@zitadel/api 0.0.0 → 0.1.0-alpha.2

package/dist/{index-DlEenfQJ.d.mts → index-DyBulyp9.d.mts}

@@ -1143,207 +1143,7 @@ type CreateFlowDefault = {
   details?: CreateFlowDefaultDetails;
 };
 //#endregion
-//#region src/generated/model/createFlowDefinition201.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type CreateFlowDefinition201 = {
-  /**
-     * Stable identifier for this flow, used as the target of cross-flow
-  `switch` and `pivot` transitions. Renaming is not supported — the
-  `name` is part of the public contract another definition may
-  reference. Acts as the human display label as well; no separate slug.
-        * @pattern ^[a-z][a-z0-9-]*$
-     */
-  name: string;
-  /** User schema this flow operates on. Step `fields` reference properties
-  defined in this schema. The engine resolves field types, validation,
-  and implicit outcomes from schema annotations at runtime.
-   */
-  user_schema: string;
-  /** Maps each purpose this definition handles to its entry-point step.
-  Keys are purpose names; values must match a `name` in `steps`. A
-  definition can serve multiple purposes (e.g. a combined login/register
-  flow) by listing one entry per purpose.
-   */
-  purposes: Partial<Record<"login" | "register" | "recovery" | "profiling" | "reauth" | "link_account", string>>;
-  /** Scopes which teams or apps this flow definition applies to. Empty or
-  omitted fields mean "no restriction"; when both are empty the definition
-  matches every request in the project. The engine picks the most specific
-  matching definition: app > team > project-wide.
-   */
-  audience?: {
-    /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
-    app_ids?: string[];
-  };
-  /**
-     * Ordered list of steps in this flow. The order is for human readability —
-  actual step sequencing is determined by transitions.
-        * @minItems 1
-     */
-  steps: {
-    /** Unique step identifier within this flow. Used as transition targets
-    and returned in the API response as `step.name`.
-    */
-    name: string;
-    /** Schema property names to collect from the user. Each entry references
-    a property in the flow's user schema. The engine resolves field type,
-    validation rules, and implicit outcomes from schema annotations
-    (e.g. a property with `x-unique` set implies a `user_not_found`
-    transition outcome).
-    */
-    fields?: string[];
-    /** Actions the user can take. Keyed by action name.
-    The action name is what the frontend sends back in the submit request.
-    If omitted, the engine provides a default `submit` action.
-    */
-    actions?: {
-      [key: string]: {
-        /** Marks this as the default/primary action. The runtime template uses
-        this hint to choose visual emphasis. At most one action per step
-        should be primary; this is not enforced here.
-        */
-        primary?: boolean;
-        /** Optional localization key override for the action's label. When
-        omitted, the engine derives a key from the step and action names.
-        Display text is resolved client-side from a locale dictionary, never
-        by the engine.
-        */
-        text_key?: string;
-      };
-    };
-    /** Security gates that must be satisfied before submission. Keyed by gate
-    name. Each gate selects a kind (e.g. "captcha") and provider-specific
-    configuration. The engine may also inject gates dynamically based on
-    policy.
-    */
-    gates?: {
-      [key: string]: {
-        /** The gate category. Only `captcha` is currently defined. Authenticator
-        ceremonies (e.g. passkey) are modelled as credential auth_attempts via
-        `x-credential` on a field, not as gates.
-        */
-        kind: "captcha";
-        /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
-        `hcaptcha`. The engine looks up an implementation in its provider
-        registry.
-        */
-        provider: string;
-        /** Provider-specific configuration consumed by the implementation when
-        issuing the per-render challenge. Opaque to the engine.
-        */
-        config?: {
-          [key: string]: unknown;
-        };
-      };
-    }; /** Available SSO identity providers for this step. */
-    sso_providers?: {
-      /** Provider instance identifier. */id: string; /** Display name for the provider. */
-      name: string; /** Template hint for rendering (logo, colors). */
-      template: string;
-    }[];
-    /** Server-side mutation to execute when this step completes successfully.
-    Runs after field validation passes, before the transition fires.
-       - create_user: creates the user record (registration flows)
-    */
-    on_success?: "create_user";
-    /** Marks this as a terminal step. Tells the frontend what to do:
-    - redirect: navigate to redirect_uri (OIDC/SAML callback done)
-    - show: render as a success/info screen
-    */
-    complete?: "redirect" | "show";
-    /** Maps action/outcome names to their transition descriptor.
-       Keys match action names from the `actions` dict. Additional keys
-    come from implicit outcomes based on schema annotations
-    (e.g. `user_not_found` from `x-unique` fields) and engine
-    events (e.g. `sso`, `callback`).
-    */
-    transitions?: {
-      [key: string]: {
-        /** Step name within this flow (when `action` is null), or the name
-        of another flow (when `action` is `switch` or `pivot`).
-        */
-        target: string;
-        /** How to interpret `target`:
-        - null (omitted): transition to a step in the current flow.
-        - switch: replace the current flow with the target flow.
-        No return — the current flow is discarded.
-        Example: login ↔ register.
-        - pivot: push the target flow onto the stack. The current flow
-        is paused and resumes when the target flow completes (auto-pop).
-        Example: login → recovery → back to login.
-        */
-        action?: "switch" | "pivot" | null;
-      };
-    };
-  }[];
-} & {
-  /** Unique identifier for the flow definition. */id: string; /** Identifier of the project this flow definition belongs to. */
-  project_id: string;
-  /** URI of the flow definition schema this definition was authored against.
-  If the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.
-   */
-  schema_uri: string; /** Status of the flow definition. */
-  status: string;
-  created_at: string;
-  updated_at: string;
-};
-//#endregion
-//#region src/generated/model/createFlowDefinition400Details.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Additional error-specific context.
- */
-type CreateFlowDefinition400Details = {
-  [key: string]: unknown;
-};
-//#endregion
-//#region src/generated/model/createFlowDefinition400.d.ts
-/**
- * Standard error payload returned for failed API requests.
- */
-type CreateFlowDefinition400 = {
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: CreateFlowDefinition400Details;
-};
-//#endregion
-//#region src/generated/model/createFlowDefinition409Details.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Additional error-specific context.
- */
-type CreateFlowDefinition409Details = {
-  [key: string]: unknown;
-};
-//#endregion
-//#region src/generated/model/createFlowDefinition409.d.ts
-/**
- * Standard error payload returned for failed API requests.
- */
-type CreateFlowDefinition409 = {
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: CreateFlowDefinition409Details;
-};
-//#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionAudience.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionAudience.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1358,12 +1158,12 @@ matches every request in the project. The engine picks the most specific
 matching definition: app > team > project-wide.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionAudience = {
+type CreateFlowDefinition201FlowDefinitionAudience = {
   /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
   app_ids?: string[];
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemActions.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemActions.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1377,7 +1177,7 @@ The action name is what the frontend sends back in the submit request.
 If omitted, the engine provides a default `submit` action.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemActions = {
+type CreateFlowDefinition201FlowDefinitionStepsItemActions = {
   [key: string]: {
     /** Marks this as the default/primary action. The runtime template uses
     this hint to choose visual emphasis. At most one action per step
@@ -1393,7 +1193,7 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItemActions = {
   };
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemComplete.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemComplete.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1407,13 +1207,13 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItemActions = {
 - show: render as a success/info screen
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete];
-declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete: {
+type CreateFlowDefinition201FlowDefinitionStepsItemComplete = (typeof CreateFlowDefinition201FlowDefinitionStepsItemComplete)[keyof typeof CreateFlowDefinition201FlowDefinitionStepsItemComplete];
+declare const CreateFlowDefinition201FlowDefinitionStepsItemComplete: {
   readonly redirect: "redirect";
   readonly show: "show";
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemGatesConfig.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1426,11 +1226,11 @@ declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete: {
 issuing the per-render challenge. Opaque to the engine.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig = {
+type CreateFlowDefinition201FlowDefinitionStepsItemGatesConfig = {
   [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGatesKind.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemGatesKind.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1444,12 +1244,12 @@ ceremonies (e.g. passkey) are modelled as credential auth_attempts via
 `x-credential` on a field, not as gates.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind];
-declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind: {
+type CreateFlowDefinition201FlowDefinitionStepsItemGatesKind = (typeof CreateFlowDefinition201FlowDefinitionStepsItemGatesKind)[keyof typeof CreateFlowDefinition201FlowDefinitionStepsItemGatesKind];
+declare const CreateFlowDefinition201FlowDefinitionStepsItemGatesKind: {
   readonly captcha: "captcha";
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGates.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemGates.d.ts
 /**
  * Security gates that must be satisfied before submission. Keyed by gate
 name. Each gate selects a kind (e.g. "captcha") and provider-specific
@@ -1457,13 +1257,13 @@ configuration. The engine may also inject gates dynamically based on
 policy.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemGates = {
+type CreateFlowDefinition201FlowDefinitionStepsItemGates = {
   [key: string]: {
     /** The gate category. Only `captcha` is currently defined. Authenticator
     ceremonies (e.g. passkey) are modelled as credential auth_attempts via
     `x-credential` on a field, not as gates.
     */
-    kind: CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind;
+    kind: CreateFlowDefinition201FlowDefinitionStepsItemGatesKind;
     /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
     `hcaptcha`. The engine looks up an implementation in its provider
     registry.
@@ -1472,11 +1272,11 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItemGates = {
     /** Provider-specific configuration consumed by the implementation when
     issuing the per-render challenge. Opaque to the engine.
     */
-    config?: CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig;
+    config?: CreateFlowDefinition201FlowDefinitionStepsItemGatesConfig;
   };
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemOnSuccess.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1491,12 +1291,12 @@ Runs after field validation passes, before the transition fires.
 - create_user: creates the user record (registration flows)
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess];
-declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess: {
+type CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess = (typeof CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess)[keyof typeof CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess];
+declare const CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess: {
   readonly create_user: "create_user";
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemSsoProvidersItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1507,13 +1307,13 @@ declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess: {
 /**
  * An available SSO identity provider.
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem = {
+type CreateFlowDefinition201FlowDefinitionStepsItemSsoProvidersItem = {
   /** Provider instance identifier. */id: string; /** Display name for the provider. */
   name: string; /** Template hint for rendering (logo, colors). */
   template: string;
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemTransitions.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemTransitions.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1530,7 +1330,7 @@ come from implicit outcomes based on schema annotations
 events (e.g. `sso`, `callback`).
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions = {
+type CreateFlowDefinition201FlowDefinitionStepsItemTransitions = {
   [key: string]: {
     /** Step name within this flow (when `action` is null), or the name
     of another flow (when `action` is `switch` or `pivot`).
@@ -1549,7 +1349,7 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions = {
   };
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItem.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItem.d.ts
 /**
  * A step in a flow definition. This is the admin-authored configuration,
 not the runtime payload sent to the frontend.
@@ -1562,7 +1362,7 @@ A step with only `complete` set is a terminal step. All other steps are
 rendered to the frontend as capability payloads.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItem = {
+type CreateFlowDefinition201FlowDefinitionStepsItem = {
   /** Unique step identifier within this flow. Used as transition targets
   and returned in the API response as `step.name`.
    */
@@ -1578,34 +1378,34 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItem = {
   The action name is what the frontend sends back in the submit request.
   If omitted, the engine provides a default `submit` action.
    */
-  actions?: CreateFlowDefinitionBodyFlowDefinitionStepsItemActions;
+  actions?: CreateFlowDefinition201FlowDefinitionStepsItemActions;
   /** Security gates that must be satisfied before submission. Keyed by gate
   name. Each gate selects a kind (e.g. "captcha") and provider-specific
   configuration. The engine may also inject gates dynamically based on
   policy.
    */
-  gates?: CreateFlowDefinitionBodyFlowDefinitionStepsItemGates; /** Available SSO identity providers for this step. */
-  sso_providers?: CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem[];
+  gates?: CreateFlowDefinition201FlowDefinitionStepsItemGates; /** Available SSO identity providers for this step. */
+  sso_providers?: CreateFlowDefinition201FlowDefinitionStepsItemSsoProvidersItem[];
   /** Server-side mutation to execute when this step completes successfully.
   Runs after field validation passes, before the transition fires.
      - create_user: creates the user record (registration flows)
    */
-  on_success?: CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess;
+  on_success?: CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess;
   /** Marks this as a terminal step. Tells the frontend what to do:
   - redirect: navigate to redirect_uri (OIDC/SAML callback done)
   - show: render as a success/info screen
    */
-  complete?: CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete;
+  complete?: CreateFlowDefinition201FlowDefinitionStepsItemComplete;
   /** Maps action/outcome names to their transition descriptor.
      Keys match action names from the `actions` dict. Additional keys
   come from implicit outcomes based on schema annotations
   (e.g. `user_not_found` from `x-unique` fields) and engine
   events (e.g. `sso`, `callback`).
    */
-  transitions?: CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions;
+  transitions?: CreateFlowDefinition201FlowDefinitionStepsItemTransitions;
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinition.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinition.d.ts
 /**
  * A flow definition is the server-side configuration that describes a complete
 authentication or identity flow. It is NOT sent to the frontend — the flow
@@ -1617,7 +1417,7 @@ configuration hierarchy. The engine selects the matching definition based on
 the purpose + audience when a flow is created via POST /flow.
 
  */
-type CreateFlowDefinitionBodyFlowDefinition = {
+type CreateFlowDefinition201FlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
   `switch` and `pivot` transitions. Renaming is not supported — the
@@ -1642,23 +1442,20 @@ type CreateFlowDefinitionBodyFlowDefinition = {
   matches every request in the project. The engine picks the most specific
   matching definition: app > team > project-wide.
    */
-  audience?: CreateFlowDefinitionBodyFlowDefinitionAudience;
+  audience?: CreateFlowDefinition201FlowDefinitionAudience;
   /**
      * Ordered list of steps in this flow. The order is for human readability —
   actual step sequencing is determined by transitions.
         * @minItems 1
      */
-  steps: CreateFlowDefinitionBodyFlowDefinitionStepsItem[];
+  steps: CreateFlowDefinition201FlowDefinitionStepsItem[];
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionBody.d.ts
-type CreateFlowDefinitionBody = {
-  /** @pattern ^[a-zA-Z0-9_-]+$ */project_id: string;
-  /** URI of the server-published flow definition schema this definition was
-  authored against. The server uses this to validate the definition.
