ type RevokeTokenBody = {
 /**
  * Additional error-specific context.
  */
-type RevokeTokenDefaultDetails = {
+type SetUserPasswordDefaultDetails = {
   [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/revokeTokenDefault.d.ts
+//#region src/generated/model/setUserPasswordDefault.d.ts
 /**
  * Standard error payload returned for failed API requests.
  */
-type RevokeTokenDefault = {
+type SetUserPasswordDefault = {
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: RevokeTokenDefaultDetails;
+  details?: SetUserPasswordDefaultDetails;
+};
+//#endregion
+//#region src/generated/model/setUserPasswordParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type SetUserPasswordParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
 };
 //#endregion
 //#region src/generated/model/submitFlowEvent400Details.d.ts
@@ -6929,7 +7500,7 @@ type SubmitFlowStep200Branding = {
   hero_url?: string;
 };
 //#endregion
-//#region src/generated/model/submitFlowStep200StepActions.d.ts
+//#region src/generated/model/submitFlowStep200StepActionsItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6938,24 +7509,23 @@ type SubmitFlowStep200Branding = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Unordered dictionary of available user actions. Keyed by action name.
-The LiquidJS template controls positioning and presentation.
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
 
  */
-type SubmitFlowStep200StepActions = {
-  [key: string]: {
-    /** Marks this as the default/primary action. The runtime template uses
-    this hint to choose visual emphasis. At most one action per step
-    should be primary; this is not enforced here.
-    */
-    primary?: boolean;
-    /** Optional localization key override for the action's label. When
-    omitted, the engine derives a key from the step and action names.
-    Display text is resolved client-side from a locale dictionary, never
-    by the engine.
-    */
-    text_key?: string;
-  };
+type SubmitFlowStep200StepActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+  text_key?: string;
 };
 //#endregion
 //#region src/generated/model/submitFlowStep200StepChallengeMethod.d.ts
@@ -7038,7 +7608,7 @@ declare const SubmitFlowStep200StepComplete: {
   readonly show: "show";
 };
 //#endregion
-//#region src/generated/model/submitFlowStep200StepFieldsType.d.ts
+//#region src/generated/model/submitFlowStep200StepFieldsItemType.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7047,14 +7617,15 @@ declare const SubmitFlowStep200StepComplete: {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * The input kind the client should render. Encodes the formats that
-have a matching HTML input type (email, url, date). For other
-formats (e.g. uuid) the type is `text` and `validation.format`
-carries the rule.
+ * The input kind the client should render. Encodes the formats and
+JSON types that map to a familiar HTML input: `email`, `url`,
+`date` come from `format`; `checkbox` from JSON `type: boolean`;
+`select` from a closed `enum`. For other formats (e.g. uuid) the
+type is `text` and `validation.format` carries the rule.
 
  */
-type SubmitFlowStep200StepFieldsType = (typeof SubmitFlowStep200StepFieldsType)[keyof typeof SubmitFlowStep200StepFieldsType];
-declare const SubmitFlowStep200StepFieldsType: {
+type SubmitFlowStep200StepFieldsItemType = (typeof SubmitFlowStep200StepFieldsItemType)[keyof typeof SubmitFlowStep200StepFieldsItemType];
+declare const SubmitFlowStep200StepFieldsItemType: {
   readonly text: "text";
   readonly email: "email";
   readonly password: "password";
@@ -7063,9 +7634,11 @@ declare const SubmitFlowStep200StepFieldsType: {
   readonly url: "url";
   readonly date: "date";
   readonly hidden: "hidden";
+  readonly checkbox: "checkbox";
+  readonly select: "select";
 };
 //#endregion
-//#region src/generated/model/submitFlowStep200StepFieldsValidationFormat.d.ts
+//#region src/generated/model/submitFlowStep200StepFieldsItemValidationFormat.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7081,15 +7654,15 @@ sufficient for client-side validation. When `type` is `text`
 (e.g. `format: uuid`), this key is the only signal.
 
  */
-type SubmitFlowStep200StepFieldsValidationFormat = (typeof SubmitFlowStep200StepFieldsValidationFormat)[keyof typeof SubmitFlowStep200StepFieldsValidationFormat];
-declare const SubmitFlowStep200StepFieldsValidationFormat: {
+type SubmitFlowStep200StepFieldsItemValidationFormat = (typeof SubmitFlowStep200StepFieldsItemValidationFormat)[keyof typeof SubmitFlowStep200StepFieldsItemValidationFormat];
+declare const SubmitFlowStep200StepFieldsItemValidationFormat: {
   readonly email: "email";
   readonly "date-time": "date-time";
   readonly uuid: "uuid";
   readonly uri: "uri";
 };
 //#endregion
-//#region src/generated/model/submitFlowStep200StepFieldsValidation.d.ts
+//#region src/generated/model/submitFlowStep200StepFieldsItemValidation.d.ts
 /**
  * Schema-derived rules the frontend SHOULD apply at input time. The
 server runs the same rules on submit and is the only authority on
@@ -7101,14 +7674,14 @@ Each key mirrors a JSON Schema keyword on the underlying user
 property; absent keys mean no rule.
 
  */
-type SubmitFlowStep200StepFieldsValidation = {
+type SubmitFlowStep200StepFieldsItemValidation = {
   /** Semantic format the value must match. Values mirror the user
   meta-schema. When `type` already encodes the format (email,
   url, date), this key is informative and the input type is
   sufficient for client-side validation. When `type` is `text`
   (e.g. `format: uuid`), this key is the only signal.
    */
-  format?: SubmitFlowStep200StepFieldsValidationFormat;
+  format?: SubmitFlowStep200StepFieldsItemValidationFormat;
   /**
    * Minimum length in characters (inclusive). Mirrors `minLength`.
    * @minimum 0
@@ -7119,40 +7692,47 @@ type SubmitFlowStep200StepFieldsValidation = {
    * @minimum 0
    */
   max_length?: number;
+  /** Closed list of allowed values. Mirrors the JSON Schema `enum`
+  keyword on the underlying user property. When `type` is
+  `select` the client renders these as options; for other types
+  the rule still applies as a membership check.
+   */
+  enum?: string[];
 };
 //#endregion
-//#region src/generated/model/submitFlowStep200StepFields.d.ts
+//#region src/generated/model/submitFlowStep200StepFieldsItem.d.ts
 /**
- * Unordered dictionary of input fields to collect. Keyed by field name.
-The LiquidJS template controls which fields appear and in what order.
-Field metadata (type, validation) is resolved by the engine from the
-flow's user schema.
+ * A data input capability. Describes what the user must provide.
+Does not contain display text — only a `text_key` resolved client-side.
 
  */
-type SubmitFlowStep200StepFields = {
-  [key: string]: {
-    /** The input kind the client should render. Encodes the formats that
-    have a matching HTML input type (email, url, date). For other
-    formats (e.g. uuid) the type is `text` and `validation.format`
-    carries the rule.
-    */
-    type: SubmitFlowStep200StepFieldsType; /** Localization key for the field label. */
-    text_key: string;
-    /** The field MUST be present and non-empty on submit. Mirrors the
-    schema's top-level `required` array.
-    */
-    required?: boolean; /** Pre-filled value (e.g., an identifier carried over from a pivot). */
-    value?: unknown;
-    /** Schema-derived rules the frontend SHOULD apply at input time. The
-    server runs the same rules on submit and is the only authority on
-    whether the step advances — these rules are a UX hint to reduce
-    round trips, not a contract guarantee.
-       Omitted entirely when the field has no rules beyond its `type`.
-    Each key mirrors a JSON Schema keyword on the underlying user
-    property; absent keys mean no rule.
-    */
-    validation?: SubmitFlowStep200StepFieldsValidation;
-  };
+type SubmitFlowStep200StepFieldsItem = {
+  /** Field name, matching a property in the flow's user schema. Carries
+  the submitted value back to the engine.
+   */
+  name: string;
+  /** The input kind the client should render. Encodes the formats and
+  JSON types that map to a familiar HTML input: `email`, `url`,
+  `date` come from `format`; `checkbox` from JSON `type: boolean`;
+  `select` from a closed `enum`. For other formats (e.g. uuid) the
+  type is `text` and `validation.format` carries the rule.
+   */
+  type: SubmitFlowStep200StepFieldsItemType; /** Localization key for the field label. */
+  text_key: string;
+  /** The field MUST be present and non-empty on submit. Mirrors the
+  schema's top-level `required` array.
+   */
+  required?: boolean; /** Pre-filled value (e.g., an identifier carried over from a pivot). */
+  value?: unknown;
+  /** Schema-derived rules the frontend SHOULD apply at input time. The
+  server runs the same rules on submit and is the only authority on
+  whether the step advances — these rules are a UX hint to reduce
+  round trips, not a contract guarantee.
+     Omitted entirely when the field has no rules beyond its `type`.
+  Each key mirrors a JSON Schema keyword on the underlying user
+  property; absent keys mean no rule.
+   */
+  validation?: SubmitFlowStep200StepFieldsItemValidation;
 };
 //#endregion
 //#region src/generated/model/submitFlowStep200StepGatesConfig.d.ts
@@ -7254,9 +7834,10 @@ type SubmitFlowStep200StepTexts = {
 //#endregion
 //#region src/generated/model/submitFlowStep200Step.d.ts
 /**
- * A step contains unordered capability dictionaries: what to collect (fields),
+ * A step contains ordered capability arrays: what to collect (fields),
 what the user can do (actions), and what security gates must be satisfied (gates).
-Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+and builds name-keyed indexes locally for lookup.
 