-  If not provided, the engine will use the latest schema version for validation.
-   */
-  schema_uri?: string;
+//#region src/generated/model/createFlowDefinition201.d.ts
+type CreateFlowDefinition201 = {
+  /** Unique identifier for the flow definition. */id: string; /** Identifier of the project this flow definition belongs to. */
+  project_id: string; /** Status of the flow definition. */
+  status: string;
   /** A flow definition is the server-side configuration that describes a complete
   authentication or identity flow. It is NOT sent to the frontend — the flow
   engine evaluates it and produces FlowResponse payloads (steps with capability
@@ -1667,10 +1464,12 @@ type CreateFlowDefinitionBody = {
   configuration hierarchy. The engine selects the matching definition based on
   the purpose + audience when a flow is created via POST /flow.
    */
-  flow_definition: CreateFlowDefinitionBodyFlowDefinition;
+  flow_definition: CreateFlowDefinition201FlowDefinition;
+  created_at: string;
+  updated_at: string;
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionDefaultDetails.d.ts
+//#region src/generated/model/createFlowDefinition400Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1681,21 +1480,21 @@ type CreateFlowDefinitionBody = {
 /**
  * Additional error-specific context.
  */
-type CreateFlowDefinitionDefaultDetails = {
+type CreateFlowDefinition400Details = {
   [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/createFlowDefinitionDefault.d.ts
+//#region src/generated/model/createFlowDefinition400.d.ts
 /**
  * Standard error payload returned for failed API requests.
  */
-type CreateFlowDefinitionDefault = {
+type CreateFlowDefinition400 = {
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: CreateFlowDefinitionDefaultDetails;
+  details?: CreateFlowDefinition400Details;
 };
 //#endregion
-//#region src/generated/model/createHandoff200.d.ts
+//#region src/generated/model/createFlowDefinition409Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1704,27 +1503,23 @@ type CreateFlowDefinitionDefault = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * The handoff token and metadata for session exchange.
-
-This is a short-lived credential (TTL ≤ 60 seconds) that the client must exchange
-at POST /sessions/exchange to receive the final session and session_token.
-The handoff token is single-use and audience-bound to the project.
-
+ * Additional error-specific context.
  */
-type CreateHandoff200 = {
-  /** The short-lived handoff token for session exchange.
-     Exchange at: POST /sessions/exchange
-     Requirements:
-  - Single-use (atomic GETDEL on exchange)
-  - TTL ≤ 60 seconds
-  - Audience-bound to project (exchange requires sk_proj_… for matching project)
-  - Idempotency-safe (Category B, 5-minute window)
-   */
-  handoff_token: string; /** When this handoff token expires */
-  expires_at: string;
+type CreateFlowDefinition409Details = {
+  [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/createHandoffDefault.d.ts
+//#region src/generated/model/createFlowDefinition409.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type CreateFlowDefinition409 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: CreateFlowDefinition409Details;
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionAudience.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1732,41 +1527,19 @@ type CreateHandoff200 = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type CreateHandoffDefault = ({
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: {
-    [key: string]: unknown;
-  };
-} & {
-  code: "att.not_found";
-}) | ({
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: {
-    [key: string]: unknown;
-  };
-} & {
-  code: "att.invalid_state";
-}) | ({
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: {
-    [key: string]: unknown;
-  };
-} & {
-  code: "att.not_completed";
-}) | ({
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: {
-    [key: string]: unknown;
-  };
-} & {
-  code: "internal";
-});
+/**
+ * Scopes which teams or apps this flow definition applies to. Empty or
+omitted fields mean "no restriction"; when both are empty the definition
+matches every request in the project. The engine picks the most specific
+matching definition: app > team > project-wide.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionAudience = {
+  /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
+  app_ids?: string[];
+};
 //#endregion
-//#region src/generated/model/createProject201.d.ts
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemActions.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1774,10 +1547,413 @@ type CreateHandoffDefault = ({
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type CreateProject201 = {
-  /** The unique identifier of the project. */id: string;
-  /** Secret which can be used for authentication when modifying the project.
-   */
+/**
+ * Actions the user can take. Keyed by action name.
+The action name is what the frontend sends back in the submit request.
+If omitted, the engine provides a default `submit` action.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemActions = {
+  [key: string]: {
+    /** Marks this as the default/primary action. The runtime template uses
+    this hint to choose visual emphasis. At most one action per step
+    should be primary; this is not enforced here.
+    */
+    primary?: boolean;
+    /** Optional localization key override for the action's label. When
+    omitted, the engine derives a key from the step and action names.
+    Display text is resolved client-side from a locale dictionary, never
+    by the engine.
+    */
+    text_key?: string;
+  };
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemComplete.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Marks this as a terminal step. Tells the frontend what to do:
+- redirect: navigate to redirect_uri (OIDC/SAML callback done)
+- show: render as a success/info screen
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete];
+declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete: {
+  readonly redirect: "redirect";
+  readonly show: "show";
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Provider-specific configuration consumed by the implementation when
+issuing the per-render challenge. Opaque to the engine.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGatesKind.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The gate category. Only `captcha` is currently defined. Authenticator
+ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+`x-credential` on a field, not as gates.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind];
+declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind: {
+  readonly captcha: "captcha";
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGates.d.ts
+/**
+ * Security gates that must be satisfied before submission. Keyed by gate
+name. Each gate selects a kind (e.g. "captcha") and provider-specific
+configuration. The engine may also inject gates dynamically based on
+policy.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemGates = {
+  [key: string]: {
+    /** The gate category. Only `captcha` is currently defined. Authenticator
+    ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+    `x-credential` on a field, not as gates.
+    */
+    kind: CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind;
+    /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
+    `hcaptcha`. The engine looks up an implementation in its provider
+    registry.
+    */
+    provider: string;
+    /** Provider-specific configuration consumed by the implementation when
+    issuing the per-render challenge. Opaque to the engine.
+    */
+    config?: CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig;
+  };
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Server-side mutation to execute when this step completes successfully.
+Runs after field validation passes, before the transition fires.
+
+- create_user: creates the user record (registration flows)
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess];
+declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess: {
+  readonly create_user: "create_user";
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * An available SSO identity provider.
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem = {
+  /** Provider instance identifier. */id: string; /** Display name for the provider. */
+  name: string; /** Template hint for rendering (logo, colors). */
+  template: string;
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemTransitions.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Maps action/outcome names to their transition descriptor.
+
+Keys match action names from the `actions` dict. Additional keys
+come from implicit outcomes based on schema annotations
+(e.g. `user_not_found` from `x-unique` fields) and engine
+events (e.g. `sso`, `callback`).
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions = {
+  [key: string]: {
+    /** Step name within this flow (when `action` is null), or the name
+    of another flow (when `action` is `switch` or `pivot`).
+    */
+    target: string;
+    /** How to interpret `target`:
+    - null (omitted): transition to a step in the current flow.
+    - switch: replace the current flow with the target flow.
+    No return — the current flow is discarded.
+    Example: login ↔ register.
+    - pivot: push the target flow onto the stack. The current flow
+    is paused and resumes when the target flow completes (auto-pop).
+    Example: login → recovery → back to login.
+    */
+    action?: "switch" | "pivot" | null;
+  };
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItem.d.ts
+/**
+ * A step in a flow definition. This is the admin-authored configuration,
+not the runtime payload sent to the frontend.
+
+Steps are schema-driven: `fields` references properties from the flow's
+user schema, and the engine resolves field metadata (type, validation,
+implicit outcomes) from schema annotations at runtime.
+
+A step with only `complete` set is a terminal step. All other steps are
+rendered to the frontend as capability payloads.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItem = {
+  /** Unique step identifier within this flow. Used as transition targets
+  and returned in the API response as `step.name`.
+   */
+  name: string;
+  /** Schema property names to collect from the user. Each entry references
+  a property in the flow's user schema. The engine resolves field type,
+  validation rules, and implicit outcomes from schema annotations
+  (e.g. a property with `x-unique` set implies a `user_not_found`
+  transition outcome).
+   */
+  fields?: string[];
+  /** Actions the user can take. Keyed by action name.
+  The action name is what the frontend sends back in the submit request.
+  If omitted, the engine provides a default `submit` action.
+   */
+  actions?: CreateFlowDefinitionBodyFlowDefinitionStepsItemActions;
+  /** Security gates that must be satisfied before submission. Keyed by gate
+  name. Each gate selects a kind (e.g. "captcha") and provider-specific
+  configuration. The engine may also inject gates dynamically based on
+  policy.
+   */
+  gates?: CreateFlowDefinitionBodyFlowDefinitionStepsItemGates; /** Available SSO identity providers for this step. */
+  sso_providers?: CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem[];
+  /** Server-side mutation to execute when this step completes successfully.
+  Runs after field validation passes, before the transition fires.
+     - create_user: creates the user record (registration flows)
+   */
+  on_success?: CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess;
+  /** Marks this as a terminal step. Tells the frontend what to do:
+  - redirect: navigate to redirect_uri (OIDC/SAML callback done)
+  - show: render as a success/info screen
+   */
+  complete?: CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete;
+  /** Maps action/outcome names to their transition descriptor.
+     Keys match action names from the `actions` dict. Additional keys
+  come from implicit outcomes based on schema annotations
+  (e.g. `user_not_found` from `x-unique` fields) and engine
+  events (e.g. `sso`, `callback`).
+   */
+  transitions?: CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions;
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinition.d.ts
+/**
+ * A flow definition is the server-side configuration that describes a complete
+authentication or identity flow. It is NOT sent to the frontend — the flow
+engine evaluates it and produces FlowResponse payloads (steps with capability
+dictionaries) for the client.
+
+Flow definitions are created by administrators and stored in the project/team
+configuration hierarchy. The engine selects the matching definition based on
+the purpose + audience when a flow is created via POST /flow.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinition = {
+  /**
+     * Stable identifier for this flow, used as the target of cross-flow
+  `switch` and `pivot` transitions. Renaming is not supported — the
+  `name` is part of the public contract another definition may
+  reference. Acts as the human display label as well; no separate slug.
+        * @pattern ^[a-z][a-z0-9-]*$
+     */
+  name: string;
+  /** User schema this flow operates on. Step `fields` reference properties
+  defined in this schema. The engine resolves field types, validation,
+  and implicit outcomes from schema annotations at runtime.
+   */
+  user_schema: string;
+  /** Maps each purpose this definition handles to its entry-point step.
+  Keys are purpose names; values must match a `name` in `steps`. A
+  definition can serve multiple purposes (e.g. a combined login/register
+  flow) by listing one entry per purpose.
+   */
+  purposes: Partial<Record<"login" | "register" | "recovery" | "profiling" | "reauth" | "link_account", string>>;
+  /** Scopes which teams or apps this flow definition applies to. Empty or
+  omitted fields mean "no restriction"; when both are empty the definition
+  matches every request in the project. The engine picks the most specific
+  matching definition: app > team > project-wide.
+   */
+  audience?: CreateFlowDefinitionBodyFlowDefinitionAudience;
+  /**
+     * Ordered list of steps in this flow. The order is for human readability —
+  actual step sequencing is determined by transitions.
+        * @minItems 1
+     */
+  steps: CreateFlowDefinitionBodyFlowDefinitionStepsItem[];
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionBody.d.ts
+type CreateFlowDefinitionBody = {
+  /** @pattern ^[a-zA-Z0-9_-]+$ */project_id: string;
+  /** URI of the server-published flow definition schema this definition was
+  authored against. The server uses this to validate the definition.
+  If not provided, the engine will use the latest schema version for validation.
+   */
+  schema_uri?: string;
+  /** A flow definition is the server-side configuration that describes a complete
+  authentication or identity flow. It is NOT sent to the frontend — the flow
+  engine evaluates it and produces FlowResponse payloads (steps with capability
+  dictionaries) for the client.
+     Flow definitions are created by administrators and stored in the project/team
+  configuration hierarchy. The engine selects the matching definition based on
+  the purpose + audience when a flow is created via POST /flow.
+   */
+  flow_definition: CreateFlowDefinitionBodyFlowDefinition;
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type CreateFlowDefinitionDefaultDetails = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/createFlowDefinitionDefault.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type CreateFlowDefinitionDefault = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: CreateFlowDefinitionDefaultDetails;
+};
+//#endregion
+//#region src/generated/model/createHandoff200.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The handoff token and metadata for session exchange.
+
+This is a short-lived credential (TTL ≤ 60 seconds) that the client must exchange
+at POST /sessions/exchange to receive the final session and session_token.
+The handoff token is single-use and audience-bound to the project.
+
+ */
+type CreateHandoff200 = {
+  /** The short-lived handoff token for session exchange.
+     Exchange at: POST /sessions/exchange
+     Requirements:
+  - Single-use (atomic GETDEL on exchange)
+  - TTL ≤ 60 seconds
+  - Audience-bound to project (exchange requires sk_proj_… for matching project)
+  - Idempotency-safe (Category B, 5-minute window)
+   */
+  handoff_token: string; /** When this handoff token expires */
+  expires_at: string;
+};
+//#endregion
+//#region src/generated/model/createHandoffDefault.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type CreateHandoffDefault = ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
+} & {
+  code: "att.not_found";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
+} & {
+  code: "att.invalid_state";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
+} & {
+  code: "att.not_completed";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
+} & {
+  code: "internal";
+});
+//#endregion
+//#region src/generated/model/createProject201.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type CreateProject201 = {
+  /** The unique identifier of the project. */id: string;
+  /** Secret which can be used for authentication when modifying the project.
+   */
   projectSecret: string;
   /** Secret which can be used for previewing and testing the project.
    */
@@ -2603,7 +2779,7 @@ type CreateUserParams = {
   team_id?: string;
 };
 //#endregion
-//#region src/generated/model/deleteFlowDefinition404Details.d.ts
+//#region src/generated/model/deleteFlowDefinitionDefaultDetails.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2614,21 +2790,21 @@ type CreateUserParams = {
 /**
  * Additional error-specific context.
  */
-type DeleteFlowDefinition404Details = {
+type DeleteFlowDefinitionDefaultDetails = {
   [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/deleteFlowDefinition404.d.ts
+//#region src/generated/model/deleteFlowDefinitionDefault.d.ts
 /**
  * Standard error payload returned for failed API requests.
  */
-type DeleteFlowDefinition404 = {
+type DeleteFlowDefinitionDefault = {
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: DeleteFlowDefinition404Details;
+  details?: DeleteFlowDefinitionDefaultDetails;
 };
 //#endregion
-//#region src/generated/model/deleteFlowDefinitionDefaultDetails.d.ts
+//#region src/generated/model/deleteFlowDefinitionParams.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2636,21 +2812,12 @@ type DeleteFlowDefinition404 = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
-type DeleteFlowDefinitionDefaultDetails = {
-  [key: string]: unknown;
-};
-//#endregion
-//#region src/generated/model/deleteFlowDefinitionDefault.d.ts
-/**
- * Standard error payload returned for failed API requests.
- */
-type DeleteFlowDefinitionDefault = {
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: DeleteFlowDefinitionDefaultDetails;
+type DeleteFlowDefinitionParams = {
+  /**
+   * The project id to filter by.
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
 };
 //#endregion
 //#region src/generated/model/endSession400Details.d.ts
@@ -2993,7 +3160,216 @@ type ExchangeHandoff401 = {
   details?: ExchangeHandoff401Details;
 };
 //#endregion
-//#region src/generated/model/exchangeHandoff410Details.d.ts
+//#region src/generated/model/exchangeHandoff410Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type ExchangeHandoff410Details = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/exchangeHandoff410.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type ExchangeHandoff410 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: ExchangeHandoff410Details;
+};
+//#endregion
+//#region src/generated/model/exchangeHandoffBody.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Request to exchange a handoff token for a session and session_token.
+ */
+type ExchangeHandoffBody = {
+  /** The one-time handoff token minted by `POST /auth_attempts/{id}/handoff`.
+  Single-use — replaying it after a successful exchange returns `410 Gone`.
+   */
+  handoff_token: string;
+  /** Optional session lifetime after exchange as an ISO-8601 duration. When omitted, the server
+  uses the configured default. Must not exceed the configured maximum.
+   */
+  ttl?: string;
+};
+//#endregion
+//#region src/generated/model/exchangeHandoffDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type ExchangeHandoffDefaultDetails = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/exchangeHandoffDefault.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type ExchangeHandoffDefault = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: ExchangeHandoffDefaultDetails;
+};
+//#endregion
+//#region src/generated/model/exchangeHandoffParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type ExchangeHandoffParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+};
+//#endregion
+//#region src/generated/model/getAuthAttempt200ChallengesItemMethod.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * An authentication factor method.
+ */
+type GetAuthAttempt200ChallengesItemMethod = (typeof GetAuthAttempt200ChallengesItemMethod)[keyof typeof GetAuthAttempt200ChallengesItemMethod];
+declare const GetAuthAttempt200ChallengesItemMethod: {
+  readonly identifier: "identifier";
+  readonly password: "password";
+  readonly passkey: "passkey";
+};
+//#endregion
+//#region src/generated/model/getAuthAttempt200ChallengesItemPayload.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Method-specific challenge data. Structure depends on the `method` field.
+- `identifier`, `password`: null (no additional data needed)
+- `passkey`: WebAuthn challenge and credential options
+- `idp`: Authorization URL and provider information
+
+ */
+type GetAuthAttempt200ChallengesItemPayload = {
+  [key: string]: unknown;
+} | {
+  /** Contains the options for the Assertion Generation (dictionary PublicKeyCredentialRequestOptions).
+  See also: https://www.w3.org/TR/webauthn/#dictdef-publickeycredentialrequestoptions
+  */
+  public_key: {
+    /** Base64-encoded WebAuthn challenge */challenge: string; /** List of credential IDs that can be used for this authentication */
+    allowed_credentials?: {
+      /** Base64-encoded credential ID */id: string;
+      type: "public-key";
+    }[]; /** User verification requirement for this challenge */
+    user_verification?: "required" | "preferred" | "discouraged"; /** Relying Party ID for WebAuthn */
+    rp_id?: string;
+  };
+};
+//#endregion
+//#region src/generated/model/getAuthAttempt200ChallengesItemState.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Current state of this challenge:
+- `pending`: awaiting proof submission
+- `failed`: proof rejected (invalid credential, wrong code, etc.)
+- `expired`: challenge TTL exceeded without verification
+
+ */
+type GetAuthAttempt200ChallengesItemState = (typeof GetAuthAttempt200ChallengesItemState)[keyof typeof GetAuthAttempt200ChallengesItemState];
+declare const GetAuthAttempt200ChallengesItemState: {
+  readonly pending: "pending";
+  readonly failed: "failed";
+  readonly expired: "expired";
+};
+//#endregion
+//#region src/generated/model/getAuthAttempt200ChallengesItem.d.ts
+/**
+ * A factor challenge issued within an authentication attempt.
+
+A challenge presents a single-factor verification prompt (password entry, TOTP code, passkey assertion, etc.).
+The client verifies the proof by POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.
+
+ */
+type GetAuthAttempt200ChallengesItem = {
+  /**
+   * Unique identifier for this challenge
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  challenge_id: string; /** An authentication factor method. */
+  method: GetAuthAttempt200ChallengesItemMethod;
+  /** Current state of this challenge:
+  - `pending`: awaiting proof submission
+  - `failed`: proof rejected (invalid credential, wrong code, etc.)
+  - `expired`: challenge TTL exceeded without verification
+   */
+  state: GetAuthAttempt200ChallengesItemState; /** When this challenge was issued */
+  created_at: string; /** When this challenge expires */
+  expires_at?: string | null;
+  /** Method-specific challenge data. Structure depends on the `method` field.
+  - `identifier`, `password`: null (no additional data needed)
+  - `passkey`: WebAuthn challenge and credential options
+  - `idp`: Authorization URL and provider information
+   */
+  payload?: GetAuthAttempt200ChallengesItemPayload;
+};
+//#endregion
+//#region src/generated/model/getAuthAttempt200CompletedFactorsItemMethod.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * An authentication factor method.
+ */
+type GetAuthAttempt200CompletedFactorsItemMethod = (typeof GetAuthAttempt200CompletedFactorsItemMethod)[keyof typeof GetAuthAttempt200CompletedFactorsItemMethod];
+declare const GetAuthAttempt200CompletedFactorsItemMethod: {
+  readonly identifier: "identifier";
+  readonly password: "password";
+  readonly passkey: "passkey";
+};
+//#endregion
+//#region src/generated/model/getAuthAttempt200CompletedFactorsItemPayload.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3002,23 +3378,42 @@ type ExchangeHandoff401 = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
+ * Method-specific factor metadata. Structure depends on the `method` field.
+- `identifier`: includes user_id
+- `password`: no additional data
+- `passkey`: includes credential details and verification flags
+
  */
-type ExchangeHandoff410Details = {
+type GetAuthAttempt200CompletedFactorsItemPayload = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */user_id: string;
+} | {
   [key: string]: unknown;
+} | {
+  /** The credential ID that was used */credential_id: string; /** Whether user verification was performed (PIN/biometric) */
+  user_verified: boolean; /** Whether the credential is backup eligible (can be synced) */
+  backup_eligible?: boolean; /** Whether the credential is currently backed up */
+  backup_state?: boolean; /** Authenticator attachment modality */
+  authenticator_attachment?: "platform" | "cross-platform";
 };
 //#endregion
-//#region src/generated/model/exchangeHandoff410.d.ts
+//#region src/generated/model/getAuthAttempt200CompletedFactorsItem.d.ts
 /**
- * Standard error payload returned for failed API requests.
+ * A successfully verified authentication factor with verification metadata.
+Method-specific details are included in the `payload` field.
+
  */
-type ExchangeHandoff410 = {
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: ExchangeHandoff410Details;
+type GetAuthAttempt200CompletedFactorsItem = {
+  /** An authentication factor method. */method: GetAuthAttempt200CompletedFactorsItemMethod; /** When this factor was successfully verified */
+  verified_at: string;
+  /** Method-specific factor metadata. Structure depends on the `method` field.
+  - `identifier`: includes user_id
+  - `password`: no additional data
+  - `passkey`: includes credential details and verification flags
+   */
+  payload?: GetAuthAttempt200CompletedFactorsItemPayload;
 };
 //#endregion
-//#region src/generated/model/exchangeHandoffBody.d.ts
+//#region src/generated/model/getAuthAttempt200RequiredFactorsItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3027,20 +3422,16 @@ type ExchangeHandoff410 = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Request to exchange a handoff token for a session and session_token.
+ * An authentication factor method.
  */
-type ExchangeHandoffBody = {
-  /** The one-time handoff token minted by `POST /auth_attempts/{id}/handoff`.
-  Single-use — replaying it after a successful exchange returns `410 Gone`.
-   */
-  handoff_token: string;
-  /** Optional session lifetime after exchange as an ISO-8601 duration. When omitted, the server
-  uses the configured default. Must not exceed the configured maximum.
-   */
-  ttl?: string;
+type GetAuthAttempt200RequiredFactorsItem = (typeof GetAuthAttempt200RequiredFactorsItem)[keyof typeof GetAuthAttempt200RequiredFactorsItem];
+declare const GetAuthAttempt200RequiredFactorsItem: {
+  readonly identifier: "identifier";
+  readonly password: "password";
+  readonly passkey: "passkey";
 };
 //#endregion
-//#region src/generated/model/exchangeHandoffDefaultDetails.d.ts
+//#region src/generated/model/getAuthAttempt200State.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3049,23 +3440,77 @@ type ExchangeHandoffBody = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
+ * Overall state of the authentication attempt:
+- `in_progress`: factors are still being collected; continue issuing challenges.
+- `completed`: all required factors have been verified; the attempt is ready for handoff.
+- `failed`: the attempt has failed (e.g. too many failed proofs) and cannot be continued.
+- `expired`: the 15-minute TTL has been exceeded.
+
  */
-type ExchangeHandoffDefaultDetails = {
-  [key: string]: unknown;
+type GetAuthAttempt200State = (typeof GetAuthAttempt200State)[keyof typeof GetAuthAttempt200State];
+declare const GetAuthAttempt200State: {
+  readonly in_progress: "in_progress";
+  readonly completed: "completed";
+  readonly failed: "failed";
+  readonly expired: "expired";
 };
 //#endregion
-//#region src/generated/model/exchangeHandoffDefault.d.ts
+//#region src/generated/model/getAuthAttempt200.d.ts
 /**
- * Standard error payload returned for failed API requests.
+ * The current state of an authentication attempt.
+
+An attempt is an ephemeral state machine (15-minute TTL) that drives a single authentication round.
+It accepts factor challenges, verifies proofs, and completes into a handoff token.
+Clients drive the attempt by:
+1. Issuing challenges: POST /auth_attempts/{attempt_id}/challenges
+2. Verifying proofs: POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify
+3. Completing: POST /auth_attempts/{attempt_id}/handoff
+
  */
-type ExchangeHandoffDefault = {
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: ExchangeHandoffDefaultDetails;
+type GetAuthAttempt200 = {
+  /**
+   * Unique identifier for this authentication attempt
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  attempt_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string;
+  /** Overall state of the authentication attempt:
+  - `in_progress`: factors are still being collected; continue issuing challenges.
+  - `completed`: all required factors have been verified; the attempt is ready for handoff.
+  - `failed`: the attempt has failed (e.g. too many failed proofs) and cannot be continued.
+  - `expired`: the 15-minute TTL has been exceeded.
+   */
+  state: GetAuthAttempt200State;
+  /** The session being authenticated into. Either newly created or passed in on POST.
+  For step-up (re-auth), this is the existing session_id provided on creation.
+   */
+  session_id?: string | null;
+  /** The user ID, if known at this point in the flow.
+  Null until an identifier challenge has been verified.
+   */
+  user_id?: string | null;
+  /** The authentication factor methods that the project policy requires in order
+  to complete this attempt. Computed by the server from the project's auth policy.
+  Clients should use this to determine which challenges still need to be issued.
+   */
+  required_factors?: GetAuthAttempt200RequiredFactorsItem[];
+  /** The factors that have been successfully verified in this attempt so far.
+  Each item includes method-specific metadata in the payload field.
+     The flow engine uses verified_at timestamps to enforce time-based policies, such as
+  requiring password verification within the last 5 minutes for step-up auth to
+  access sensitive operations.
+     A factor appears here once its challenge reaches `verified` state.
+   */
+  completed_factors?: GetAuthAttempt200CompletedFactorsItem[];
+  /** All challenges issued within this attempt, in creation order.
+  Use this to track the state of each factor challenge (pending, verified, failed, expired).
+   */
+  challenges?: GetAuthAttempt200ChallengesItem[]; /** When this attempt expires (15-minute TTL from creation) */
+  expires_at?: string; /** When this attempt was created */
+  created_at: string;
 };
 //#endregion
-//#region src/generated/model/exchangeHandoffParams.d.ts
+//#region src/generated/model/getAuthAttemptDefault.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3073,15 +3518,25 @@ type ExchangeHandoffDefault = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type ExchangeHandoffParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  project_id: string;
-};
+type GetAuthAttemptDefault = ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
+} & {
+  code: "att.not_found";
+}) | ({
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
+} & {
+  code: "internal";
+});
 //#endregion
-//#region src/generated/model/getAuthAttempt200ChallengesItemMethod.d.ts
+//#region src/generated/model/getFlowDefinition200FlowDefinitionAudience.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3090,16 +3545,18 @@ type ExchangeHandoffParams = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * An authentication factor method.
+ * Scopes which teams or apps this flow definition applies to. Empty or
+omitted fields mean "no restriction"; when both are empty the definition
+matches every request in the project. The engine picks the most specific
+matching definition: app > team > project-wide.
+
  */
-type GetAuthAttempt200ChallengesItemMethod = (typeof GetAuthAttempt200ChallengesItemMethod)[keyof typeof GetAuthAttempt200ChallengesItemMethod];
-declare const GetAuthAttempt200ChallengesItemMethod: {
-  readonly identifier: "identifier";
-  readonly password: "password";
-  readonly passkey: "passkey";
+type GetFlowDefinition200FlowDefinitionAudience = {
+  /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
+  app_ids?: string[];
 };
 //#endregion
-//#region src/generated/model/getAuthAttempt200ChallengesItemPayload.d.ts
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemActions.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3108,30 +3565,28 @@ declare const GetAuthAttempt200ChallengesItemMethod: {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Method-specific challenge data. Structure depends on the `method` field.