  */
 type SubmitFlowStep200Step = {
@@ -7272,16 +7853,16 @@ type SubmitFlowStep200Step = {
    */
   complete?: SubmitFlowStep200StepComplete; /** URL to navigate to (e.g., SSO provider redirect). */
   redirect_url?: string;
-  /** Unordered dictionary of input fields to collect. Keyed by field name.
-  The LiquidJS template controls which fields appear and in what order.
-  Field metadata (type, validation) is resolved by the engine from the
-  flow's user schema.
+  /** Ordered list of input fields to collect. Field metadata (type, validation)
+  is resolved by the engine from the flow's user schema. The LiquidJS
+  template iterates this array; for keyed lookup it builds a name-indexed
+  map locally.
    */
-  fields: SubmitFlowStep200StepFields;
-  /** Unordered dictionary of available user actions. Keyed by action name.
-  The LiquidJS template controls positioning and presentation.
+  fields: SubmitFlowStep200StepFieldsItem[];
+  /** Ordered list of available user actions. The LiquidJS template iterates
+  this array and builds a name-indexed map locally for keyed lookup.
    */
-  actions: SubmitFlowStep200StepActions;
+  actions: SubmitFlowStep200StepActionsItem[];
   /** Security gates that must be satisfied before the step can be submitted.
   The engine injects gates dynamically based on policy, even if they
   are not declared in the flow definition.
@@ -7307,9 +7888,10 @@ type SubmitFlowStep200 = {
   id: string; /** Underlying session ID. Stable across all stacked flows. */
   session_id: string; /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */
   session_token?: string;
-  /** A step contains unordered capability dictionaries: what to collect (fields),
+  /** A step contains ordered capability arrays: what to collect (fields),
   what the user can do (actions), and what security gates must be satisfied (gates).
-  Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+  The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+  and builds name-keyed indexes locally for lookup.
    */
   step: SubmitFlowStep200Step;
   /** Resolved branding configuration. Inherited from the app → team → project
@@ -7372,7 +7954,7 @@ type SubmitFlowStep400Branding = {
   hero_url?: string;
 };
 //#endregion
-//#region src/generated/model/submitFlowStep400StepActions.d.ts
+//#region src/generated/model/submitFlowStep400StepActionsItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7381,24 +7963,23 @@ type SubmitFlowStep400Branding = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Unordered dictionary of available user actions. Keyed by action name.
-The LiquidJS template controls positioning and presentation.
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
 
  */
-type SubmitFlowStep400StepActions = {
-  [key: string]: {
-    /** Marks this as the default/primary action. The runtime template uses
-    this hint to choose visual emphasis. At most one action per step
-    should be primary; this is not enforced here.
-    */
-    primary?: boolean;
-    /** Optional localization key override for the action's label. When
-    omitted, the engine derives a key from the step and action names.
-    Display text is resolved client-side from a locale dictionary, never
-    by the engine.
-    */
-    text_key?: string;
-  };
+type SubmitFlowStep400StepActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+  text_key?: string;
 };
 //#endregion
 //#region src/generated/model/submitFlowStep400StepChallengeMethod.d.ts
@@ -7481,7 +8062,7 @@ declare const SubmitFlowStep400StepComplete: {
   readonly show: "show";
 };
 //#endregion
-//#region src/generated/model/submitFlowStep400StepFieldsType.d.ts
+//#region src/generated/model/submitFlowStep400StepFieldsItemType.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7490,14 +8071,15 @@ declare const SubmitFlowStep400StepComplete: {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * The input kind the client should render. Encodes the formats that
-have a matching HTML input type (email, url, date). For other
-formats (e.g. uuid) the type is `text` and `validation.format`
-carries the rule.
+ * The input kind the client should render. Encodes the formats and
+JSON types that map to a familiar HTML input: `email`, `url`,
+`date` come from `format`; `checkbox` from JSON `type: boolean`;
+`select` from a closed `enum`. For other formats (e.g. uuid) the
+type is `text` and `validation.format` carries the rule.
 
  */
-type SubmitFlowStep400StepFieldsType = (typeof SubmitFlowStep400StepFieldsType)[keyof typeof SubmitFlowStep400StepFieldsType];
-declare const SubmitFlowStep400StepFieldsType: {
+type SubmitFlowStep400StepFieldsItemType = (typeof SubmitFlowStep400StepFieldsItemType)[keyof typeof SubmitFlowStep400StepFieldsItemType];
+declare const SubmitFlowStep400StepFieldsItemType: {
   readonly text: "text";
   readonly email: "email";
   readonly password: "password";
@@ -7506,9 +8088,11 @@ declare const SubmitFlowStep400StepFieldsType: {
   readonly url: "url";
   readonly date: "date";
   readonly hidden: "hidden";
+  readonly checkbox: "checkbox";
+  readonly select: "select";
 };
 //#endregion
-//#region src/generated/model/submitFlowStep400StepFieldsValidationFormat.d.ts
+//#region src/generated/model/submitFlowStep400StepFieldsItemValidationFormat.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7524,15 +8108,15 @@ sufficient for client-side validation. When `type` is `text`
 (e.g. `format: uuid`), this key is the only signal.
 
  */
-type SubmitFlowStep400StepFieldsValidationFormat = (typeof SubmitFlowStep400StepFieldsValidationFormat)[keyof typeof SubmitFlowStep400StepFieldsValidationFormat];
-declare const SubmitFlowStep400StepFieldsValidationFormat: {
+type SubmitFlowStep400StepFieldsItemValidationFormat = (typeof SubmitFlowStep400StepFieldsItemValidationFormat)[keyof typeof SubmitFlowStep400StepFieldsItemValidationFormat];
+declare const SubmitFlowStep400StepFieldsItemValidationFormat: {
   readonly email: "email";
   readonly "date-time": "date-time";
   readonly uuid: "uuid";
   readonly uri: "uri";
 };
 //#endregion
-//#region src/generated/model/submitFlowStep400StepFieldsValidation.d.ts
+//#region src/generated/model/submitFlowStep400StepFieldsItemValidation.d.ts
 /**
  * Schema-derived rules the frontend SHOULD apply at input time. The
 server runs the same rules on submit and is the only authority on
@@ -7544,14 +8128,14 @@ Each key mirrors a JSON Schema keyword on the underlying user
 property; absent keys mean no rule.
 
  */
-type SubmitFlowStep400StepFieldsValidation = {
+type SubmitFlowStep400StepFieldsItemValidation = {
   /** Semantic format the value must match. Values mirror the user
   meta-schema. When `type` already encodes the format (email,
   url, date), this key is informative and the input type is
   sufficient for client-side validation. When `type` is `text`
   (e.g. `format: uuid`), this key is the only signal.
    */
-  format?: SubmitFlowStep400StepFieldsValidationFormat;
+  format?: SubmitFlowStep400StepFieldsItemValidationFormat;
   /**
    * Minimum length in characters (inclusive). Mirrors `minLength`.
    * @minimum 0
@@ -7562,40 +8146,47 @@ type SubmitFlowStep400StepFieldsValidation = {
    * @minimum 0
    */
   max_length?: number;
+  /** Closed list of allowed values. Mirrors the JSON Schema `enum`
+  keyword on the underlying user property. When `type` is
+  `select` the client renders these as options; for other types
+  the rule still applies as a membership check.
+   */
+  enum?: string[];
 };
 //#endregion
-//#region src/generated/model/submitFlowStep400StepFields.d.ts
+//#region src/generated/model/submitFlowStep400StepFieldsItem.d.ts
 /**
- * Unordered dictionary of input fields to collect. Keyed by field name.
-The LiquidJS template controls which fields appear and in what order.
-Field metadata (type, validation) is resolved by the engine from the
-flow's user schema.
+ * A data input capability. Describes what the user must provide.
+Does not contain display text — only a `text_key` resolved client-side.
 
  */
-type SubmitFlowStep400StepFields = {
-  [key: string]: {
-    /** The input kind the client should render. Encodes the formats that
-    have a matching HTML input type (email, url, date). For other
-    formats (e.g. uuid) the type is `text` and `validation.format`
-    carries the rule.
-    */
-    type: SubmitFlowStep400StepFieldsType; /** Localization key for the field label. */
-    text_key: string;
-    /** The field MUST be present and non-empty on submit. Mirrors the
-    schema's top-level `required` array.
-    */
-    required?: boolean; /** Pre-filled value (e.g., an identifier carried over from a pivot). */
-    value?: unknown;
-    /** Schema-derived rules the frontend SHOULD apply at input time. The
-    server runs the same rules on submit and is the only authority on
-    whether the step advances — these rules are a UX hint to reduce
-    round trips, not a contract guarantee.
-       Omitted entirely when the field has no rules beyond its `type`.
-    Each key mirrors a JSON Schema keyword on the underlying user
-    property; absent keys mean no rule.
-    */
-    validation?: SubmitFlowStep400StepFieldsValidation;
-  };
+type SubmitFlowStep400StepFieldsItem = {
+  /** Field name, matching a property in the flow's user schema. Carries
+  the submitted value back to the engine.
+   */
+  name: string;
+  /** The input kind the client should render. Encodes the formats and
+  JSON types that map to a familiar HTML input: `email`, `url`,
+  `date` come from `format`; `checkbox` from JSON `type: boolean`;
+  `select` from a closed `enum`. For other formats (e.g. uuid) the
+  type is `text` and `validation.format` carries the rule.
+   */
+  type: SubmitFlowStep400StepFieldsItemType; /** Localization key for the field label. */
+  text_key: string;
+  /** The field MUST be present and non-empty on submit. Mirrors the
+  schema's top-level `required` array.
+   */
+  required?: boolean; /** Pre-filled value (e.g., an identifier carried over from a pivot). */
+  value?: unknown;
+  /** Schema-derived rules the frontend SHOULD apply at input time. The
+  server runs the same rules on submit and is the only authority on
+  whether the step advances — these rules are a UX hint to reduce
+  round trips, not a contract guarantee.
+     Omitted entirely when the field has no rules beyond its `type`.
+  Each key mirrors a JSON Schema keyword on the underlying user
+  property; absent keys mean no rule.
+   */
+  validation?: SubmitFlowStep400StepFieldsItemValidation;
 };
 //#endregion
 //#region src/generated/model/submitFlowStep400StepGatesConfig.d.ts
@@ -7697,9 +8288,10 @@ type SubmitFlowStep400StepTexts = {
 //#endregion
 //#region src/generated/model/submitFlowStep400Step.d.ts
 /**
- * A step contains unordered capability dictionaries: what to collect (fields),
+ * A step contains ordered capability arrays: what to collect (fields),
 what the user can do (actions), and what security gates must be satisfied (gates).
-Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+and builds name-keyed indexes locally for lookup.
 