-- `identifier`, `password`: null (no additional data needed)
-- `passkey`: WebAuthn challenge and credential options
-- `idp`: Authorization URL and provider information
+ * Actions the user can take. Keyed by action name.
+The action name is what the frontend sends back in the submit request.
+If omitted, the engine provides a default `submit` action.
 
  */
-type GetAuthAttempt200ChallengesItemPayload = {
-  [key: string]: unknown;
-} | {
-  /** Contains the options for the Assertion Generation (dictionary PublicKeyCredentialRequestOptions).
-  See also: https://www.w3.org/TR/webauthn/#dictdef-publickeycredentialrequestoptions
-  */
-  public_key: {
-    /** Base64-encoded WebAuthn challenge */challenge: string; /** List of credential IDs that can be used for this authentication */
-    allowed_credentials?: {
-      /** Base64-encoded credential ID */id: string;
-      type: "public-key";
-    }[]; /** User verification requirement for this challenge */
-    user_verification?: "required" | "preferred" | "discouraged"; /** Relying Party ID for WebAuthn */
-    rp_id?: string;
+type GetFlowDefinition200FlowDefinitionStepsItemActions = {
+  [key: string]: {
+    /** Marks this as the default/primary action. The runtime template uses
+    this hint to choose visual emphasis. At most one action per step
+    should be primary; this is not enforced here.
+    */
+    primary?: boolean;
+    /** Optional localization key override for the action's label. When
+    omitted, the engine derives a key from the step and action names.
+    Display text is resolved client-side from a locale dictionary, never
+    by the engine.
+    */
+    text_key?: string;
   };
 };
 //#endregion
-//#region src/generated/model/getAuthAttempt200ChallengesItemState.d.ts
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemComplete.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3140,51 +3595,35 @@ type GetAuthAttempt200ChallengesItemPayload = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Current state of this challenge:
-- `pending`: awaiting proof submission
-- `failed`: proof rejected (invalid credential, wrong code, etc.)
-- `expired`: challenge TTL exceeded without verification
+ * Marks this as a terminal step. Tells the frontend what to do:
+- redirect: navigate to redirect_uri (OIDC/SAML callback done)
+- show: render as a success/info screen
 
  */
-type GetAuthAttempt200ChallengesItemState = (typeof GetAuthAttempt200ChallengesItemState)[keyof typeof GetAuthAttempt200ChallengesItemState];
-declare const GetAuthAttempt200ChallengesItemState: {
-  readonly pending: "pending";
-  readonly failed: "failed";
-  readonly expired: "expired";
+type GetFlowDefinition200FlowDefinitionStepsItemComplete = (typeof GetFlowDefinition200FlowDefinitionStepsItemComplete)[keyof typeof GetFlowDefinition200FlowDefinitionStepsItemComplete];
+declare const GetFlowDefinition200FlowDefinitionStepsItemComplete: {
+  readonly redirect: "redirect";
+  readonly show: "show";
 };
 //#endregion
-//#region src/generated/model/getAuthAttempt200ChallengesItem.d.ts
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemGatesConfig.d.ts
 /**
- * A factor challenge issued within an authentication attempt.
-
-A challenge presents a single-factor verification prompt (password entry, TOTP code, passkey assertion, etc.).
-The client verifies the proof by POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Provider-specific configuration consumed by the implementation when
+issuing the per-render challenge. Opaque to the engine.
 
  */
-type GetAuthAttempt200ChallengesItem = {
-  /**
-   * Unique identifier for this challenge
-   * @pattern ^[a-zA-Z0-9_-]+$
-   */
-  challenge_id: string; /** An authentication factor method. */
-  method: GetAuthAttempt200ChallengesItemMethod;
-  /** Current state of this challenge:
-  - `pending`: awaiting proof submission
-  - `failed`: proof rejected (invalid credential, wrong code, etc.)
-  - `expired`: challenge TTL exceeded without verification
-   */
-  state: GetAuthAttempt200ChallengesItemState; /** When this challenge was issued */
-  created_at: string; /** When this challenge expires */
-  expires_at?: string | null;
-  /** Method-specific challenge data. Structure depends on the `method` field.
-  - `identifier`, `password`: null (no additional data needed)
-  - `passkey`: WebAuthn challenge and credential options
-  - `idp`: Authorization URL and provider information
-   */
-  payload?: GetAuthAttempt200ChallengesItemPayload;
+type GetFlowDefinition200FlowDefinitionStepsItemGatesConfig = {
+  [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/getAuthAttempt200CompletedFactorsItemMethod.d.ts
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemGatesKind.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3193,16 +3632,44 @@ type GetAuthAttempt200ChallengesItem = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * An authentication factor method.
+ * The gate category. Only `captcha` is currently defined. Authenticator
+ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+`x-credential` on a field, not as gates.
+
  */
-type GetAuthAttempt200CompletedFactorsItemMethod = (typeof GetAuthAttempt200CompletedFactorsItemMethod)[keyof typeof GetAuthAttempt200CompletedFactorsItemMethod];
-declare const GetAuthAttempt200CompletedFactorsItemMethod: {
-  readonly identifier: "identifier";
-  readonly password: "password";
-  readonly passkey: "passkey";
+type GetFlowDefinition200FlowDefinitionStepsItemGatesKind = (typeof GetFlowDefinition200FlowDefinitionStepsItemGatesKind)[keyof typeof GetFlowDefinition200FlowDefinitionStepsItemGatesKind];
+declare const GetFlowDefinition200FlowDefinitionStepsItemGatesKind: {
+  readonly captcha: "captcha";
 };
 //#endregion
-//#region src/generated/model/getAuthAttempt200CompletedFactorsItemPayload.d.ts
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemGates.d.ts
+/**
+ * Security gates that must be satisfied before submission. Keyed by gate
+name. Each gate selects a kind (e.g. "captcha") and provider-specific
+configuration. The engine may also inject gates dynamically based on
+policy.
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemGates = {
+  [key: string]: {
+    /** The gate category. Only `captcha` is currently defined. Authenticator
+    ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+    `x-credential` on a field, not as gates.
+    */
+    kind: GetFlowDefinition200FlowDefinitionStepsItemGatesKind;
+    /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
+    `hcaptcha`. The engine looks up an implementation in its provider
+    registry.
+    */
+    provider: string;
+    /** Provider-specific configuration consumed by the implementation when
+    issuing the per-render challenge. Opaque to the engine.
+    */
+    config?: GetFlowDefinition200FlowDefinitionStepsItemGatesConfig;
+  };
+};
+//#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemOnSuccess.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3211,42 +3678,18 @@ declare const GetAuthAttempt200CompletedFactorsItemMethod: {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Method-specific factor metadata. Structure depends on the `method` field.
-- `identifier`: includes user_id
-- `password`: no additional data
-- `passkey`: includes credential details and verification flags
+ * Server-side mutation to execute when this step completes successfully.
+Runs after field validation passes, before the transition fires.
 
- */
-type GetAuthAttempt200CompletedFactorsItemPayload = {
-  /** @pattern ^user_[a-zA-Z0-9_-]+$ */user_id: string;
-} | {
-  [key: string]: unknown;
-} | {
-  /** The credential ID that was used */credential_id: string; /** Whether user verification was performed (PIN/biometric) */
-  user_verified: boolean; /** Whether the credential is backup eligible (can be synced) */
-  backup_eligible?: boolean; /** Whether the credential is currently backed up */
-  backup_state?: boolean; /** Authenticator attachment modality */
-  authenticator_attachment?: "platform" | "cross-platform";
-};
-//#endregion
-//#region src/generated/model/getAuthAttempt200CompletedFactorsItem.d.ts
-/**
- * A successfully verified authentication factor with verification metadata.
-Method-specific details are included in the `payload` field.
+- create_user: creates the user record (registration flows)
 
  */
-type GetAuthAttempt200CompletedFactorsItem = {
-  /** An authentication factor method. */method: GetAuthAttempt200CompletedFactorsItemMethod; /** When this factor was successfully verified */
-  verified_at: string;
-  /** Method-specific factor metadata. Structure depends on the `method` field.
-  - `identifier`: includes user_id
-  - `password`: no additional data
-  - `passkey`: includes credential details and verification flags
-   */
-  payload?: GetAuthAttempt200CompletedFactorsItemPayload;
+type GetFlowDefinition200FlowDefinitionStepsItemOnSuccess = (typeof GetFlowDefinition200FlowDefinitionStepsItemOnSuccess)[keyof typeof GetFlowDefinition200FlowDefinitionStepsItemOnSuccess];
+declare const GetFlowDefinition200FlowDefinitionStepsItemOnSuccess: {
+  readonly create_user: "create_user";
 };
 //#endregion
-//#region src/generated/model/getAuthAttempt200RequiredFactorsItem.d.ts
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3255,16 +3698,15 @@ type GetAuthAttempt200CompletedFactorsItem = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * An authentication factor method.
+ * An available SSO identity provider.
  */
-type GetAuthAttempt200RequiredFactorsItem = (typeof GetAuthAttempt200RequiredFactorsItem)[keyof typeof GetAuthAttempt200RequiredFactorsItem];
-declare const GetAuthAttempt200RequiredFactorsItem: {
-  readonly identifier: "identifier";
-  readonly password: "password";
-  readonly passkey: "passkey";
+type GetFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem = {
+  /** Provider instance identifier. */id: string; /** Display name for the provider. */
+  name: string; /** Template hint for rendering (logo, colors). */
+  template: string;
 };
 //#endregion
-//#region src/generated/model/getAuthAttempt200State.d.ts
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemTransitions.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3273,111 +3715,102 @@ declare const GetAuthAttempt200RequiredFactorsItem: {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Overall state of the authentication attempt:
-- `in_progress`: factors are still being collected; continue issuing challenges.
-- `completed`: all required factors have been verified; the attempt is ready for handoff.
-- `failed`: the attempt has failed (e.g. too many failed proofs) and cannot be continued.
-- `expired`: the 15-minute TTL has been exceeded.
+ * Maps action/outcome names to their transition descriptor.
+
+Keys match action names from the `actions` dict. Additional keys
+come from implicit outcomes based on schema annotations
+(e.g. `user_not_found` from `x-unique` fields) and engine
+events (e.g. `sso`, `callback`).
 
  */
-type GetAuthAttempt200State = (typeof GetAuthAttempt200State)[keyof typeof GetAuthAttempt200State];
-declare const GetAuthAttempt200State: {
-  readonly in_progress: "in_progress";
-  readonly completed: "completed";
-  readonly failed: "failed";
-  readonly expired: "expired";
+type GetFlowDefinition200FlowDefinitionStepsItemTransitions = {
+  [key: string]: {
+    /** Step name within this flow (when `action` is null), or the name
+    of another flow (when `action` is `switch` or `pivot`).
+    */
+    target: string;
+    /** How to interpret `target`:
+    - null (omitted): transition to a step in the current flow.
+    - switch: replace the current flow with the target flow.
+    No return — the current flow is discarded.
+    Example: login ↔ register.
+    - pivot: push the target flow onto the stack. The current flow
+    is paused and resumes when the target flow completes (auto-pop).
+    Example: login → recovery → back to login.
+    */
+    action?: "switch" | "pivot" | null;
+  };
 };
 //#endregion
-//#region src/generated/model/getAuthAttempt200.d.ts
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItem.d.ts
 /**
- * The current state of an authentication attempt.
+ * A step in a flow definition. This is the admin-authored configuration,
+not the runtime payload sent to the frontend.
 
-An attempt is an ephemeral state machine (15-minute TTL) that drives a single authentication round.
-It accepts factor challenges, verifies proofs, and completes into a handoff token.
-Clients drive the attempt by:
-1. Issuing challenges: POST /auth_attempts/{attempt_id}/challenges
-2. Verifying proofs: POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify
-3. Completing: POST /auth_attempts/{attempt_id}/handoff
+Steps are schema-driven: `fields` references properties from the flow's
+user schema, and the engine resolves field metadata (type, validation,
+implicit outcomes) from schema annotations at runtime.
+
+A step with only `complete` set is a terminal step. All other steps are
+rendered to the frontend as capability payloads.
 
  */
-type GetAuthAttempt200 = {
-  /**
-   * Unique identifier for this authentication attempt
-   * @pattern ^[a-zA-Z0-9_-]+$
+type GetFlowDefinition200FlowDefinitionStepsItem = {
+  /** Unique step identifier within this flow. Used as transition targets
+  and returned in the API response as `step.name`.
    */
-  attempt_id: string; /** @pattern ^[a-zA-Z0-9_-]+$ */
-  project_id: string;
-  /** Overall state of the authentication attempt:
-  - `in_progress`: factors are still being collected; continue issuing challenges.
-  - `completed`: all required factors have been verified; the attempt is ready for handoff.
-  - `failed`: the attempt has failed (e.g. too many failed proofs) and cannot be continued.
-  - `expired`: the 15-minute TTL has been exceeded.
+  name: string;
+  /** Schema property names to collect from the user. Each entry references
+  a property in the flow's user schema. The engine resolves field type,
+  validation rules, and implicit outcomes from schema annotations
+  (e.g. a property with `x-unique` set implies a `user_not_found`
+  transition outcome).
    */
-  state: GetAuthAttempt200State;
-  /** The session being authenticated into. Either newly created or passed in on POST.
-  For step-up (re-auth), this is the existing session_id provided on creation.
+  fields?: string[];
+  /** Actions the user can take. Keyed by action name.
+  The action name is what the frontend sends back in the submit request.
+  If omitted, the engine provides a default `submit` action.
    */
-  session_id?: string | null;
-  /** The user ID, if known at this point in the flow.
-  Null until an identifier challenge has been verified.
+  actions?: GetFlowDefinition200FlowDefinitionStepsItemActions;
+  /** Security gates that must be satisfied before submission. Keyed by gate
+  name. Each gate selects a kind (e.g. "captcha") and provider-specific
+  configuration. The engine may also inject gates dynamically based on
+  policy.
    */
-  user_id?: string | null;
-  /** The authentication factor methods that the project policy requires in order
-  to complete this attempt. Computed by the server from the project's auth policy.