  */
 type SubmitFlowStep400Step = {
@@ -7715,16 +8307,16 @@ type SubmitFlowStep400Step = {
    */
   complete?: SubmitFlowStep400StepComplete; /** URL to navigate to (e.g., SSO provider redirect). */
   redirect_url?: string;
-  /** Unordered dictionary of input fields to collect. Keyed by field name.
-  The LiquidJS template controls which fields appear and in what order.
-  Field metadata (type, validation) is resolved by the engine from the
-  flow's user schema.
+  /** Ordered list of input fields to collect. Field metadata (type, validation)
+  is resolved by the engine from the flow's user schema. The LiquidJS
+  template iterates this array; for keyed lookup it builds a name-indexed
+  map locally.
    */
-  fields: SubmitFlowStep400StepFields;
-  /** Unordered dictionary of available user actions. Keyed by action name.
-  The LiquidJS template controls positioning and presentation.
+  fields: SubmitFlowStep400StepFieldsItem[];
+  /** Ordered list of available user actions. The LiquidJS template iterates
+  this array and builds a name-indexed map locally for keyed lookup.
    */
-  actions: SubmitFlowStep400StepActions;
+  actions: SubmitFlowStep400StepActionsItem[];
   /** Security gates that must be satisfied before the step can be submitted.
   The engine injects gates dynamically based on policy, even if they
   are not declared in the flow definition.
@@ -7750,9 +8342,10 @@ type SubmitFlowStep400 = {
   id: string; /** Underlying session ID. Stable across all stacked flows. */
   session_id: string; /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */
   session_token?: string;
-  /** A step contains unordered capability dictionaries: what to collect (fields),
+  /** A step contains ordered capability arrays: what to collect (fields),
   what the user can do (actions), and what security gates must be satisfied (gates).
-  Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+  The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+  and builds name-keyed indexes locally for lookup.
    */
   step: SubmitFlowStep400Step;
   /** Resolved branding configuration. Inherited from the app → team → project
@@ -7765,14 +8358,207 @@ type SubmitFlowStep400 = {
   Exchange it for a session via `POST /sessions/exchange`.
   Only present when `step.complete` is set.
    */
-  handoff_token?: string;
-  /** Expiry timestamp for `handoff_token`. Only present when
-  `handoff_token` is set.
+  handoff_token?: string;
+  /** Expiry timestamp for `handoff_token`. Only present when
+  `handoff_token` is set.
+   */
+  handoff_token_expires_at?: string;
+};
+//#endregion
+//#region src/generated/model/submitFlowStep409Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type SubmitFlowStep409Details = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/submitFlowStep409.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type SubmitFlowStep409 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: SubmitFlowStep409Details;
+};
+//#endregion
+//#region src/generated/model/submitFlowStepBodyChallengeResponseProof.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Method-specific proof payload.
+For passkeys, this is the WebAuthn JSON serialization of PublicKeyCredential.
+
+ */
+type SubmitFlowStepBodyChallengeResponseProof = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/submitFlowStepBodyChallengeResponse.d.ts
+/**
+ * Response to a pending challenge on the step. Required when the step has a
+`challenge` property (e.g., after submitting a passkey action).
+The `<zl-passkey>` component populates this after the WebAuthn ceremony.
+
+ */
+type SubmitFlowStepBodyChallengeResponse = {
+  /** The challenge identifier from `step.challenge.challenge_id`.
+  Matches the server-side challenge for verification.
+   */
+  challenge_id?: string; /** Which auth method this response is for (e.g., 'passkey'). */
+  method?: string;
+  /** Method-specific proof payload.
+  For passkeys, this is the WebAuthn JSON serialization of PublicKeyCredential.
+   */
+  proof?: SubmitFlowStepBodyChallengeResponseProof;
+};
+//#endregion
+//#region src/generated/model/submitFlowStepBodyFields.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * User input values. Keys match field names from the step's `fields` dictionary.
+
+ */
+type SubmitFlowStepBodyFields = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/submitFlowStepBodyGateProofs.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Solutions for security gates. Keys match gate names from the step's `gates` dictionary.
+The orchestrator collects these from `<zl-captcha>` component events.
+
+ */
+type SubmitFlowStepBodyGateProofs = {
+  [key: string]: string;
+};
+//#endregion
+//#region src/generated/model/submitFlowStepBody.d.ts
+type SubmitFlowStepBody = {
+  /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */session_token?: string;
+  /** Which action to take. Must be a key from the step's `actions` dictionary:
+  - A regular action (e.g., "submit", "register", "back")
+  - The reserved value "sso" — triggers SSO redirect (requires `sso_provider_id`)
+   */
+  action: string;
+  /** User input values. Keys match field names from the step's `fields` dictionary.
+   */
+  fields?: SubmitFlowStepBodyFields;
+  /** Solutions for security gates. Keys match gate names from the step's `gates` dictionary.
+  The orchestrator collects these from `<zl-captcha>` component events.
+   */
+  gate_proofs?: SubmitFlowStepBodyGateProofs;
+  /** Response to a pending challenge on the step. Required when the step has a
+  `challenge` property (e.g., after submitting a passkey action).
+  The `<zl-passkey>` component populates this after the WebAuthn ceremony.
+   */
+  challenge_response?: SubmitFlowStepBodyChallengeResponse;
+  /** ID of the selected SSO provider (from `sso_providers[].id`).
+  Required when `action` is "sso".
+   */
+  sso_provider_id?: string;
+};
+//#endregion
+//#region src/generated/model/submitFlowStepDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type SubmitFlowStepDefaultDetails = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/submitFlowStepDefault.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type SubmitFlowStepDefault = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: SubmitFlowStepDefaultDetails;
+};
+//#endregion
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionAudience.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Scopes which teams or apps this flow definition applies to. Empty or
+omitted fields mean "no restriction"; when both are empty the definition
+matches every request in the project. The engine picks the most specific
+matching definition: app > team > project-wide.
+
+ */
+type UpdateFlowDefinition200FlowDefinitionAudience = {
+  /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
+  app_ids?: string[];
+};
+//#endregion
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemActionsItem.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
+
+ */
+type UpdateFlowDefinition200FlowDefinitionStepsItemActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
    */
-  handoff_token_expires_at?: string;
+  text_key?: string;
 };
 //#endregion
-//#region src/generated/model/submitFlowStep409Details.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemComplete.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7781,23 +8567,35 @@ type SubmitFlowStep400 = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
+ * Marks this as a terminal step. Tells the frontend what to do:
+- redirect: navigate to redirect_uri (OIDC/SAML callback done)
+- show: render as a success/info screen
+
  */
-type SubmitFlowStep409Details = {
-  [key: string]: unknown;
+type UpdateFlowDefinition200FlowDefinitionStepsItemComplete = (typeof UpdateFlowDefinition200FlowDefinitionStepsItemComplete)[keyof typeof UpdateFlowDefinition200FlowDefinitionStepsItemComplete];
+declare const UpdateFlowDefinition200FlowDefinitionStepsItemComplete: {
+  readonly redirect: "redirect";
+  readonly show: "show";
 };
 //#endregion
-//#region src/generated/model/submitFlowStep409.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemGatesConfig.d.ts
 /**
- * Standard error payload returned for failed API requests.
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
  */
-type SubmitFlowStep409 = {
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: SubmitFlowStep409Details;
+/**
+ * Provider-specific configuration consumed by the implementation when
+issuing the per-render challenge. Opaque to the engine.
+
+ */
+type UpdateFlowDefinition200FlowDefinitionStepsItemGatesConfig = {
+  [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/submitFlowStepBodyChallengeResponseProof.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemGatesKind.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7806,34 +8604,44 @@ type SubmitFlowStep409 = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Method-specific proof payload.
-For passkeys, this is the WebAuthn JSON serialization of PublicKeyCredential.
+ * The gate category. Only `captcha` is currently defined. Authenticator
+ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+`x-credential` on a field, not as gates.
 
  */
-type SubmitFlowStepBodyChallengeResponseProof = {
-  [key: string]: unknown;
+type UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind = (typeof UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind)[keyof typeof UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind];
+declare const UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind: {
+  readonly captcha: "captcha";
 };
 //#endregion
-//#region src/generated/model/submitFlowStepBodyChallengeResponse.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemGates.d.ts
 /**
- * Response to a pending challenge on the step. Required when the step has a
-`challenge` property (e.g., after submitting a passkey action).
-The `<zl-passkey>` component populates this after the WebAuthn ceremony.
+ * Security gates that must be satisfied before submission. Keyed by gate
+name. Each gate selects a kind (e.g. "captcha") and provider-specific
+configuration. The engine may also inject gates dynamically based on
+policy.
 
  */
-type SubmitFlowStepBodyChallengeResponse = {
-  /** The challenge identifier from `step.challenge.challenge_id`.
-  Matches the server-side challenge for verification.
-   */
-  challenge_id?: string; /** Which auth method this response is for (e.g., 'passkey'). */
-  method?: string;
-  /** Method-specific proof payload.
-  For passkeys, this is the WebAuthn JSON serialization of PublicKeyCredential.
-   */
-  proof?: SubmitFlowStepBodyChallengeResponseProof;
+type UpdateFlowDefinition200FlowDefinitionStepsItemGates = {
+  [key: string]: {
+    /** The gate category. Only `captcha` is currently defined. Authenticator
+    ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+    `x-credential` on a field, not as gates.
+    */
+    kind: UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind;
+    /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
+    `hcaptcha`. The engine looks up an implementation in its provider
+    registry.
+    */
+    provider: string;
+    /** Provider-specific configuration consumed by the implementation when
+    issuing the per-render challenge. Opaque to the engine.
+    */
+    config?: UpdateFlowDefinition200FlowDefinitionStepsItemGatesConfig;
+  };
 };
 //#endregion
-//#region src/generated/model/submitFlowStepBodyFields.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemOnSuccess.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7842,14 +8650,18 @@ type SubmitFlowStepBodyChallengeResponse = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * User input values. Keys match field names from the step's `fields` dictionary.
+ * Server-side mutation to execute when this step completes successfully.
+Runs after field validation passes, before the transition fires.
+
+- create_user: creates the user record (registration flows)
 