-  Clients should use this to determine which challenges still need to be issued.
+  gates?: GetFlowDefinition200FlowDefinitionStepsItemGates; /** Available SSO identity providers for this step. */
+  sso_providers?: GetFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem[];
+  /** Server-side mutation to execute when this step completes successfully.
+  Runs after field validation passes, before the transition fires.
+     - create_user: creates the user record (registration flows)
    */
-  required_factors?: GetAuthAttempt200RequiredFactorsItem[];
-  /** The factors that have been successfully verified in this attempt so far.
-  Each item includes method-specific metadata in the payload field.
-     The flow engine uses verified_at timestamps to enforce time-based policies, such as
-  requiring password verification within the last 5 minutes for step-up auth to
-  access sensitive operations.
-     A factor appears here once its challenge reaches `verified` state.
+  on_success?: GetFlowDefinition200FlowDefinitionStepsItemOnSuccess;
+  /** Marks this as a terminal step. Tells the frontend what to do:
+  - redirect: navigate to redirect_uri (OIDC/SAML callback done)
+  - show: render as a success/info screen
    */
-  completed_factors?: GetAuthAttempt200CompletedFactorsItem[];
-  /** All challenges issued within this attempt, in creation order.
-  Use this to track the state of each factor challenge (pending, verified, failed, expired).
+  complete?: GetFlowDefinition200FlowDefinitionStepsItemComplete;
+  /** Maps action/outcome names to their transition descriptor.
+     Keys match action names from the `actions` dict. Additional keys
+  come from implicit outcomes based on schema annotations
+  (e.g. `user_not_found` from `x-unique` fields) and engine
+  events (e.g. `sso`, `callback`).
    */
-  challenges?: GetAuthAttempt200ChallengesItem[]; /** When this attempt expires (15-minute TTL from creation) */
-  expires_at?: string; /** When this attempt was created */
-  created_at: string;
+  transitions?: GetFlowDefinition200FlowDefinitionStepsItemTransitions;
 };
 //#endregion
-//#region src/generated/model/getAuthAttemptDefault.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type GetAuthAttemptDefault = ({
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: {
-    [key: string]: unknown;
-  };
-} & {
-  code: "att.not_found";
-}) | ({
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: {
-    [key: string]: unknown;
-  };
-} & {
-  code: "internal";
-});
-//#endregion
-//#region src/generated/model/getFlowDefinition200.d.ts
+//#region src/generated/model/getFlowDefinition200FlowDefinition.d.ts
 /**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
+ * A flow definition is the server-side configuration that describes a complete
+authentication or identity flow. It is NOT sent to the frontend — the flow
+engine evaluates it and produces FlowResponse payloads (steps with capability
+dictionaries) for the client.
+
+Flow definitions are created by administrators and stored in the project/team
+configuration hierarchy. The engine selects the matching definition based on
+the purpose + audience when a flow is created via POST /flow.
+
  */
-type GetFlowDefinition200 = {
+type GetFlowDefinition200FlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
   `switch` and `pivot` transitions. Renaming is not supported — the
@@ -3402,124 +3835,34 @@ type GetFlowDefinition200 = {
   matches every request in the project. The engine picks the most specific
   matching definition: app > team > project-wide.
    */
-  audience?: {
-    /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
-    app_ids?: string[];
-  };
+  audience?: GetFlowDefinition200FlowDefinitionAudience;
   /**
      * Ordered list of steps in this flow. The order is for human readability —
   actual step sequencing is determined by transitions.
         * @minItems 1
      */
-  steps: {
-    /** Unique step identifier within this flow. Used as transition targets
-    and returned in the API response as `step.name`.
-    */
-    name: string;
-    /** Schema property names to collect from the user. Each entry references
-    a property in the flow's user schema. The engine resolves field type,
-    validation rules, and implicit outcomes from schema annotations
-    (e.g. a property with `x-unique` set implies a `user_not_found`
-    transition outcome).
-    */
-    fields?: string[];
-    /** Actions the user can take. Keyed by action name.
-    The action name is what the frontend sends back in the submit request.
-    If omitted, the engine provides a default `submit` action.
-    */
-    actions?: {
-      [key: string]: {
-        /** Marks this as the default/primary action. The runtime template uses
-        this hint to choose visual emphasis. At most one action per step
-        should be primary; this is not enforced here.
-        */
-        primary?: boolean;
-        /** Optional localization key override for the action's label. When
-        omitted, the engine derives a key from the step and action names.
-        Display text is resolved client-side from a locale dictionary, never
-        by the engine.
-        */
-        text_key?: string;
-      };
-    };
-    /** Security gates that must be satisfied before submission. Keyed by gate
-    name. Each gate selects a kind (e.g. "captcha") and provider-specific
-    configuration. The engine may also inject gates dynamically based on
-    policy.
-    */
-    gates?: {
-      [key: string]: {
-        /** The gate category. Only `captcha` is currently defined. Authenticator
-        ceremonies (e.g. passkey) are modelled as credential auth_attempts via
-        `x-credential` on a field, not as gates.
-        */
-        kind: "captcha";
-        /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
-        `hcaptcha`. The engine looks up an implementation in its provider
-        registry.
-        */
-        provider: string;
-        /** Provider-specific configuration consumed by the implementation when
-        issuing the per-render challenge. Opaque to the engine.
-        */
-        config?: {
-          [key: string]: unknown;
-        };
-      };
-    }; /** Available SSO identity providers for this step. */
-    sso_providers?: {
-      /** Provider instance identifier. */id: string; /** Display name for the provider. */
-      name: string; /** Template hint for rendering (logo, colors). */
-      template: string;
-    }[];
-    /** Server-side mutation to execute when this step completes successfully.
-    Runs after field validation passes, before the transition fires.
-       - create_user: creates the user record (registration flows)
-    */
-    on_success?: "create_user";
-    /** Marks this as a terminal step. Tells the frontend what to do:
-    - redirect: navigate to redirect_uri (OIDC/SAML callback done)
-    - show: render as a success/info screen
-    */
-    complete?: "redirect" | "show";
-    /** Maps action/outcome names to their transition descriptor.
-       Keys match action names from the `actions` dict. Additional keys
-    come from implicit outcomes based on schema annotations
-    (e.g. `user_not_found` from `x-unique` fields) and engine
-    events (e.g. `sso`, `callback`).
-    */
-    transitions?: {
-      [key: string]: {
-        /** Step name within this flow (when `action` is null), or the name
-        of another flow (when `action` is `switch` or `pivot`).
-        */
-        target: string;
-        /** How to interpret `target`:
-        - null (omitted): transition to a step in the current flow.
-        - switch: replace the current flow with the target flow.
-        No return — the current flow is discarded.
-        Example: login ↔ register.
-        - pivot: push the target flow onto the stack. The current flow
-        is paused and resumes when the target flow completes (auto-pop).
-        Example: login → recovery → back to login.
-        */
-        action?: "switch" | "pivot" | null;
-      };
-    };
-  }[];
-} & {
+  steps: GetFlowDefinition200FlowDefinitionStepsItem[];
+};
+//#endregion
+//#region src/generated/model/getFlowDefinition200.d.ts
+type GetFlowDefinition200 = {
   /** Unique identifier for the flow definition. */id: string; /** Identifier of the project this flow definition belongs to. */
-  project_id: string;
-  /** URI of the flow definition schema this definition was authored against.
-  If the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.
+  project_id: string; /** Status of the flow definition. */
+  status: string;
+  /** A flow definition is the server-side configuration that describes a complete
+  authentication or identity flow. It is NOT sent to the frontend — the flow
+  engine evaluates it and produces FlowResponse payloads (steps with capability
+  dictionaries) for the client.
+     Flow definitions are created by administrators and stored in the project/team
+  configuration hierarchy. The engine selects the matching definition based on
+  the purpose + audience when a flow is created via POST /flow.
    */
-  schema_uri: string; /** Status of the flow definition. */
-  status: string;
+  flow_definition: GetFlowDefinition200FlowDefinition;
   created_at: string;
   updated_at: string;
 };
 //#endregion
-//#region src/generated/model/getFlowDefinition404Details.d.ts
+//#region src/generated/model/getFlowDefinitionDefaultDetails.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3530,21 +3873,21 @@ type GetFlowDefinition200 = {
 /**
  * Additional error-specific context.
  */
-type GetFlowDefinition404Details = {
+type GetFlowDefinitionDefaultDetails = {
   [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/getFlowDefinition404.d.ts
+//#region src/generated/model/getFlowDefinitionDefault.d.ts
 /**
  * Standard error payload returned for failed API requests.
  */
-type GetFlowDefinition404 = {
+type GetFlowDefinitionDefault = {
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: GetFlowDefinition404Details;
+  details?: GetFlowDefinitionDefaultDetails;
 };
 //#endregion
-//#region src/generated/model/getFlowDefinitionDefaultDetails.d.ts
+//#region src/generated/model/getFlowDefinitionParams.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3552,21 +3895,12 @@ type GetFlowDefinition404 = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
-type GetFlowDefinitionDefaultDetails = {
-  [key: string]: unknown;
-};
-//#endregion
-//#region src/generated/model/getFlowDefinitionDefault.d.ts
-/**
- * Standard error payload returned for failed API requests.
- */
-type GetFlowDefinitionDefault = {
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: GetFlowDefinitionDefaultDetails;
+type GetFlowDefinitionParams = {
+  /**
+   * The project id to filter by.
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
 };
 //#endregion
 //#region src/generated/model/getFlowStep200BrandingLayout.d.ts
@@ -4515,6 +4849,92 @@ type GetMySessionDefault = {
   details?: GetMySessionDefaultDetails;
 };
 //#endregion
+//#region src/generated/model/getMyUser200.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type GetMyUser200 = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/getMyUser401Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type GetMyUser401Details = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/getMyUser401.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type GetMyUser401 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: GetMyUser401Details;
+};
+//#endregion
+//#region src/generated/model/getMyUser404.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * User not found
+
+Error code: user.not_found
+
+ */
+type GetMyUser404 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: {
+    [key: string]: unknown;
+  };
+} & {
+  code: "user.not_found";
+};
+//#endregion
+//#region src/generated/model/getMyUserDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type GetMyUserDefaultDetails = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/getMyUserDefault.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type GetMyUserDefault = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: GetMyUserDefaultDetails;
+};
+//#endregion
 //#region src/generated/model/getOpenIDConfiguration4xxDetails.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -5955,7 +6375,7 @@ type ListFlowDefinitions200FlowDefinitionsItem = {
   /** URI of the flow definition schema this definition was authored against.
   If the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.
    */
-  schema_uri: string; /** Status of the flow definition. */
+  schema_uri?: string; /** Status of the flow definition. */
   status: string; /** Timestamp when the flow definition was created. */
   created_at: string; /** Timestamp when the flow definition was last updated. */
   updated_at: string;
@@ -6051,7 +6471,7 @@ type ListFlowDefinitionsParams = {
     */
   page_token?: string;
   /**
-   * The unique identifier of the project
+   * The project id to filter by.
    * @pattern ^[a-zA-Z0-9_-]+$
    */
   project_id: string;
@@ -6596,7 +7016,161 @@ type RevokeMySessionDefault = {
   details?: RevokeMySessionDefaultDetails;
 };
 //#endregion
-//#region src/generated/model/revokeSession401Details.d.ts
+//#region src/generated/model/revokeSession401Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type RevokeSession401Details = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/revokeSession401.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type RevokeSession401 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: RevokeSession401Details;
+};
+//#endregion
+//#region src/generated/model/revokeSession404Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type RevokeSession404Details = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/revokeSession404.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type RevokeSession404 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: RevokeSession404Details;
+};
+//#endregion
+//#region src/generated/model/revokeSession409Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type RevokeSession409Details = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/revokeSession409.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type RevokeSession409 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: RevokeSession409Details;
+};
+//#endregion
+//#region src/generated/model/revokeSessionDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type RevokeSessionDefaultDetails = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/revokeSessionDefault.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type RevokeSessionDefault = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: RevokeSessionDefaultDetails;
+};
+//#endregion
+//#region src/generated/model/revokeSessionParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type RevokeSessionParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+};
+//#endregion
+//#region src/generated/model/revokeToken4xxDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type RevokeToken4xxDetails = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/revokeToken4xx.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type RevokeToken4xx = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: RevokeToken4xxDetails;
+};
+//#endregion
+//#region src/generated/model/revokeTokenBody.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type RevokeTokenBody = {
+  /** The token to revoke (access token or refresh token) */token?: string; /** Optional hint about the type of the token being revoked (access_token or refresh_token) */
+  token_type_hint?: string;
+};
+//#endregion
+//#region src/generated/model/revokeTokenDefaultDetails.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6607,21 +7181,21 @@ type RevokeMySessionDefault = {
 /**
  * Additional error-specific context.
  */
-type RevokeSession401Details = {
+type RevokeTokenDefaultDetails = {
   [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/revokeSession401.d.ts
+//#region src/generated/model/revokeTokenDefault.d.ts
 /**
  * Standard error payload returned for failed API requests.
  */
-type RevokeSession401 = {
+type RevokeTokenDefault = {
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: RevokeSession401Details;
+  details?: RevokeTokenDefaultDetails;
 };
 //#endregion
-//#region src/generated/model/revokeSession404Details.d.ts
+//#region src/generated/model/setUserPassword400Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6632,21 +7206,21 @@ type RevokeSession401 = {
 /**
  * Additional error-specific context.
  */
-type RevokeSession404Details = {
+type SetUserPassword400Details = {
   [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/revokeSession404.d.ts
+//#region src/generated/model/setUserPassword400.d.ts
 /**
  * Standard error payload returned for failed API requests.
  */
-type RevokeSession404 = {
+type SetUserPassword400 = {
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: RevokeSession404Details;
+  details?: SetUserPassword400Details;
 };
 //#endregion
-//#region src/generated/model/revokeSession409Details.d.ts
+//#region src/generated/model/setUserPassword404Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6657,21 +7231,21 @@ type RevokeSession404 = {
 /**
  * Additional error-specific context.
  */
-type RevokeSession409Details = {
+type SetUserPassword404Details = {
   [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/revokeSession409.d.ts
+//#region src/generated/model/setUserPassword404.d.ts
 /**
  * Standard error payload returned for failed API requests.