  */
-type SubmitFlowStepBodyFields = {
-  [key: string]: unknown;
+type UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess = (typeof UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess)[keyof typeof UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess];
+declare const UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess: {
+  readonly create_user: "create_user";
 };
 //#endregion
-//#region src/generated/model/submitFlowStepBodyGateProofs.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7858,41 +8670,15 @@ type SubmitFlowStepBodyFields = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Solutions for security gates. Keys match gate names from the step's `gates` dictionary.
-The orchestrator collects these from `<zl-captcha>` component events.
-
+ * An available SSO identity provider.
  */
-type SubmitFlowStepBodyGateProofs = {
-  [key: string]: string;
-};
-//#endregion
-//#region src/generated/model/submitFlowStepBody.d.ts
-type SubmitFlowStepBody = {
-  /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */session_token?: string;
-  /** Which action to take. Must be a key from the step's `actions` dictionary:
-  - A regular action (e.g., "submit", "register", "back")
-  - The reserved value "sso" — triggers SSO redirect (requires `sso_provider_id`)
-   */
-  action: string;
-  /** User input values. Keys match field names from the step's `fields` dictionary.
-   */
-  fields?: SubmitFlowStepBodyFields;
-  /** Solutions for security gates. Keys match gate names from the step's `gates` dictionary.
-  The orchestrator collects these from `<zl-captcha>` component events.
-   */
-  gate_proofs?: SubmitFlowStepBodyGateProofs;
-  /** Response to a pending challenge on the step. Required when the step has a
-  `challenge` property (e.g., after submitting a passkey action).
-  The `<zl-passkey>` component populates this after the WebAuthn ceremony.
-   */
-  challenge_response?: SubmitFlowStepBodyChallengeResponse;
-  /** ID of the selected SSO provider (from `sso_providers[].id`).
-  Required when `action` is "sso".
-   */
-  sso_provider_id?: string;
+type UpdateFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem = {
+  /** Provider instance identifier. */id: string; /** Display name for the provider. */
+  name: string; /** Template hint for rendering (logo, colors). */
+  template: string;
 };
 //#endregion
-//#region src/generated/model/submitFlowStepDefaultDetails.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemTransitions.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7901,31 +8687,102 @@ type SubmitFlowStepBody = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
+ * Maps action/outcome names to their transition descriptor.
+
+Keys match action names from the `actions` array. Additional keys
+come from implicit outcomes based on schema annotations
+(e.g. `user_not_found` from `x-unique` fields) and engine
+events (e.g. `sso`, `callback`).
+
  */
-type SubmitFlowStepDefaultDetails = {
-  [key: string]: unknown;
+type UpdateFlowDefinition200FlowDefinitionStepsItemTransitions = {
+  [key: string]: {
+    /** Step name within this flow (when `action` is null), or the name
+    of another flow (when `action` is `switch` or `pivot`).
+    */
+    target: string;
+    /** How to interpret `target`:
+    - null (omitted): transition to a step in the current flow.
+    - switch: replace the current flow with the target flow.
+    No return — the current flow is discarded.
+    Example: login ↔ register.
+    - pivot: push the target flow onto the stack. The current flow
+    is paused and resumes when the target flow completes (auto-pop).
+    Example: login → recovery → back to login.
+    */
+    action?: "switch" | "pivot" | null;
+  };
 };
 //#endregion
-//#region src/generated/model/submitFlowStepDefault.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItem.d.ts
 /**
- * Standard error payload returned for failed API requests.
+ * A step in a flow definition. This is the admin-authored configuration,
+not the runtime payload sent to the frontend.
+
+Steps are schema-driven: `fields` references properties from the flow's
+user schema, and the engine resolves field metadata (type, validation,
+implicit outcomes) from schema annotations at runtime.
+
+A step with only `complete` set is a terminal step. All other steps are
+rendered to the frontend as capability payloads.
+
  */
-type SubmitFlowStepDefault = {
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: SubmitFlowStepDefaultDetails;
+type UpdateFlowDefinition200FlowDefinitionStepsItem = {
+  /** Unique step identifier within this flow. Used as transition targets
+  and returned in the API response as `step.name`.
+   */
+  name: string;
+  /** Schema property names to collect from the user. Each entry references
+  a property in the flow's user schema. The engine resolves field type,
+  validation rules, and implicit outcomes from schema annotations
+  (e.g. a property with `x-unique` set implies a `user_not_found`
+  transition outcome).
+   */
+  fields?: string[];
+  /** Ordered list of actions the user can take. The action name is what the
+  frontend sends back in the submit request. If omitted, the engine
+  provides a default `submit` action.
+   */
+  actions?: UpdateFlowDefinition200FlowDefinitionStepsItemActionsItem[];
+  /** Security gates that must be satisfied before submission. Keyed by gate
+  name. Each gate selects a kind (e.g. "captcha") and provider-specific
+  configuration. The engine may also inject gates dynamically based on
+  policy.
+   */
+  gates?: UpdateFlowDefinition200FlowDefinitionStepsItemGates; /** Available SSO identity providers for this step. */
+  sso_providers?: UpdateFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem[];
+  /** Server-side mutation to execute when this step completes successfully.
+  Runs after field validation passes, before the transition fires.
+     - create_user: creates the user record (registration flows)
+   */
+  on_success?: UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess;
+  /** Marks this as a terminal step. Tells the frontend what to do:
+  - redirect: navigate to redirect_uri (OIDC/SAML callback done)
+  - show: render as a success/info screen
+   */
+  complete?: UpdateFlowDefinition200FlowDefinitionStepsItemComplete;
+  /** Maps action/outcome names to their transition descriptor.
+     Keys match action names from the `actions` array. Additional keys
+  come from implicit outcomes based on schema annotations
+  (e.g. `user_not_found` from `x-unique` fields) and engine
+  events (e.g. `sso`, `callback`).
+   */
+  transitions?: UpdateFlowDefinition200FlowDefinitionStepsItemTransitions;
 };
 //#endregion
-//#region src/generated/model/updateFlowDefinition200.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinition.d.ts
 /**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
+ * A flow definition is the server-side configuration that describes a complete
+authentication or identity flow. It is NOT sent to the frontend — the flow
+engine evaluates it and produces FlowResponse payloads (steps with capability
+dictionaries) for the client.
+
+Flow definitions are created by administrators and stored in the project/team
+configuration hierarchy. The engine selects the matching definition based on
+the purpose + audience when a flow is created via POST /flow.
+
  */
-type UpdateFlowDefinition200 = {
+type UpdateFlowDefinition200FlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
   `switch` and `pivot` transitions. Renaming is not supported — the
@@ -7950,119 +8807,29 @@ type UpdateFlowDefinition200 = {
   matches every request in the project. The engine picks the most specific
   matching definition: app > team > project-wide.
    */
-  audience?: {
-    /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
-    app_ids?: string[];
-  };
+  audience?: UpdateFlowDefinition200FlowDefinitionAudience;
   /**
      * Ordered list of steps in this flow. The order is for human readability —
   actual step sequencing is determined by transitions.
         * @minItems 1
      */
-  steps: {
-    /** Unique step identifier within this flow. Used as transition targets
-    and returned in the API response as `step.name`.
-    */
-    name: string;
-    /** Schema property names to collect from the user. Each entry references
-    a property in the flow's user schema. The engine resolves field type,
-    validation rules, and implicit outcomes from schema annotations
-    (e.g. a property with `x-unique` set implies a `user_not_found`
-    transition outcome).
-    */
-    fields?: string[];
-    /** Actions the user can take. Keyed by action name.
-    The action name is what the frontend sends back in the submit request.
-    If omitted, the engine provides a default `submit` action.
-    */
-    actions?: {
-      [key: string]: {
-        /** Marks this as the default/primary action. The runtime template uses
-        this hint to choose visual emphasis. At most one action per step
-        should be primary; this is not enforced here.
-        */
-        primary?: boolean;
-        /** Optional localization key override for the action's label. When
-        omitted, the engine derives a key from the step and action names.
-        Display text is resolved client-side from a locale dictionary, never
-        by the engine.
-        */
-        text_key?: string;
-      };
-    };
-    /** Security gates that must be satisfied before submission. Keyed by gate
-    name. Each gate selects a kind (e.g. "captcha") and provider-specific
-    configuration. The engine may also inject gates dynamically based on
-    policy.
-    */
-    gates?: {
-      [key: string]: {
-        /** The gate category. Only `captcha` is currently defined. Authenticator
-        ceremonies (e.g. passkey) are modelled as credential auth_attempts via
-        `x-credential` on a field, not as gates.
-        */
-        kind: "captcha";
-        /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
-        `hcaptcha`. The engine looks up an implementation in its provider
-        registry.
-        */
-        provider: string;
-        /** Provider-specific configuration consumed by the implementation when
-        issuing the per-render challenge. Opaque to the engine.
-        */
-        config?: {
-          [key: string]: unknown;
-        };
-      };
-    }; /** Available SSO identity providers for this step. */
-    sso_providers?: {
-      /** Provider instance identifier. */id: string; /** Display name for the provider. */
-      name: string; /** Template hint for rendering (logo, colors). */
-      template: string;
-    }[];
-    /** Server-side mutation to execute when this step completes successfully.
-    Runs after field validation passes, before the transition fires.
-       - create_user: creates the user record (registration flows)
-    */
-    on_success?: "create_user";
-    /** Marks this as a terminal step. Tells the frontend what to do:
-    - redirect: navigate to redirect_uri (OIDC/SAML callback done)
-    - show: render as a success/info screen
-    */
-    complete?: "redirect" | "show";
-    /** Maps action/outcome names to their transition descriptor.
-       Keys match action names from the `actions` dict. Additional keys
-    come from implicit outcomes based on schema annotations
-    (e.g. `user_not_found` from `x-unique` fields) and engine
-    events (e.g. `sso`, `callback`).
-    */
-    transitions?: {
-      [key: string]: {
-        /** Step name within this flow (when `action` is null), or the name
-        of another flow (when `action` is `switch` or `pivot`).
-        */
-        target: string;
-        /** How to interpret `target`:
-        - null (omitted): transition to a step in the current flow.
-        - switch: replace the current flow with the target flow.
-        No return — the current flow is discarded.
-        Example: login ↔ register.
-        - pivot: push the target flow onto the stack. The current flow
-        is paused and resumes when the target flow completes (auto-pop).
-        Example: login → recovery → back to login.
-        */
-        action?: "switch" | "pivot" | null;
-      };
-    };
-  }[];
-} & {
+  steps: UpdateFlowDefinition200FlowDefinitionStepsItem[];
+};
+//#endregion
+//#region src/generated/model/updateFlowDefinition200.d.ts
+type UpdateFlowDefinition200 = {
   /** Unique identifier for the flow definition. */id: string; /** Identifier of the project this flow definition belongs to. */
-  project_id: string;
-  /** URI of the flow definition schema this definition was authored against.
-  If the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.
-   */
-  schema_uri: string; /** Status of the flow definition. */
+  project_id: string; /** Status of the flow definition. */
   status: string;
+  /** A flow definition is the server-side configuration that describes a complete
+  authentication or identity flow. It is NOT sent to the frontend — the flow
+  engine evaluates it and produces FlowResponse payloads (steps with capability
+  dictionaries) for the client.
+     Flow definitions are created by administrators and stored in the project/team
+  configuration hierarchy. The engine selects the matching definition based on
+  the purpose + audience when a flow is created via POST /flow.
+   */
+  flow_definition: UpdateFlowDefinition200FlowDefinition;
   created_at: string;
   updated_at: string;
 };
@@ -8137,7 +8904,7 @@ type UpdateFlowDefinitionBodyAudience = {
   app_ids?: string[];
 };
 //#endregion
-//#region src/generated/model/updateFlowDefinitionBodyStepsItemActions.d.ts
+//#region src/generated/model/updateFlowDefinitionBodyStepsItemActionsItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -8146,25 +8913,23 @@ type UpdateFlowDefinitionBodyAudience = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Actions the user can take. Keyed by action name.
-The action name is what the frontend sends back in the submit request.
-If omitted, the engine provides a default `submit` action.
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
 
  */
-type UpdateFlowDefinitionBodyStepsItemActions = {
-  [key: string]: {
-    /** Marks this as the default/primary action. The runtime template uses
-    this hint to choose visual emphasis. At most one action per step
-    should be primary; this is not enforced here.
-    */
-    primary?: boolean;
-    /** Optional localization key override for the action's label. When
-    omitted, the engine derives a key from the step and action names.
-    Display text is resolved client-side from a locale dictionary, never
-    by the engine.
-    */
-    text_key?: string;
-  };
+type UpdateFlowDefinitionBodyStepsItemActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+  text_key?: string;
 };
 //#endregion
 //#region src/generated/model/updateFlowDefinitionBodyStepsItemComplete.d.ts
@@ -8298,7 +9063,7 @@ type UpdateFlowDefinitionBodyStepsItemSsoProvidersItem = {
 /**
  * Maps action/outcome names to their transition descriptor.
 
-Keys match action names from the `actions` dict. Additional keys
+Keys match action names from the `actions` array. Additional keys
 come from implicit outcomes based on schema annotations
 (e.g. `user_not_found` from `x-unique` fields) and engine
 events (e.g. `sso`, `callback`).
@@ -8348,11 +9113,11 @@ type UpdateFlowDefinitionBodyStepsItem = {
   transition outcome).
    */
   fields?: string[];
-  /** Actions the user can take. Keyed by action name.
-  The action name is what the frontend sends back in the submit request.
-  If omitted, the engine provides a default `submit` action.
+  /** Ordered list of actions the user can take. The action name is what the
+  frontend sends back in the submit request. If omitted, the engine
+  provides a default `submit` action.
    */
-  actions?: UpdateFlowDefinitionBodyStepsItemActions;
+  actions?: UpdateFlowDefinitionBodyStepsItemActionsItem[];
   /** Security gates that must be satisfied before submission. Keyed by gate
   name. Each gate selects a kind (e.g. "captcha") and provider-specific
   configuration. The engine may also inject gates dynamically based on
@@ -8371,7 +9136,7 @@ type UpdateFlowDefinitionBodyStepsItem = {
    */
   complete?: UpdateFlowDefinitionBodyStepsItemComplete;
   /** Maps action/outcome names to their transition descriptor.
-     Keys match action names from the `actions` dict. Additional keys
+     Keys match action names from the `actions` array. Additional keys
   come from implicit outcomes based on schema annotations
   (e.g. `user_not_found` from `x-unique` fields) and engine
   events (e.g. `sso`, `callback`).
@@ -8438,6 +9203,22 @@ type UpdateFlowDefinitionDefault = {
   details?: UpdateFlowDefinitionDefaultDetails;
 };
 //#endregion
+//#region src/generated/model/updateFlowDefinitionParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type UpdateFlowDefinitionParams = {
+  /**
+   * The project id to filter by.
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+};
+//#endregion
 //#region src/generated/model/verifyChallengeProof200ChallengesItemMethod.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -8793,5 +9574,5 @@ type VerifyChallengeProofDefault = ({
   code: "internal";
 });
 //#endregion
-export { SubmitFlowStep400StepChallengeOptions as $, CreateUserBody as $a, GetFlowStep200StepFieldsType as $i, GetUserByIDParams as $n, CreateFlowDefinitionBodyFlowDefinitionStepsItem as $o, GetProject401Details as $r, AuthorizeGetDefaultDetails as $s, ListUsersParams as $t, UpdateFlowDefinition200 as A, ExchangeHandoff401Details as Aa, GetKeys200KeysItem as Ai, ListFlowDefinitions400Details as An, CreateSession201SessionFactorsItemPayload as Ao, GetSession200UserAgent as Ar, CreateFlow201StepFieldsValidationFormat as As, SubmitFlowEvent400Details as At, SubmitFlowStep400 as B, ExchangeHandoff200SessionFactorsItemMethod as Ba, GetFlowStep410Details as Bi, IssueChallenge201Payload as Bn, CreateSchema201 as Bo, GetSchemaById404Details as Br, CreateAuthAttemptBody as Bs, RevokeSession409Details as Bt, UpdateFlowDefinitionBodyStepsItemComplete as C, ExchangeHandoffParams as Ca, GetLiveDefault as Ci, ListSessions200SessionsItemFactorsItemPayload as Cn, CreateSession400Details as Co, GetSessionDefault as Cr, CreateFlow201StepTexts as Cs, SubmitFlowEventDefaultDetails as Ct, UpdateFlowDefinition404Details as D, ExchangeHandoff410 as Da, GetKeysDefault as Di, ListFlowDefinitionsDefault as Dn, CreateSession201SessionState as Do, GetSession401 as Dr, CreateFlow201StepGatesConfig as Ds, SubmitFlowEvent404 as Dt, UpdateFlowDefinition404 as E, ExchangeHandoffBody as Ea, GetLive4xxDetails as Ei, ListFlowDefinitionsPurpose as En, CreateSession201SessionUserAgent as Eo, GetSession404Details as Er, CreateFlow201StepGatesKind as Es, SubmitFlowEventBodyPayload as Et, SubmitFlowStepBodyFields as F, ExchangeHandoff200SessionUserAgent as Fa, GetHealth4xx as Fi, IssueChallengeBodyPasskeyOptions as Fn, CreateSchemaBody as Fo, GetSession200FactorsItemMethod as Fr, CreateFlow201StepChallengeMethod as Fs, RevokeToken4xxDetails as Ft, SubmitFlowStep400StepGatesKind as G, EndSession400Details as Ga, GetFlowStep200StepTexts as Gi, Introspect400 as Gn, CreateProject429Details as Go, GetReadyDefaultDetails as Gr, CreateAuthAttempt201CompletedFactorsItemPayload as Gs, RevokeMySessionDefault as Gt, SubmitFlowStep400StepTexts as H, EndSessionDefault as Ha, GetFlowStep404Details as Hi, IntrospectDefault as Hn, CreateProjectDefaultDetails as Ho, GetSchemaById400Details as Hr, CreateAuthAttempt201State as Hs, RevokeSession404Details as Ht, SubmitFlowStepBodyChallengeResponse as I, ExchangeHandoff200SessionState as Ia, GetHealth4xxDetails as Ii, IssueChallengeBodyPasskeyOptionsUserVerification as In, CreateSchema409 as Io, GetSchemaByIdParams as Ir, CreateFlow201StepActions as Is, RevokeSessionParams as It, SubmitFlowStep400StepFieldsValidation as J, DeleteFlowDefinition404 as Ja, GetFlowStep200StepGatesKind as Ji, GetUserInfoDefault as Jn, CreateHandoff200 as Jo, GetProjectDefault as Jr, CreateAuthAttempt201ChallengesItemState as Js, RevokeMySession409Details as Jt, SubmitFlowStep400StepGatesConfig as K, DeleteFlowDefinitionDefault as Ka, GetFlowStep200StepSsoProvidersItem as Ki, Introspect400Details as Kn, CreateProject201 as Ko, GetReady4xx as Kr, CreateAuthAttempt201CompletedFactorsItemMethod as Ks, RevokeMySessionDefaultDetails as Kt, SubmitFlowStepBodyChallengeResponseProof as L, ExchangeHandoff200SessionMetadata as La, GetFlowStepDefault as Li, IssueChallengeBodyMethod as Ln, CreateSchema409Details as Lo, GetSchemaByIdDefault as Lr, CreateFlow201Branding as Ls, RevokeSessionDefault as Lt, SubmitFlowStepDefaultDetails as M, ExchangeHandoff400Details as Ma, GetKeys4xxDetails as Mi, ListFlowDefinitions200FlowDefinitionsItem as Mn, CreateSchemaParams as Mo, GetSession200Metadata as Mr, CreateFlow201StepComplete as Ms, RevokeTokenDefaultDetails as Mt, SubmitFlowStepBody as N, ExchangeHandoff200 as Na, GetHealthDefault as Ni, IssueChallengeDefault as Nn, CreateSchemaDefault as No, GetSession200FactorsItem as Nr, CreateFlow201StepChallenge as Ns, RevokeTokenBody as Nt, UpdateFlowDefinition400 as O, ExchangeHandoff410Details as Oa, GetKeysDefaultDetails as Oi, ListFlowDefinitionsDefaultDetails as On, CreateSession201SessionMetadata as Oo, GetSession401Details as Or, CreateFlow201StepFields as Os, SubmitFlowEvent404Details as Ot, SubmitFlowStepBodyGateProofs as P, ExchangeHandoff200Session as Pa, GetHealthDefaultDetails as Pi, IssueChallengeBody as Pn, CreateSchemaDefaultDetails as Po, GetSession200FactorsItemPayload as Pr, CreateFlow201StepChallengeOptions as Ps, RevokeToken4xx as Pt, SubmitFlowStep400StepChallenge as Q, CreateUserDefaultDetails as Qa, GetFlowStep200StepFieldsValidationFormat as Qi, GetUserInfo4xxDetails as Qn, CreateFlowDefinitionBodyFlowDefinition as Qo, GetProject401 as Qr, AuthorizeGetDefault as Qs, RevokeMySession401Details as Qt, SubmitFlowStep409 as R, ExchangeHandoff200SessionFactorsItem as Ra, GetFlowStepDefaultDetails as Ri, IssueChallenge201 as Rn, CreateSchema400 as Ro, GetSchemaByIdDefaultDetails as Rr, CreateFlow201BrandingLayout as Rs, RevokeSessionDefaultDetails as Rt, UpdateFlowDefinitionBodyStepsItemGatesConfig as S, GetAuthAttempt200ChallengesItemMethod as Sa, GetMySession200FactorsItemMethod as Si, ListSessions200SessionsItemFactorsItem as Sn, CreateSession400 as So, GetSessionParams as Sr, CreateFlow201Step as Ss, SubmitFlowEventDefault as St, UpdateFlowDefinitionBodyAudience as T, ExchangeHandoffDefaultDetails as Ta, GetLive4xx as Ti, ListFlowDefinitionsParams as Tn, CreateSession201Session as To, GetSession404 as Tr, CreateFlow201StepGates as Ts, SubmitFlowEventBodyType as Tt, SubmitFlowStep400StepSsoProvidersItem as U, EndSessionDefaultDetails as Ua, GetFlowStep200 as Ui, IntrospectDefaultDetails as Un, CreateProjectBody as Uo, GetSchemaById200 as Ur, CreateAuthAttempt201RequiredFactorsItem as Us, RevokeSession401 as Ut, SubmitFlowStep400Step as V, EndSessionParams as Va, GetFlowStep404 as Vi, IssueChallenge201Method as Vn, CreateProjectDefault as Vo, GetSchemaById400 as Vr, CreateAuthAttempt201 as Vs, RevokeSession404 as Vt, SubmitFlowStep400StepGates as W, EndSession400 as Wa, GetFlowStep200Step as Wi, IntrospectBody as Wn, CreateProject429 as Wo, GetReadyDefault as Wr, CreateAuthAttempt201CompletedFactorsItem as Ws, RevokeSession401Details as Wt, SubmitFlowStep400StepFieldsType as X, CreateUserParams