  */
-type RevokeSession409 = {
+type SetUserPassword404 = {
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: RevokeSession409Details;
+  details?: SetUserPassword404Details;
 };
 //#endregion
-//#region src/generated/model/revokeSessionDefaultDetails.d.ts
+//#region src/generated/model/setUserPassword500Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6682,21 +7256,21 @@ type RevokeSession409 = {
 /**
  * Additional error-specific context.
  */
-type RevokeSessionDefaultDetails = {
+type SetUserPassword500Details = {
   [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/revokeSessionDefault.d.ts
+//#region src/generated/model/setUserPassword500.d.ts
 /**
  * Standard error payload returned for failed API requests.
  */
-type RevokeSessionDefault = {
+type SetUserPassword500 = {
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: RevokeSessionDefaultDetails;
+  details?: SetUserPassword500Details;
 };
 //#endregion
-//#region src/generated/model/revokeSessionParams.d.ts
+//#region src/generated/model/setUserPasswordBody.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6704,15 +7278,18 @@ type RevokeSessionDefault = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type RevokeSessionParams = {
-  /**
-   * The unique identifier of the project
-   * @pattern ^[a-zA-Z0-9_-]+$
+/**
+ * Request to update the user's password.
+ */
+type SetUserPasswordBody = {
+  /** The new password for the user. */password: string;
+  /** Whether the user is required to change their password on the next login.
+  If not provided, it will default to false.
    */
-  project_id: string;
+  isChangeRequired?: boolean;
 };
 //#endregion
-//#region src/generated/model/revokeToken4xxDetails.d.ts
+//#region src/generated/model/setUserPasswordDefaultDetails.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6723,34 +7300,21 @@ type RevokeSessionParams = {
 /**
  * Additional error-specific context.
  */
-type RevokeToken4xxDetails = {
+type SetUserPasswordDefaultDetails = {
   [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/revokeToken4xx.d.ts
+//#region src/generated/model/setUserPasswordDefault.d.ts
 /**
  * Standard error payload returned for failed API requests.
  */
-type RevokeToken4xx = {
+type SetUserPasswordDefault = {
   /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
   message: string; /** Additional error-specific context. */
-  details?: RevokeToken4xxDetails;
-};
-//#endregion
-//#region src/generated/model/revokeTokenBody.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type RevokeTokenBody = {
-  /** The token to revoke (access token or refresh token) */token?: string; /** Optional hint about the type of the token being revoked (access_token or refresh_token) */
-  token_type_hint?: string;
+  details?: SetUserPasswordDefaultDetails;
 };
 //#endregion
-//#region src/generated/model/revokeTokenDefaultDetails.d.ts
+//#region src/generated/model/setUserPasswordParams.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6758,21 +7322,12 @@ type RevokeTokenBody = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-/**
- * Additional error-specific context.
- */
-type RevokeTokenDefaultDetails = {
-  [key: string]: unknown;
-};
-//#endregion
-//#region src/generated/model/revokeTokenDefault.d.ts
-/**
- * Standard error payload returned for failed API requests.
- */
-type RevokeTokenDefault = {
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: RevokeTokenDefaultDetails;
+type SetUserPasswordParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
 };
 //#endregion
 //#region src/generated/model/submitFlowEvent400Details.d.ts
@@ -7772,7 +8327,202 @@ type SubmitFlowStep400 = {
   handoff_token_expires_at?: string;
 };
 //#endregion
-//#region src/generated/model/submitFlowStep409Details.d.ts
+//#region src/generated/model/submitFlowStep409Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type SubmitFlowStep409Details = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/submitFlowStep409.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type SubmitFlowStep409 = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: SubmitFlowStep409Details;
+};
+//#endregion
+//#region src/generated/model/submitFlowStepBodyChallengeResponseProof.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Method-specific proof payload.
+For passkeys, this is the WebAuthn JSON serialization of PublicKeyCredential.
+
+ */
+type SubmitFlowStepBodyChallengeResponseProof = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/submitFlowStepBodyChallengeResponse.d.ts
+/**
+ * Response to a pending challenge on the step. Required when the step has a
+`challenge` property (e.g., after submitting a passkey action).
+The `<zl-passkey>` component populates this after the WebAuthn ceremony.
+
+ */
+type SubmitFlowStepBodyChallengeResponse = {
+  /** The challenge identifier from `step.challenge.challenge_id`.
+  Matches the server-side challenge for verification.
+   */
+  challenge_id?: string; /** Which auth method this response is for (e.g., 'passkey'). */
+  method?: string;
+  /** Method-specific proof payload.
+  For passkeys, this is the WebAuthn JSON serialization of PublicKeyCredential.
+   */
+  proof?: SubmitFlowStepBodyChallengeResponseProof;
+};
+//#endregion
+//#region src/generated/model/submitFlowStepBodyFields.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * User input values. Keys match field names from the step's `fields` dictionary.
+
+ */
+type SubmitFlowStepBodyFields = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/submitFlowStepBodyGateProofs.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Solutions for security gates. Keys match gate names from the step's `gates` dictionary.
+The orchestrator collects these from `<zl-captcha>` component events.
+
+ */
+type SubmitFlowStepBodyGateProofs = {
+  [key: string]: string;
+};
+//#endregion
+//#region src/generated/model/submitFlowStepBody.d.ts
+type SubmitFlowStepBody = {
+  /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */session_token?: string;
+  /** Which action to take. Must be a key from the step's `actions` dictionary:
+  - A regular action (e.g., "submit", "register", "back")
+  - The reserved value "sso" — triggers SSO redirect (requires `sso_provider_id`)
+   */
+  action: string;
+  /** User input values. Keys match field names from the step's `fields` dictionary.
+   */
+  fields?: SubmitFlowStepBodyFields;
+  /** Solutions for security gates. Keys match gate names from the step's `gates` dictionary.
+  The orchestrator collects these from `<zl-captcha>` component events.
+   */
+  gate_proofs?: SubmitFlowStepBodyGateProofs;
+  /** Response to a pending challenge on the step. Required when the step has a
+  `challenge` property (e.g., after submitting a passkey action).
+  The `<zl-passkey>` component populates this after the WebAuthn ceremony.
+   */
+  challenge_response?: SubmitFlowStepBodyChallengeResponse;
+  /** ID of the selected SSO provider (from `sso_providers[].id`).
+  Required when `action` is "sso".
+   */
+  sso_provider_id?: string;
+};
+//#endregion
+//#region src/generated/model/submitFlowStepDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+type SubmitFlowStepDefaultDetails = {
+  [key: string]: unknown;
+};
+//#endregion
+//#region src/generated/model/submitFlowStepDefault.d.ts
+/**
+ * Standard error payload returned for failed API requests.
+ */
+type SubmitFlowStepDefault = {
+  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
+  message: string; /** Additional error-specific context. */
+  details?: SubmitFlowStepDefaultDetails;
+};
+//#endregion
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionAudience.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Scopes which teams or apps this flow definition applies to. Empty or
+omitted fields mean "no restriction"; when both are empty the definition
+matches every request in the project. The engine picks the most specific
+matching definition: app > team > project-wide.
+
+ */
+type UpdateFlowDefinition200FlowDefinitionAudience = {
+  /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
+  app_ids?: string[];
+};
+//#endregion
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemActions.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Actions the user can take. Keyed by action name.
+The action name is what the frontend sends back in the submit request.
+If omitted, the engine provides a default `submit` action.
+
+ */
+type UpdateFlowDefinition200FlowDefinitionStepsItemActions = {
+  [key: string]: {
+    /** Marks this as the default/primary action. The runtime template uses
+    this hint to choose visual emphasis. At most one action per step
+    should be primary; this is not enforced here.
+    */
+    primary?: boolean;
+    /** Optional localization key override for the action's label. When
+    omitted, the engine derives a key from the step and action names.
+    Display text is resolved client-side from a locale dictionary, never
+    by the engine.
+    */
+    text_key?: string;
+  };
+};
+//#endregion
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemComplete.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7781,23 +8531,35 @@ type SubmitFlowStep400 = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
+ * Marks this as a terminal step. Tells the frontend what to do:
+- redirect: navigate to redirect_uri (OIDC/SAML callback done)
+- show: render as a success/info screen
+
  */
-type SubmitFlowStep409Details = {
-  [key: string]: unknown;
+type UpdateFlowDefinition200FlowDefinitionStepsItemComplete = (typeof UpdateFlowDefinition200FlowDefinitionStepsItemComplete)[keyof typeof UpdateFlowDefinition200FlowDefinitionStepsItemComplete];
+declare const UpdateFlowDefinition200FlowDefinitionStepsItemComplete: {
+  readonly redirect: "redirect";
+  readonly show: "show";
 };
 //#endregion
-//#region src/generated/model/submitFlowStep409.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemGatesConfig.d.ts
 /**
- * Standard error payload returned for failed API requests.
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
  */
-type SubmitFlowStep409 = {
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: SubmitFlowStep409Details;
+/**
+ * Provider-specific configuration consumed by the implementation when
+issuing the per-render challenge. Opaque to the engine.
+
+ */
+type UpdateFlowDefinition200FlowDefinitionStepsItemGatesConfig = {
+  [key: string]: unknown;
 };
 //#endregion
-//#region src/generated/model/submitFlowStepBodyChallengeResponseProof.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemGatesKind.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7806,34 +8568,44 @@ type SubmitFlowStep409 = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Method-specific proof payload.
-For passkeys, this is the WebAuthn JSON serialization of PublicKeyCredential.
+ * The gate category. Only `captcha` is currently defined. Authenticator
+ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+`x-credential` on a field, not as gates.
 
  */
-type SubmitFlowStepBodyChallengeResponseProof = {
-  [key: string]: unknown;
+type UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind = (typeof UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind)[keyof typeof UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind];
+declare const UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind: {
+  readonly captcha: "captcha";
 };
 //#endregion
-//#region src/generated/model/submitFlowStepBodyChallengeResponse.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemGates.d.ts
 /**
- * Response to a pending challenge on the step. Required when the step has a
-`challenge` property (e.g., after submitting a passkey action).
-The `<zl-passkey>` component populates this after the WebAuthn ceremony.
+ * Security gates that must be satisfied before submission. Keyed by gate
+name. Each gate selects a kind (e.g. "captcha") and provider-specific
+configuration. The engine may also inject gates dynamically based on
+policy.
 
  */
-type SubmitFlowStepBodyChallengeResponse = {
-  /** The challenge identifier from `step.challenge.challenge_id`.
-  Matches the server-side challenge for verification.
-   */
-  challenge_id?: string; /** Which auth method this response is for (e.g., 'passkey'). */
-  method?: string;
-  /** Method-specific proof payload.
-  For passkeys, this is the WebAuthn JSON serialization of PublicKeyCredential.
-   */
-  proof?: SubmitFlowStepBodyChallengeResponseProof;
+type UpdateFlowDefinition200FlowDefinitionStepsItemGates = {
+  [key: string]: {
+    /** The gate category. Only `captcha` is currently defined. Authenticator
+    ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+    `x-credential` on a field, not as gates.
+    */
+    kind: UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind;
+    /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
+    `hcaptcha`. The engine looks up an implementation in its provider
+    registry.
+    */
+    provider: string;
+    /** Provider-specific configuration consumed by the implementation when
+    issuing the per-render challenge. Opaque to the engine.
+    */
+    config?: UpdateFlowDefinition200FlowDefinitionStepsItemGatesConfig;
+  };
 };
 //#endregion
-//#region src/generated/model/submitFlowStepBodyFields.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemOnSuccess.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7842,14 +8614,18 @@ type SubmitFlowStepBodyChallengeResponse = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * User input values. Keys match field names from the step's `fields` dictionary.
+ * Server-side mutation to execute when this step completes successfully.
+Runs after field validation passes, before the transition fires.
+
+- create_user: creates the user record (registration flows)
 
  */
-type SubmitFlowStepBodyFields = {
-  [key: string]: unknown;
+type UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess = (typeof UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess)[keyof typeof UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess];
+declare const UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess: {
+  readonly create_user: "create_user";
 };
 //#endregion
-//#region src/generated/model/submitFlowStepBodyGateProofs.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7858,41 +8634,15 @@ type SubmitFlowStepBodyFields = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Solutions for security gates. Keys match gate names from the step's `gates` dictionary.
-The orchestrator collects these from `<zl-captcha>` component events.
-
+ * An available SSO identity provider.
  */
-type SubmitFlowStepBodyGateProofs = {
-  [key: string]: string;
-};
-//#endregion
-//#region src/generated/model/submitFlowStepBody.d.ts
-type SubmitFlowStepBody = {
-  /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */session_token?: string;
-  /** Which action to take. Must be a key from the step's `actions` dictionary:
-  - A regular action (e.g., "submit", "register", "back")
-  - The reserved value "sso" — triggers SSO redirect (requires `sso_provider_id`)
-   */
-  action: string;
-  /** User input values. Keys match field names from the step's `fields` dictionary.
-   */
-  fields?: SubmitFlowStepBodyFields;
-  /** Solutions for security gates. Keys match gate names from the step's `gates` dictionary.
-  The orchestrator collects these from `<zl-captcha>` component events.
-   */
-  gate_proofs?: SubmitFlowStepBodyGateProofs;
-  /** Response to a pending challenge on the step. Required when the step has a
-  `challenge` property (e.g., after submitting a passkey action).
-  The `<zl-passkey>` component populates this after the WebAuthn ceremony.
-   */
-  challenge_response?: SubmitFlowStepBodyChallengeResponse;
-  /** ID of the selected SSO provider (from `sso_providers[].id`).
-  Required when `action` is "sso".
-   */
-  sso_provider_id?: string;
+type UpdateFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem = {
+  /** Provider instance identifier. */id: string; /** Display name for the provider. */
+  name: string; /** Template hint for rendering (logo, colors). */
+  template: string;
 };
 //#endregion
-//#region src/generated/model/submitFlowStepDefaultDetails.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemTransitions.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -7901,31 +8651,102 @@ type SubmitFlowStepBody = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
+ * Maps action/outcome names to their transition descriptor.
+
+Keys match action names from the `actions` dict. Additional keys
+come from implicit outcomes based on schema annotations
+(e.g. `user_not_found` from `x-unique` fields) and engine
+events (e.g. `sso`, `callback`).