as Xa, GetFlowStep200StepFields as Xi, GetUserInfo200 as Xn, CreateFlowDefinitionDefaultDetails as Xo, GetProject404 as Xr, CreateAuthAttempt201ChallengesItemMethod as Xs, RevokeMySession404Details as Xt, SubmitFlowStep400StepFieldsValidationFormat as Y, DeleteFlowDefinition404Details as Ya, GetFlowStep200StepGatesConfig as Yi, GetUserInfoDefaultDetails as Yn, CreateFlowDefinitionDefault as Yo, GetProjectDefaultDetails as Yr, CreateAuthAttempt201ChallengesItemPayload as Ys, RevokeMySession404 as Yt, SubmitFlowStep400StepComplete as Z, CreateUserDefault as Za, GetFlowStep200StepFieldsValidation as Zi, GetUserInfo4xx as Zn, CreateFlowDefinitionBody as Zo, GetProject404Details as Zr, AuthorizeGetParams as Zs, RevokeMySession401 as Zt, UpdateFlowDefinitionBodyStepsItemTransitions as _, GetAuthAttempt200CompletedFactorsItemPayload as _a, GetMySession200UserAgent as _i, ListSessions200 as _n, CreateTeam201 as _o, GetTeam404 as _r, CreateFlowBodyPurpose as _s, SubmitFlowStep200StepChallengeOptions as _t, VerifyChallengeProof200RequiredFactorsItem as a, GetFlowStep200Branding as aa, AuthorizeDevice400 as ac, GetOpenIDConfiguration200SubjectTypesSupportedItem as ai, ListUsers400Details as an, CreateUser401Details as ao, GetUserByID401Details as ar, CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig as as, SubmitFlowStep200Step as at, UpdateFlowDefinitionBodyStepsItemGates as b, GetAuthAttempt200ChallengesItemState as ba, GetMySession200FactorsItem as bi, ListSessions200SessionsItemState as bn, CreateSessionBody as bo, GetTeam401Details as br, CreateFlow400Details as bs, SubmitFlowStep200Branding as bt, VerifyChallengeProof200CompletedFactorsItemMethod as c, GetFlowDefinitionDefaultDetails as ca, GetOpenIDConfiguration4xx as ci, ListSessionsState as cn, CreateUser201 as co, GetTokenDefaultDetails as cr, CreateFlowDefinitionBodyFlowDefinitionAudience as cs, SubmitFlowStep200StepGates as ct, VerifyChallengeProof200ChallengesItemPayload as d, GetFlowDefinition200 as da, GetMySessionDefaultDetails as di, ListSessions403 as dn, CreateTeamDefaultDetails as do, GetToken200 as dr, CreateFlowDefinition400 as ds, SubmitFlowStep200StepFields as dt, GetFlowStep200StepComplete as ea, AuthorizeGet400 as ec, GetProject200 as ei, ListUsersDefault as en, CreateUser409 as eo, GetUserByIDDefault as er, CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions as es, SubmitFlowStep400StepChallengeMethod as et, VerifyChallengeProof200ChallengesItemMethod as f, GetAuthAttemptDefault as fa, GetMySession404 as fi, ListSessions403Details as fn, CreateTeamBody as fo, GetToken4xx as fr, CreateFlowDefinition400Details as fs, SubmitFlowStep200StepFieldsValidation as ft, UpdateFlowDefinitionBodyStepsItem as g, GetAuthAttempt200CompletedFactorsItem as ga, GetMySession200 as gi, ListSessions400Details as gn, CreateTeam400Details as go, GetTeamDefaultDetails as gr, CreateFlowBody as gs, SubmitFlowStep200StepChallenge as gt, UpdateFlowDefinitionBody as h, GetAuthAttempt200RequiredFactorsItem as ha, GetMySession401Details as hi, ListSessions400 as hn, CreateTeam400 as ho, GetTeamDefault as hr, CreateFlowDefaultDetails as hs, SubmitFlowStep200StepComplete as ht, VerifyChallengeProof200State as i, GetFlowStep200StepActions as ia, AuthorizeDeviceDefaultDetails as ic, GetOpenIDConfiguration200TokenEndpointAuthMethodsSupportedItem as ii, ListUsers400 as in, CreateUser401 as io, GetUserByID401 as ir, CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind as is, SubmitFlowStep200 as it, SubmitFlowStepDefault as j, ExchangeHandoff400 as ja, GetKeys4xx as ji, ListFlowDefinitions200 as jn, CreateSession201SessionFactorsItemMethod as jo, GetSession200State as jr, CreateFlow201StepFieldsType as js, RevokeTokenDefault as jt, UpdateFlowDefinition400Details as k, ExchangeHandoff401 as ka, GetKeys200 as ki, ListFlowDefinitions400 as kn, CreateSession201SessionFactorsItem as ko, GetSession200 as kr, CreateFlow201StepFieldsValidation as ks, SubmitFlowEvent400 as kt, VerifyChallengeProof200ChallengesItem as l, GetFlowDefinition404 as la, GetOpenIDConfiguration4xxDetails as li, ListSessionsDefault as ln, CreateTeamParams as lo, GetTokenBody as lr, CreateFlowDefinition409 as ls, SubmitFlowStep200StepGatesKind as lt, UpdateFlowDefinitionDefaultDetails as m, GetAuthAttempt200State as ma, GetMySession401 as mi, ListSessions401Details as mn, CreateTeam429Details as mo, GetTeamParams as mr, CreateFlowDefault as ms, SubmitFlowStep200StepFieldsType as mt, VerifyChallengeProofBody as n, GetFlowStep200StepChallengeOptions as na, AuthorizeDeviceParams as nc, GetOpenIDConfigurationDefaultDetails as ni, ListUsers500 as nn, CreateUser403 as no, GetUserByID404 as nr, CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess as ns, SubmitFlowStep400Branding as nt, VerifyChallengeProof200CompletedFactorsItem as o, GetFlowStep200BrandingLayout as oa, AuthorizeDevice400Details as oc, GetOpenIDConfiguration200DisplayValuesSupportedItem as oi, ListUsers200Item as on, CreateUser400 as oo, GetUserByID200 as or, CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete as os, SubmitFlowStep200StepTexts as ot, UpdateFlowDefinitionDefault as p, GetAuthAttempt200 as pa, GetMySession404Details as pi, ListSessions401 as pn, CreateTeam429 as po, GetToken4xxDetails as pr, CreateFlowDefinition201 as ps, SubmitFlowStep200StepFieldsValidationFormat as pt, SubmitFlowStep400StepFields as q, DeleteFlowDefinitionDefaultDetails as qa, GetFlowStep200StepGates as qi, Introspect200 as qn, CreateHandoffDefault as qo, GetReady4xxDetails as qr, CreateAuthAttempt201ChallengesItem as qs, RevokeMySession409 as qt, VerifyChallengeProof200 as r, GetFlowStep200StepChallengeMethod as ra, AuthorizeDeviceDefault as rc, GetOpenIDConfiguration200 as ri, ListUsers500Details as rn, CreateUser403Details as ro, GetUserByID404Details as rr, CreateFlowDefinitionBodyFlowDefinitionStepsItemGates as rs, SubmitFlowStep400BrandingLayout as rt, VerifyChallengeProof200CompletedFactorsItemPayload as s, GetFlowDefinitionDefault as sa, AuthorizeDevice200 as sc, GetOpenIDConfiguration200ClaimTypesSupportedItem as si, ListSessionsParams as sn, CreateUser400Details as so, GetTokenDefault as sr, CreateFlowDefinitionBodyFlowDefinitionStepsItemActions as ss, SubmitFlowStep200StepSsoProvidersItem as st, VerifyChallengeProofDefault as t, GetFlowStep200StepChallenge as ta, AuthorizeGet400Details as tc, GetOpenIDConfigurationDefault as ti, ListUsersDefaultDetails as tn, CreateUser409Details as to, GetUserByIDDefaultDetails as tr, CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem as ts, SubmitFlowStep400StepActions as tt, VerifyChallengeProof200ChallengesItemState as u, GetFlowDefinition404Details as ua, GetMySessionDefault as ui, ListSessionsDefaultDetails as un, CreateTeamDefault as uo, GetTokenBodyGrantType as ur, CreateFlowDefinition409Details as us, SubmitFlowStep200StepGatesConfig as ut, UpdateFlowDefinitionBodyStepsItemSsoProvidersItem as v, GetAuthAttempt200CompletedFactorsItemMethod as va, GetMySession200State as vi, ListSessions200SessionsItem as vn, CreateSessionDefault as vo, GetTeam404Details as vr, CreateFlowBodyHint as vs, SubmitFlowStep200StepChallengeMethod as vt, UpdateFlowDefinitionBodyStepsItemActions as w, ExchangeHandoffDefault as wa, GetLiveDefaultDetails as wi, ListSessions200SessionsItemFactorsItemMethod as wn, CreateSession201 as wo, GetSessionDefaultDetails as wr, CreateFlow201StepSsoProvidersItem as ws, SubmitFlowEventBody as wt, UpdateFlowDefinitionBodyStepsItemGatesKind as x, GetAuthAttempt200ChallengesItemPayload as xa, GetMySession200FactorsItemPayload as xi, ListSessions200SessionsItemMetadata as xn, CreateSessionBodyUserAgent as xo, GetTeam200 as xr, CreateFlow201 as xs, SubmitFlowStep200BrandingLayout as xt, UpdateFlowDefinitionBodyStepsItemOnSuccess as y, GetAuthAttempt200ChallengesItem as ya, GetMySession200Metadata as yi, ListSessions200SessionsItemUserAgent as yn, CreateSessionDefaultDetails as yo, GetTeam401 as yr, CreateFlow400 as ys, SubmitFlowStep200StepActions as yt, SubmitFlowStep409Details as z, ExchangeHandoff200SessionFactorsItemPayload as za, GetFlowStep410 as zi, IssueChallenge201State as zn, CreateSchema400Details as zo, GetSchemaById404 as zr, CreateAuthAttemptDefault as zs, RevokeSession409 as zt };
-//# sourceMappingURL=index-DlEenfQJ.d.mts.map