+
  */
-type SubmitFlowStepDefaultDetails = {
-  [key: string]: unknown;
+type UpdateFlowDefinition200FlowDefinitionStepsItemTransitions = {
+  [key: string]: {
+    /** Step name within this flow (when `action` is null), or the name
+    of another flow (when `action` is `switch` or `pivot`).
+    */
+    target: string;
+    /** How to interpret `target`:
+    - null (omitted): transition to a step in the current flow.
+    - switch: replace the current flow with the target flow.
+    No return — the current flow is discarded.
+    Example: login ↔ register.
+    - pivot: push the target flow onto the stack. The current flow
+    is paused and resumes when the target flow completes (auto-pop).
+    Example: login → recovery → back to login.
+    */
+    action?: "switch" | "pivot" | null;
+  };
 };
 //#endregion
-//#region src/generated/model/submitFlowStepDefault.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItem.d.ts
 /**
- * Standard error payload returned for failed API requests.
+ * A step in a flow definition. This is the admin-authored configuration,
+not the runtime payload sent to the frontend.
+
+Steps are schema-driven: `fields` references properties from the flow's
+user schema, and the engine resolves field metadata (type, validation,
+implicit outcomes) from schema annotations at runtime.
+
+A step with only `complete` set is a terminal step. All other steps are
+rendered to the frontend as capability payloads.
+
  */
-type SubmitFlowStepDefault = {
-  /** Stable machine-readable error code. */code: string; /** Human-readable explanation of the error. */
-  message: string; /** Additional error-specific context. */
-  details?: SubmitFlowStepDefaultDetails;
+type UpdateFlowDefinition200FlowDefinitionStepsItem = {
+  /** Unique step identifier within this flow. Used as transition targets
+  and returned in the API response as `step.name`.
+   */
+  name: string;
+  /** Schema property names to collect from the user. Each entry references
+  a property in the flow's user schema. The engine resolves field type,
+  validation rules, and implicit outcomes from schema annotations
+  (e.g. a property with `x-unique` set implies a `user_not_found`
+  transition outcome).
+   */
+  fields?: string[];
+  /** Actions the user can take. Keyed by action name.
+  The action name is what the frontend sends back in the submit request.
+  If omitted, the engine provides a default `submit` action.
+   */
+  actions?: UpdateFlowDefinition200FlowDefinitionStepsItemActions;
+  /** Security gates that must be satisfied before submission. Keyed by gate
+  name. Each gate selects a kind (e.g. "captcha") and provider-specific
+  configuration. The engine may also inject gates dynamically based on
+  policy.
+   */
+  gates?: UpdateFlowDefinition200FlowDefinitionStepsItemGates; /** Available SSO identity providers for this step. */
+  sso_providers?: UpdateFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem[];
+  /** Server-side mutation to execute when this step completes successfully.
+  Runs after field validation passes, before the transition fires.
+     - create_user: creates the user record (registration flows)
+   */
+  on_success?: UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess;
+  /** Marks this as a terminal step. Tells the frontend what to do:
+  - redirect: navigate to redirect_uri (OIDC/SAML callback done)
+  - show: render as a success/info screen
+   */
+  complete?: UpdateFlowDefinition200FlowDefinitionStepsItemComplete;
+  /** Maps action/outcome names to their transition descriptor.
+     Keys match action names from the `actions` dict. Additional keys
+  come from implicit outcomes based on schema annotations
+  (e.g. `user_not_found` from `x-unique` fields) and engine
+  events (e.g. `sso`, `callback`).
+   */
+  transitions?: UpdateFlowDefinition200FlowDefinitionStepsItemTransitions;
 };
 //#endregion
-//#region src/generated/model/updateFlowDefinition200.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinition.d.ts
 /**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
+ * A flow definition is the server-side configuration that describes a complete
+authentication or identity flow. It is NOT sent to the frontend — the flow
+engine evaluates it and produces FlowResponse payloads (steps with capability
+dictionaries) for the client.
+
+Flow definitions are created by administrators and stored in the project/team
+configuration hierarchy. The engine selects the matching definition based on
+the purpose + audience when a flow is created via POST /flow.
+
  */
-type UpdateFlowDefinition200 = {
+type UpdateFlowDefinition200FlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
   `switch` and `pivot` transitions. Renaming is not supported — the
@@ -7950,119 +8771,29 @@ type UpdateFlowDefinition200 = {
   matches every request in the project. The engine picks the most specific
   matching definition: app > team > project-wide.
    */
-  audience?: {
-    /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
-    app_ids?: string[];
-  };
+  audience?: UpdateFlowDefinition200FlowDefinitionAudience;
   /**
      * Ordered list of steps in this flow. The order is for human readability —
   actual step sequencing is determined by transitions.
         * @minItems 1
      */
-  steps: {
-    /** Unique step identifier within this flow. Used as transition targets
-    and returned in the API response as `step.name`.
-    */
-    name: string;
-    /** Schema property names to collect from the user. Each entry references
-    a property in the flow's user schema. The engine resolves field type,
-    validation rules, and implicit outcomes from schema annotations
-    (e.g. a property with `x-unique` set implies a `user_not_found`
-    transition outcome).
-    */
-    fields?: string[];
-    /** Actions the user can take. Keyed by action name.
-    The action name is what the frontend sends back in the submit request.
-    If omitted, the engine provides a default `submit` action.
-    */
-    actions?: {
-      [key: string]: {
-        /** Marks this as the default/primary action. The runtime template uses
-        this hint to choose visual emphasis. At most one action per step
-        should be primary; this is not enforced here.
-        */
-        primary?: boolean;
-        /** Optional localization key override for the action's label. When
-        omitted, the engine derives a key from the step and action names.
-        Display text is resolved client-side from a locale dictionary, never
-        by the engine.
-        */
-        text_key?: string;
-      };
-    };
-    /** Security gates that must be satisfied before submission. Keyed by gate
-    name. Each gate selects a kind (e.g. "captcha") and provider-specific
-    configuration. The engine may also inject gates dynamically based on
-    policy.
-    */
-    gates?: {
-      [key: string]: {
-        /** The gate category. Only `captcha` is currently defined. Authenticator
-        ceremonies (e.g. passkey) are modelled as credential auth_attempts via
-        `x-credential` on a field, not as gates.
-        */
-        kind: "captcha";
-        /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
-        `hcaptcha`. The engine looks up an implementation in its provider
-        registry.
-        */
-        provider: string;
-        /** Provider-specific configuration consumed by the implementation when
-        issuing the per-render challenge. Opaque to the engine.
-        */
-        config?: {
-          [key: string]: unknown;
-        };
-      };
-    }; /** Available SSO identity providers for this step. */
-    sso_providers?: {
-      /** Provider instance identifier. */id: string; /** Display name for the provider. */
-      name: string; /** Template hint for rendering (logo, colors). */
-      template: string;
-    }[];
-    /** Server-side mutation to execute when this step completes successfully.
-    Runs after field validation passes, before the transition fires.
-       - create_user: creates the user record (registration flows)
-    */
-    on_success?: "create_user";
-    /** Marks this as a terminal step. Tells the frontend what to do:
-    - redirect: navigate to redirect_uri (OIDC/SAML callback done)
-    - show: render as a success/info screen
-    */
-    complete?: "redirect" | "show";
-    /** Maps action/outcome names to their transition descriptor.
-       Keys match action names from the `actions` dict. Additional keys
-    come from implicit outcomes based on schema annotations
-    (e.g. `user_not_found` from `x-unique` fields) and engine
-    events (e.g. `sso`, `callback`).
-    */
-    transitions?: {
-      [key: string]: {
-        /** Step name within this flow (when `action` is null), or the name
-        of another flow (when `action` is `switch` or `pivot`).
-        */
-        target: string;
-        /** How to interpret `target`:
-        - null (omitted): transition to a step in the current flow.
-        - switch: replace the current flow with the target flow.
-        No return — the current flow is discarded.
-        Example: login ↔ register.
-        - pivot: push the target flow onto the stack. The current flow
-        is paused and resumes when the target flow completes (auto-pop).
-        Example: login → recovery → back to login.
-        */
-        action?: "switch" | "pivot" | null;
-      };
-    };
-  }[];
-} & {
+  steps: UpdateFlowDefinition200FlowDefinitionStepsItem[];
+};
+//#endregion
+//#region src/generated/model/updateFlowDefinition200.d.ts
+type UpdateFlowDefinition200 = {
   /** Unique identifier for the flow definition. */id: string; /** Identifier of the project this flow definition belongs to. */
-  project_id: string;
-  /** URI of the flow definition schema this definition was authored against.
-  If the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.
-   */
-  schema_uri: string; /** Status of the flow definition. */
+  project_id: string; /** Status of the flow definition. */
   status: string;
+  /** A flow definition is the server-side configuration that describes a complete
+  authentication or identity flow. It is NOT sent to the frontend — the flow
+  engine evaluates it and produces FlowResponse payloads (steps with capability
+  dictionaries) for the client.
+     Flow definitions are created by administrators and stored in the project/team
+  configuration hierarchy. The engine selects the matching definition based on
+  the purpose + audience when a flow is created via POST /flow.
+   */
+  flow_definition: UpdateFlowDefinition200FlowDefinition;
   created_at: string;
   updated_at: string;
 };
@@ -8438,6 +9169,22 @@ type UpdateFlowDefinitionDefault = {
   details?: UpdateFlowDefinitionDefaultDetails;
 };
 //#endregion
+//#region src/generated/model/updateFlowDefinitionParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type UpdateFlowDefinitionParams = {
+  /**
+   * The project id to filter by.
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+};
+//#endregion
 //#region src/generated/model/verifyChallengeProof200ChallengesItemMethod.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -8793,5 +9540,5 @@ type VerifyChallengeProofDefault = ({
   code: "internal";
 });
 //#endregion