+export { SubmitFlowStep400Step as $, GetAuthAttempt200RequiredFactorsItem as $a, AuthorizeDevice400 as $c, GetLive4xx as $i, ListFlowDefinitions200 as $n, CreateTeam400Details as $o, GetSession200State as $r, CreateFlowDefinition201FlowDefinitionStepsItemTransitions as $s, RevokeTokenDefault as $t, UpdateFlowDefinition400Details as A, GetFlowStep200StepChallengeOptions as Aa, CreateFlow201StepActionsItem as Ac, GetOpenIDConfiguration4xx as Ai, ListSessionsState as An, DeleteFlowDefinitionParams as Ao, GetTokenDefaultDetails as Ar, CreateHandoffDefault as As, SubmitFlowStep200StepChallengeMethod as At, UpdateFlowDefinition200FlowDefinitionStepsItemComplete as B, GetFlowDefinition200FlowDefinitionStepsItem as Ba, CreateAuthAttempt201CompletedFactorsItemMethod as Bc, GetMySession404 as Bi, ListSessions200SessionsItem as Bn, CreateUser403Details as Bo, GetTeam404Details as Br, CreateFlowDefinitionBodyFlowDefinitionStepsItemGates as Bs, SubmitFlowEvent404Details as Bt, UpdateFlowDefinitionBodyStepsItemGatesConfig as C, GetFlowStep200StepGatesConfig as Ca, CreateFlow201StepFieldsItemValidation as Cc, GetOpenIDConfigurationDefault as Ci, ListUsersDefaultDetails as Cn, ExchangeHandoff200SessionFactorsItemPayload as Co, GetUserByIDDefaultDetails as Cr, CreateSchema201 as Cs, SubmitFlowStep200StepFieldsItem as Ct, UpdateFlowDefinition404 as D, GetFlowStep200StepFieldsItemType as Da, CreateFlow201StepChallenge as Dc, GetOpenIDConfiguration200SubjectTypesSupportedItem as Di, ListUsers400Details as Dn, EndSessionDefaultDetails as Do, GetUserByID401Details as Dr, CreateProject429 as Ds, SubmitFlowStep200StepComplete as Dt, UpdateFlowDefinitionBodyAudience as E, GetFlowStep200StepFieldsItemValidationFormat as Ea, CreateFlow201StepComplete as Ec, GetOpenIDConfiguration200TokenEndpointAuthMethodsSupportedItem as Ei, ListUsers400 as En, EndSessionDefault as Eo, GetUserByID401 as Er, CreateProjectBody as Es, SubmitFlowStep200StepFieldsItemType as Et, UpdateFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem as F, GetFlowDefinitionParams as Fa, CreateAuthAttempt201 as Fc, GetMyUser401 as Fi, ListSessions401 as Fn, CreateUserDefaultDetails as Fo, GetToken4xxDetails as Fr, CreateFlowDefinitionBodyFlowDefinition as Fs, SubmitFlowEventDefaultDetails as Ft, SubmitFlowStepBody as G, GetFlowDefinition200FlowDefinitionStepsItemGatesKind as Ga, AuthorizeGetParams as Gc, GetMySession200UserAgent as Gi, ListSessions200SessionsItemFactorsItemPayload as Gn, CreateUser201 as Go, GetSessionDefault as Gr, CreateFlowDefinitionBodyFlowDefinitionAudience as Gs, SetUserPasswordDefaultDetails as Gt, UpdateFlowDefinition200FlowDefinitionAudience as H, GetFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem as Ha, CreateAuthAttempt201ChallengesItemState as Hc, GetMySession401 as Hi, ListSessions200SessionsItemState as Hn, CreateUser401Details as Ho, GetTeam401Details as Hr, CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig as Hs, SubmitFlowEvent400Details as Ht, UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess as I, GetFlowDefinitionDefault as Ia, CreateAuthAttempt201State as Ic, GetMyUser401Details as Ii, ListSessions401Details as In, CreateUserBody as Io, GetTeamParams as Ir, CreateFlowDefinitionBodyFlowDefinitionStepsItem as Is, SubmitFlowEventBody as It, SubmitFlowStepBodyChallengeResponse as J, GetFlowDefinition200FlowDefinitionStepsItemActionsItem as Ja, AuthorizeGet400 as Jc, GetMySession200FactorsItem as Ji, ListFlowDefinitionsPurpose as Jn, CreateTeamDefaultDetails as Jo, GetSession404Details as Jr, CreateFlowDefinition400 as Js, SetUserPassword500Details as Jt, SubmitFlowStepBodyGateProofs as K, GetFlowDefinition200FlowDefinitionStepsItemGatesConfig as Ka, AuthorizeGetDefault as Kc, GetMySession200State as Ki, ListSessions200SessionsItemFactorsItemMethod as Kn, CreateTeamParams as Ko, GetSessionDefaultDetails as Kr, CreateFlowDefinition409 as Ks, SetUserPasswordBody as Kt, UpdateFlowDefinition200FlowDefinitionStepsItemGates as L, GetFlowDefinitionDefaultDetails as La, CreateAuthAttempt201RequiredFactorsItem as Lc, GetMyUser200 as Li, ListSessions400 as Ln, CreateUser409 as Lo, GetTeamDefault as Lr, CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions as Ls, SubmitFlowEventBodyType as Lt, UpdateFlowDefinition200FlowDefinition as M, GetFlowStep200StepActionsItem as Ma, CreateFlow201BrandingLayout as Mc, GetMyUserDefault as Mi, ListSessionsDefaultDetails as Mn, DeleteFlowDefinitionDefaultDetails as Mo, GetTokenBodyGrantType as Mr, CreateFlowDefinitionDefault as Ms, SubmitFlowStep200Branding as Mt, UpdateFlowDefinition200FlowDefinitionStepsItem as N, GetFlowStep200Branding as Na, CreateAuthAttemptDefault as Nc, GetMyUserDefaultDetails as Ni, ListSessions403 as Nn, CreateUserParams as No, GetToken200 as Nr, CreateFlowDefinitionDefaultDetails as Ns, SubmitFlowStep200BrandingLayout as Nt, UpdateFlowDefinition404Details as O, GetFlowStep200StepComplete as Oa, CreateFlow201StepChallengeOptions as Oc, GetOpenIDConfiguration200DisplayValuesSupportedItem as Oi, ListUsers200Item as On, EndSession400 as Oo, GetUserByID200 as Or, CreateProject429Details as Os, SubmitFlowStep200StepChallenge as Ot, UpdateFlowDefinition200FlowDefinitionStepsItemTransitions as P, GetFlowStep200BrandingLayout as Pa, CreateAuthAttemptBody as Pc, GetMyUser404 as Pi, ListSessions403Details as Pn, CreateUserDefault as Po, GetToken4xx as Pr, CreateFlowDefinitionBody as Ps, SubmitFlowEventDefault as Pt, SubmitFlowStep400 as Q, GetAuthAttempt200State as Qa, AuthorizeDeviceDefaultDetails as Qc, GetLiveDefaultDetails as Qi, ListFlowDefinitions400Details as Qn, CreateTeam400 as Qo, GetSession200UserAgent as Qr, CreateFlowDefinition201FlowDefinitionStepsItem as Qs, SetUserPassword400Details as Qt, UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind as R, GetFlowDefinition200 as Ra, CreateAuthAttempt201CompletedFactorsItem as Rc, GetMySessionDefault as Ri, ListSessions400Details as Rn, CreateUser409Details as Ro, GetTeamDefaultDetails as Rr, CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem as Rs, SubmitFlowEventBodyPayload as Rt, UpdateFlowDefinitionBodyStepsItemGatesKind as S, GetFlowStep200StepGatesKind as Sa, CreateFlow201StepFieldsItem as Sc, GetProject200 as Si, ListUsersDefault as Sn, ExchangeHandoff200SessionFactorsItem as So, GetUserByIDDefault as Sr, CreateSchema400Details as Ss, SubmitFlowStep200StepGatesConfig as St, UpdateFlowDefinitionBodyStepsItemActionsItem as T, GetFlowStep200StepFieldsItemValidation as Ta, CreateFlow201StepFieldsItemType as Tc, GetOpenIDConfiguration200 as Ti, ListUsers500Details as Tn, EndSessionParams as To, GetUserByID404Details as Tr, CreateProjectDefaultDetails as Ts, SubmitFlowStep200StepFieldsItemValidationFormat as Tt, SubmitFlowStepDefault as U, GetFlowDefinition200FlowDefinitionStepsItemOnSuccess as Ua, CreateAuthAttempt201ChallengesItemPayload as Uc, GetMySession401Details as Ui, ListSessions200SessionsItemMetadata as Un, CreateUser400 as Uo, GetTeam200 as Ur, CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete as Us, SetUserPasswordParams as Ut, UpdateFlowDefinition200FlowDefinitionStepsItemActionsItem as V, GetFlowDefinition200FlowDefinitionStepsItemTransitions as Va, CreateAuthAttempt201ChallengesItem as Vc, GetMySession404Details as Vi, ListSessions200SessionsItemUserAgent as Vn, CreateUser401 as Vo, GetTeam401 as Vr, CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind as Vs, SubmitFlowEvent400 as Vt, SubmitFlowStepDefaultDetails as W, GetFlowDefinition200FlowDefinitionStepsItemGates as Wa, CreateAuthAttempt201ChallengesItemMethod as Wc, GetMySession200 as Wi, ListSessions200SessionsItemFactorsItem as Wn, CreateUser400Details as Wo, GetSessionParams as Wr, CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItem as Ws, SetUserPasswordDefault as Wt, SubmitFlowStep409 as X, GetAuthAttemptDefault as Xa, AuthorizeDeviceParams as Xc, GetMySession200FactorsItemMethod as Xi, ListFlowDefinitionsDefaultDetails as Xn, CreateTeam429 as Xo, GetSession401Details as Xr, CreateFlowDefinition201 as Xs, SetUserPassword404Details as Xt, SubmitFlowStepBodyChallengeResponseProof as Y, GetFlowDefinition200FlowDefinitionAudience as Ya, AuthorizeGet400Details as Yc, GetMySession200FactorsItemPayload as Yi, ListFlowDefinitionsDefault as Yn, CreateTeamBody as Yo, GetSession401 as Yr, CreateFlowDefinition400Details as Ys, SetUserPassword404 as Yt, SubmitFlowStep409Details as Z, GetAuthAttempt200 as Za, AuthorizeDeviceDefault as Zc, GetLiveDefault as Zi, ListFlowDefinitions400 as Zn, CreateTeam429Details as Zo, GetSession200 as Zr, CreateFlowDefinition201FlowDefinition as Zs, SetUserPassword400 as Zt, UpdateFlowDefinitionBodyStepsItem as _, GetFlowStep200 as _a, CreateFlow201StepTexts as _c, GetProjectDefaultDetails as _i, RevokeMySession404 as _n, ExchangeHandoff200 as _o, GetUserInfoDefaultDetails as _r, CreateSchemaDefaultDetails as _s, SubmitFlowStep200Step as _t, VerifyChallengeProof200RequiredFactorsItem as a, GetKeys4xx as aa, CreateFlowDefinition201FlowDefinitionStepsItemComplete as ac, GetSchemaByIdDefault as ai, RevokeSessionDefault as an, GetAuthAttempt200ChallengesItemPayload as ao, IssueChallengeBodyMethod as ar, CreateSession400 as as, SubmitFlowStep400StepFieldsItem as at, UpdateFlowDefinitionBodyStepsItemOnSuccess as b, GetFlowStep200StepSsoProvidersItem as ba, CreateFlow201StepGatesKind as bc, GetProject401 as bi, RevokeMySession401Details as bn, ExchangeHandoff200SessionState as bo, GetUserInfo4xxDetails as br, CreateSchema409Details as bs, SubmitFlowStep200StepGates as bt, VerifyChallengeProof200CompletedFactorsItemMethod as c, GetHealthDefaultDetails as ca, CreateFlowDefault as cc, GetSchemaById404Details as ci, RevokeSession409Details as cn, ExchangeHandoffDefault as co, IssueChallenge201Payload as cr, CreateSession201Session as cs, SubmitFlowStep400StepFieldsItemType as ct, VerifyChallengeProof200ChallengesItemPayload as d, GetFlowStepDefault as da, CreateFlowBodyPurpose as dc, GetSchemaById200 as di, RevokeSession401 as dn, ExchangeHandoff410 as do, IntrospectDefaultDetails as dr, CreateSession201SessionMetadata as ds, SubmitFlowStep400StepChallengeOptions as dt, GetLive4xxDetails as ea, CreateFlowDefinition201FlowDefinitionStepsItemSsoProvidersItem as ec, GetSession200Metadata as ei, AuthorizeDevice400Details as el, RevokeTokenDefaultDetails as en, GetAuthAttempt200CompletedFactorsItem as eo, ListFlowDefinitions200FlowDefinitionsItem as er, CreateTeam201 as es, SubmitFlowStep400StepTexts as et, VerifyChallengeProof200ChallengesItemMethod as f, GetFlowStepDefaultDetails as fa, CreateFlowBodyHint as fc, GetReadyDefault as fi, RevokeSession401Details as fn, ExchangeHandoff410Details as fo, IntrospectBody as fr, CreateSession201SessionFactorsItem as fs, SubmitFlowStep400StepChallengeMethod as ft, UpdateFlowDefinitionBody as g, GetFlowStep404Details as ga, CreateFlow201Step as gc, GetProjectDefault as gi, RevokeMySession409Details as gn, ExchangeHandoff400Details as go, GetUserInfoDefault as gr, CreateSchemaDefault as gs, SubmitFlowStep200 as gt, UpdateFlowDefinitionDefaultDetails as h, GetFlowStep404 as ha, CreateFlow201 as hc, GetReady4xxDetails as hi, RevokeMySession409 as hn, ExchangeHandoff400 as ho, Introspect200 as hr, CreateSchemaParams as hs, SubmitFlowStep400BrandingLayout as ht, VerifyChallengeProof200State as i, GetKeys200KeysItem as ia, CreateFlowDefinition201FlowDefinitionStepsItemGatesConfig as ic, GetSchemaByIdParams as ii, RevokeSessionParams as in, GetAuthAttempt200ChallengesItemState as io, IssueChallengeBodyPasskeyOptionsUserVerification as ir, CreateSessionBodyUserAgent as is, SubmitFlowStep400StepGatesConfig as it, UpdateFlowDefinition200 as j, GetFlowStep200StepChallengeMethod as ja, CreateFlow201Branding as jc, GetOpenIDConfiguration4xxDetails as ji, ListSessionsDefault as jn, DeleteFlowDefinitionDefault as jo, GetTokenBody as jr, CreateHandoff200 as js, SubmitFlowStep200StepActionsItem as jt, UpdateFlowDefinition400 as k, GetFlowStep200StepChallenge as ka, CreateFlow201StepChallengeMethod as kc, GetOpenIDConfiguration200ClaimTypesSupportedItem as ki, ListSessionsParams as kn, EndSession400Details as ko, GetTokenDefault as kr, CreateProject201 as ks, SubmitFlowStep200StepChallengeOptions as kt, VerifyChallengeProof200ChallengesItem as l, GetHealth4xx as la, CreateFlowDefaultDetails as lc, GetSchemaById400 as li, RevokeSession404 as ln, ExchangeHandoffDefaultDetails as lo, IssueChallenge201Method as lr, CreateSession201SessionUserAgent as ls, SubmitFlowStep400StepComplete as lt, UpdateFlowDefinitionDefault as m, GetFlowStep410Details as ma, CreateFlow400Details as mc, GetReady4xx as mi, RevokeMySessionDefaultDetails as mn, ExchangeHandoff401Details as mo, Introspect400Details as mr, CreateSession201SessionFactorsItemMethod as ms, SubmitFlowStep400Branding as mt, VerifyChallengeProofBody as n, GetKeysDefaultDetails as na, CreateFlowDefinition201FlowDefinitionStepsItemGates as nc, GetSession200FactorsItemPayload as ni, RevokeToken4xx as nn, GetAuthAttempt200CompletedFactorsItemMethod as no, IssueChallengeBody as nr, CreateSessionDefaultDetails as ns, SubmitFlowStep400StepGates as nt, VerifyChallengeProof200CompletedFactorsItem as o, GetKeys4xxDetails as oa, CreateFlowDefinition201FlowDefinitionStepsItemActionsItem as oc, GetSchemaByIdDefaultDetails as oi, RevokeSessionDefaultDetails as on, GetAuthAttempt200ChallengesItemMethod as oo, IssueChallenge201 as or, CreateSession400Details as os, SubmitFlowStep400StepFieldsItemValidation as ot, UpdateFlowDefinitionParams as p, GetFlowStep410 as pa, CreateFlow400 as pc, GetReadyDefaultDetails as pi, RevokeMySessionDefault as pn, ExchangeHandoff401 as po, Introspect400 as pr, CreateSession201SessionFactorsItemPayload as ps, SubmitFlowStep400StepActionsItem as pt, SubmitFlowStepBodyFields as q, GetFlowDefinition200FlowDefinitionStepsItemComplete as qa, AuthorizeGetDefaultDetails as qc, GetMySession200Metadata as qi, ListFlowDefinitionsParams as qn, CreateTeamDefault as qo, GetSession404 as qr, CreateFlowDefinition409Details as qs, SetUserPassword500 as qt, VerifyChallengeProof200 as r, GetKeys200 as ra, CreateFlowDefinition201FlowDefinitionStepsItemGatesKind as rc, GetSession200FactorsItemMethod as ri, RevokeToken4xxDetails as rn, GetAuthAttempt200ChallengesItem as ro, IssueChallengeBodyPasskeyOptions as rr, CreateSessionBody as rs, SubmitFlowStep400StepGatesKind as rt, VerifyChallengeProof200CompletedFactorsItemPayload as s, GetHealthDefault as sa, CreateFlowDefinition201FlowDefinitionAudience as sc, GetSchemaById404 as si, RevokeSession409 as sn, ExchangeHandoffParams as so, IssueChallenge201State as sr, CreateSession201 as ss, SubmitFlowStep400StepFieldsItemValidationFormat as st, VerifyChallengeProofDefault as t, GetKeysDefault as ta, CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess as tc, GetSession200FactorsItem as ti, AuthorizeDevice200 as tl, RevokeTokenBody as tn, GetAuthAttempt200CompletedFactorsItemPayload as to, IssueChallengeDefault as tr, CreateSessionDefault as ts, SubmitFlowStep400StepSsoProvidersItem as tt, VerifyChallengeProof200ChallengesItemState as u, GetHealth4xxDetails as ua, CreateFlowBody as uc, GetSchemaById400Details as ui, RevokeSession404Details as un, ExchangeHandoffBody as uo, IntrospectDefault as ur, CreateSession201SessionState as us, SubmitFlowStep400StepChallenge as ut, UpdateFlowDefinitionBodyStepsItemTransitions as v, GetFlowStep200Step as va, CreateFlow201StepSsoProvidersItem as vc, GetProject404 as vi, RevokeMySession404Details as vn, ExchangeHandoff200Session as vo, GetUserInfo200 as vr, CreateSchemaBody as vs, SubmitFlowStep200StepTexts as vt, UpdateFlowDefinitionBodyStepsItemComplete as w, GetFlowStep200StepFieldsItem as wa, CreateFlow201StepFieldsItemValidationFormat as wc, GetOpenIDConfigurationDefaultDetails as wi, ListUsers500 as wn, ExchangeHandoff200SessionFactorsItemMethod as wo, GetUserByID404 as wr, CreateProjectDefault as ws, SubmitFlowStep200StepFieldsItemValidation as wt, UpdateFlowDefinitionBodyStepsItemGates as x, GetFlowStep200StepGates as xa, CreateFlow201StepGatesConfig as xc, GetProject401Details as xi, ListUsersParams as xn, ExchangeHandoff200SessionMetadata as xo, GetUserByIDParams as xr, CreateSchema400 as xs, SubmitFlowStep200StepGatesKind as xt, UpdateFlowDefinitionBodyStepsItemSsoProvidersItem as y, GetFlowStep200StepTexts as ya, CreateFlow201StepGates as yc, GetProject404Details as yi, RevokeMySession401 as yn, ExchangeHandoff200SessionUserAgent as yo, GetUserInfo4xx as yr, CreateSchema409 as ys, SubmitFlowStep200StepSsoProvidersItem as yt, UpdateFlowDefinition200FlowDefinitionStepsItemGatesConfig as z, GetFlowDefinition200FlowDefinition as za, CreateAuthAttempt201CompletedFactorsItemPayload as zc, GetMySessionDefaultDetails as zi, ListSessions200 as zn, CreateUser403 as zo, GetTeam404 as zr, CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess as zs, SubmitFlowEvent404 as zt };
+//# sourceMappingURL=index-BGnjxx-b.d.mts.map