-export { SubmitFlowStep400StepChallengeOptions as $, CreateUserBody as $a, GetFlowStep200StepFieldsType as $i, GetUserByIDParams as $n, CreateFlowDefinitionBodyFlowDefinitionStepsItem as $o, GetProject401Details as $r, AuthorizeGetDefaultDetails as $s, ListUsersParams as $t, UpdateFlowDefinition200 as A, ExchangeHandoff401Details as Aa, GetKeys200KeysItem as Ai, ListFlowDefinitions400Details as An, CreateSession201SessionFactorsItemPayload as Ao, GetSession200UserAgent as Ar, CreateFlow201StepFieldsValidationFormat as As, SubmitFlowEvent400Details as At, SubmitFlowStep400 as B, ExchangeHandoff200SessionFactorsItemMethod as Ba, GetFlowStep410Details as Bi, IssueChallenge201Payload as Bn, CreateSchema201 as Bo, GetSchemaById404Details as Br, CreateAuthAttemptBody as Bs, RevokeSession409Details as Bt, UpdateFlowDefinitionBodyStepsItemComplete as C, ExchangeHandoffParams as Ca, GetLiveDefault as Ci, ListSessions200SessionsItemFactorsItemPayload as Cn, CreateSession400Details as Co, GetSessionDefault as Cr, CreateFlow201StepTexts as Cs, SubmitFlowEventDefaultDetails as Ct, UpdateFlowDefinition404Details as D, ExchangeHandoff410 as Da, GetKeysDefault as Di, ListFlowDefinitionsDefault as Dn, CreateSession201SessionState as Do, GetSession401 as Dr, CreateFlow201StepGatesConfig as Ds, SubmitFlowEvent404 as Dt, UpdateFlowDefinition404 as E, ExchangeHandoffBody as Ea, GetLive4xxDetails as Ei, ListFlowDefinitionsPurpose as En, CreateSession201SessionUserAgent as Eo, GetSession404Details as Er, CreateFlow201StepGatesKind as Es, SubmitFlowEventBodyPayload as Et, SubmitFlowStepBodyFields as F, ExchangeHandoff200SessionUserAgent as Fa, GetHealth4xx as Fi, IssueChallengeBodyPasskeyOptions as Fn, CreateSchemaBody as Fo, GetSession200FactorsItemMethod as Fr, CreateFlow201StepChallengeMethod as Fs, RevokeToken4xxDetails as Ft, SubmitFlowStep400StepGatesKind as G, EndSession400Details as Ga, GetFlowStep200StepTexts as Gi, Introspect400 as Gn, CreateProject429Details as Go, GetReadyDefaultDetails as Gr, CreateAuthAttempt201CompletedFactorsItemPayload as Gs, RevokeMySessionDefault as Gt, SubmitFlowStep400StepTexts as H, EndSessionDefault as Ha, GetFlowStep404Details as Hi, IntrospectDefault as Hn, CreateProjectDefaultDetails as Ho, GetSchemaById400Details as Hr, CreateAuthAttempt201State as Hs, RevokeSession404Details as Ht, SubmitFlowStepBodyChallengeResponse as I, ExchangeHandoff200SessionState as Ia, GetHealth4xxDetails as Ii, IssueChallengeBodyPasskeyOptionsUserVerification as In, CreateSchema409 as Io, GetSchemaByIdParams as Ir, CreateFlow201StepActions as Is, RevokeSessionParams as It, SubmitFlowStep400StepFieldsValidation as J, DeleteFlowDefinition404 as Ja, GetFlowStep200StepGatesKind as Ji, GetUserInfoDefault as Jn, CreateHandoff200 as Jo, GetProjectDefault as Jr, CreateAuthAttempt201ChallengesItemState as Js, RevokeMySession409Details as Jt, SubmitFlowStep400StepGatesConfig as K, DeleteFlowDefinitionDefault as Ka, GetFlowStep200StepSsoProvidersItem as Ki, Introspect400Details as Kn, CreateProject201 as Ko, GetReady4xx as Kr, CreateAuthAttempt201CompletedFactorsItemMethod as Ks, RevokeMySessionDefaultDetails as Kt, SubmitFlowStepBodyChallengeResponseProof as L, ExchangeHandoff200SessionMetadata as La, GetFlowStepDefault as Li, IssueChallengeBodyMethod as Ln, CreateSchema409Details as Lo, GetSchemaByIdDefault as Lr, CreateFlow201Branding as Ls, RevokeSessionDefault as Lt, SubmitFlowStepDefaultDetails as M, ExchangeHandoff400Details as Ma, GetKeys4xxDetails as Mi, ListFlowDefinitions200FlowDefinitionsItem as Mn, CreateSchemaParams as Mo, GetSession200Metadata as Mr, CreateFlow201StepComplete as Ms, RevokeTokenDefaultDetails as Mt, SubmitFlowStepBody as N, ExchangeHandoff200 as Na, GetHealthDefault as Ni, IssueChallengeDefault as Nn, CreateSchemaDefault as No, GetSession200FactorsItem as Nr, CreateFlow201StepChallenge as Ns, RevokeTokenBody as Nt, UpdateFlowDefinition400 as O, ExchangeHandoff410Details as Oa, GetKeysDefaultDetails as Oi, ListFlowDefinitionsDefaultDetails as On, CreateSession201SessionMetadata as Oo, GetSession401Details as Or, CreateFlow201StepFields as Os, SubmitFlowEvent404Details as Ot, SubmitFlowStepBodyGateProofs as P, ExchangeHandoff200Session as Pa, GetHealthDefaultDetails as Pi, IssueChallengeBody as Pn, CreateSchemaDefaultDetails as Po, GetSession200FactorsItemPayload as Pr, CreateFlow201StepChallengeOptions as Ps, RevokeToken4xx as Pt, SubmitFlowStep400StepChallenge as Q, CreateUserDefaultDetails as Qa, GetFlowStep200StepFieldsValidationFormat as Qi, GetUserInfo4xxDetails as Qn, CreateFlowDefinitionBodyFlowDefinition as Qo, GetProject401 as Qr, AuthorizeGetDefault as Qs, RevokeMySession401Details as Qt, SubmitFlowStep409 as R, ExchangeHandoff200SessionFactorsItem as Ra, GetFlowStepDefaultDetails as Ri, IssueChallenge201 as Rn, CreateSchema400 as Ro, GetSchemaByIdDefaultDetails as Rr, CreateFlow201BrandingLayout as Rs, RevokeSessionDefaultDetails as Rt, UpdateFlowDefinitionBodyStepsItemGatesConfig as S, GetAuthAttempt200ChallengesItemMethod as Sa, GetMySession200FactorsItemMethod as Si, ListSessions200SessionsItemFactorsItem as Sn, CreateSession400 as So, GetSessionParams as Sr, CreateFlow201Step as Ss, SubmitFlowEventDefault as St, UpdateFlowDefinitionBodyAudience as T, ExchangeHandoffDefaultDetails as Ta, GetLive4xx as Ti, ListFlowDefinitionsParams as Tn, CreateSession201Session as To, GetSession404 as Tr, CreateFlow201StepGates as Ts, SubmitFlowEventBodyType as Tt, SubmitFlowStep400StepSsoProvidersItem as U, EndSessionDefaultDetails as Ua, GetFlowStep200 as Ui, IntrospectDefaultDetails as Un, CreateProjectBody as Uo, GetSchemaById200 as Ur, CreateAuthAttempt201RequiredFactorsItem as Us, RevokeSession401 as Ut, SubmitFlowStep400Step as V, EndSessionParams as Va, GetFlowStep404 as Vi, IssueChallenge201Method as Vn, CreateProjectDefault as Vo, GetSchemaById400 as Vr, CreateAuthAttempt201 as Vs, RevokeSession404 as Vt, SubmitFlowStep400StepGates as W, EndSession400 as Wa, GetFlowStep200Step as Wi, IntrospectBody as Wn, CreateProject429 as Wo, GetReadyDefault as Wr, CreateAuthAttempt201CompletedFactorsItem as Ws, RevokeSession401Details as Wt, SubmitFlowStep400StepFieldsType as X, CreateUserParams as Xa, GetFlowStep200StepFields as Xi, GetUserInfo200 as Xn, CreateFlowDefinitionDefaultDetails as Xo, GetProject404 as Xr, CreateAuthAttempt201ChallengesItemMethod as Xs, RevokeMySession404Details as Xt, SubmitFlowStep400StepFieldsValidationFormat as Y, DeleteFlowDefinition404Details as Ya, GetFlowStep200StepGatesConfig as Yi, GetUserInfoDefaultDetails as Yn, CreateFlowDefinitionDefault as Yo, GetProjectDefaultDetails as Yr, CreateAuthAttempt201ChallengesItemPayload as Ys, RevokeMySession404 as Yt, SubmitFlowStep400StepComplete as Z, CreateUserDefault as Za, GetFlowStep200StepFieldsValidation as Zi, GetUserInfo4xx as Zn, CreateFlowDefinitionBody as Zo, GetProject404Details as Zr, AuthorizeGetParams as Zs, RevokeMySession401 as Zt, UpdateFlowDefinitionBodyStepsItemTransitions as _, GetAuthAttempt200CompletedFactorsItemPayload as _a, GetMySession200UserAgent as _i, ListSessions200 as _n, CreateTeam201 as _o, GetTeam404 as _r, CreateFlowBodyPurpose as _s, SubmitFlowStep200StepChallengeOptions as _t, VerifyChallengeProof200RequiredFactorsItem as a, GetFlowStep200Branding as aa, AuthorizeDevice400 as ac, GetOpenIDConfiguration200SubjectTypesSupportedItem as ai, ListUsers400Details as an, CreateUser401Details as ao, GetUserByID401Details as ar, CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig as as, SubmitFlowStep200Step as at, UpdateFlowDefinitionBodyStepsItemGates as b, GetAuthAttempt200ChallengesItemState as ba, GetMySession200FactorsItem as bi, ListSessions200SessionsItemState as bn, CreateSessionBody as bo, GetTeam401Details as br, CreateFlow400Details as bs, SubmitFlowStep200Branding as bt, VerifyChallengeProof200CompletedFactorsItemMethod as c, GetFlowDefinitionDefaultDetails as ca, GetOpenIDConfiguration4xx as ci, ListSessionsState as cn, CreateUser201 as co, GetTokenDefaultDetails as cr, CreateFlowDefinitionBodyFlowDefinitionAudience as cs, SubmitFlowStep200StepGates as ct, VerifyChallengeProof200ChallengesItemPayload as d, GetFlowDefinition200 as da, GetMySessionDefaultDetails as di, ListSessions403 as dn, CreateTeamDefaultDetails as do, GetToken200 as dr, CreateFlowDefinition400 as ds, SubmitFlowStep200StepFields as dt, GetFlowStep200StepComplete as ea, AuthorizeGet400 as ec, GetProject200 as ei, ListUsersDefault as en, CreateUser409 as eo, GetUserByIDDefault as er, CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions as es, SubmitFlowStep400StepChallengeMethod as et, VerifyChallengeProof200ChallengesItemMethod as f, GetAuthAttemptDefault as fa, GetMySession404 as fi, ListSessions403Details as fn, CreateTeamBody as fo, GetToken4xx as fr, CreateFlowDefinition400Details as fs, SubmitFlowStep200StepFieldsValidation as ft, UpdateFlowDefinitionBodyStepsItem as g, GetAuthAttempt200CompletedFactorsItem as ga, GetMySession200 as gi, ListSessions400Details as gn, CreateTeam400Details as go, GetTeamDefaultDetails as gr, CreateFlowBody as gs, SubmitFlowStep200StepChallenge as gt, UpdateFlowDefinitionBody as h, GetAuthAttempt200RequiredFactorsItem as ha, GetMySession401Details as hi, ListSessions400 as hn, CreateTeam400 as ho, GetTeamDefault as hr, CreateFlowDefaultDetails as hs, SubmitFlowStep200StepComplete as ht, VerifyChallengeProof200State as i, GetFlowStep200StepActions as ia, AuthorizeDeviceDefaultDetails as ic, GetOpenIDConfiguration200TokenEndpointAuthMethodsSupportedItem as ii, ListUsers400 as in, CreateUser401 as io, GetUserByID401 as ir, CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind as is, SubmitFlowStep200 as it, SubmitFlowStepDefault as j, ExchangeHandoff400 as ja, GetKeys4xx as ji, ListFlowDefinitions200 as jn, CreateSession201SessionFactorsItemMethod as jo, GetSession200State as jr, CreateFlow201StepFieldsType as js, RevokeTokenDefault as jt, UpdateFlowDefinition400Details as k, ExchangeHandoff401 as ka, GetKeys200 as ki, ListFlowDefinitions400 as kn, CreateSession201SessionFactorsItem as ko, GetSession200 as kr, CreateFlow201StepFieldsValidation as ks, SubmitFlowEvent400 as kt, VerifyChallengeProof200ChallengesItem as l, GetFlowDefinition404 as la, GetOpenIDConfiguration4xxDetails as li, ListSessionsDefault as ln, CreateTeamParams as lo, GetTokenBody as lr, CreateFlowDefinition409 as ls, SubmitFlowStep200StepGatesKind as lt, UpdateFlowDefinitionDefaultDetails as m, GetAuthAttempt200State as ma, GetMySession401 as mi, ListSessions401Details as mn, CreateTeam429Details as mo, GetTeamParams as mr, CreateFlowDefault as ms, SubmitFlowStep200StepFieldsType as mt, VerifyChallengeProofBody as n, GetFlowStep200StepChallengeOptions as na, AuthorizeDeviceParams as nc, GetOpenIDConfigurationDefaultDetails as ni, ListUsers500 as nn, CreateUser403 as no, GetUserByID404 as nr, CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess as ns, SubmitFlowStep400Branding as nt, VerifyChallengeProof200CompletedFactorsItem as o, GetFlowStep200BrandingLayout as oa, AuthorizeDevice400Details as oc, GetOpenIDConfiguration200DisplayValuesSupportedItem as oi, ListUsers200Item as on, CreateUser400 as oo, GetUserByID200 as or, CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete as os, SubmitFlowStep200StepTexts as ot, UpdateFlowDefinitionDefault as p, GetAuthAttempt200 as pa, GetMySession404Details as pi, ListSessions401 as pn, CreateTeam429 as po, GetToken4xxDetails as pr, CreateFlowDefinition201 as ps, SubmitFlowStep200StepFieldsValidationFormat as pt, SubmitFlowStep400StepFields as q, DeleteFlowDefinitionDefaultDetails as qa, GetFlowStep200StepGates as qi, Introspect200 as qn, CreateHandoffDefault as qo, GetReady4xxDetails as qr, CreateAuthAttempt201ChallengesItem as qs, RevokeMySession409 as qt, VerifyChallengeProof200 as r, GetFlowStep200StepChallengeMethod as ra, AuthorizeDeviceDefault as rc, GetOpenIDConfiguration200 as ri, ListUsers500Details as rn, CreateUser403Details as ro, GetUserByID404Details as rr, CreateFlowDefinitionBodyFlowDefinitionStepsItemGates as rs, SubmitFlowStep400BrandingLayout as rt, VerifyChallengeProof200CompletedFactorsItemPayload as s, GetFlowDefinitionDefault as sa, AuthorizeDevice200 as sc, GetOpenIDConfiguration200ClaimTypesSupportedItem as si, ListSessionsParams as sn, CreateUser400Details as so, GetTokenDefault as sr, CreateFlowDefinitionBodyFlowDefinitionStepsItemActions as ss, SubmitFlowStep200StepSsoProvidersItem as st, VerifyChallengeProofDefault as t, GetFlowStep200StepChallenge as ta, AuthorizeGet400Details as tc, GetOpenIDConfigurationDefault as ti, ListUsersDefaultDetails as tn, CreateUser409Details as to, GetUserByIDDefaultDetails as tr, CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem as ts, SubmitFlowStep400StepActions as tt, VerifyChallengeProof200ChallengesItemState as u, GetFlowDefinition404Details as ua, GetMySessionDefault as ui, ListSessionsDefaultDetails as un, CreateTeamDefault as uo, GetTokenBodyGrantType as ur, CreateFlowDefinition409Details as us, SubmitFlowStep200StepGatesConfig as ut, UpdateFlowDefinitionBodyStepsItemSsoProvidersItem as v, GetAuthAttempt200CompletedFactorsItemMethod as va, GetMySession200State as vi, ListSessions200SessionsItem as vn, CreateSessionDefault as vo, GetTeam404Details as vr, CreateFlowBodyHint as vs, SubmitFlowStep200StepChallengeMethod as vt, UpdateFlowDefinitionBodyStepsItemActions as w, ExchangeHandoffDefault as wa, GetLiveDefaultDetails as wi, ListSessions200SessionsItemFactorsItemMethod as wn, CreateSession201 as wo, GetSessionDefaultDetails as wr, CreateFlow201StepSsoProvidersItem as ws, SubmitFlowEventBody as wt, UpdateFlowDefinitionBodyStepsItemGatesKind as x, GetAuthAttempt200ChallengesItemPayload as xa, GetMySession200FactorsItemPayload as xi, ListSessions200SessionsItemMetadata as xn, CreateSessionBodyUserAgent as xo, GetTeam200 as xr, CreateFlow201 as xs, SubmitFlowStep200BrandingLayout as xt, UpdateFlowDefinitionBodyStepsItemOnSuccess as y, GetAuthAttempt200ChallengesItem as ya, GetMySession200Metadata as yi, ListSessions200SessionsItemUserAgent as yn, CreateSessionDefaultDetails as yo, GetTeam401 as yr, CreateFlow400 as ys, SubmitFlowStep200StepActions as yt, SubmitFlowStep409Details as z, ExchangeHandoff200SessionFactorsItemPayload as za, GetFlowStep410 as zi, IssueChallenge201State as zn, CreateSchema400Details as zo, GetSchemaById404 as zr, CreateAuthAttemptDefault as zs, RevokeSession409 as zt };
-//# sourceMappingURL=index-DlEenfQJ.d.mts.map
+export { SubmitFlowStep400Step as $, GetAuthAttempt200RequiredFactorsItem as $a, AuthorizeDevice400 as $c, GetLive4xx as $i, ListFlowDefinitions200 as $n, CreateTeam400Details as $o, GetSession200State as $r, CreateFlowDefinition201FlowDefinitionStepsItemTransitions as $s, RevokeTokenDefault as $t, UpdateFlowDefinition400Details as A, GetFlowStep200StepChallengeOptions as Aa, CreateFlow201StepActions as Ac, GetOpenIDConfiguration4xx as Ai, ListSessionsState as An, DeleteFlowDefinitionParams as Ao, GetTokenDefaultDetails as Ar, CreateHandoffDefault as As, SubmitFlowStep200StepChallengeMethod as At, UpdateFlowDefinition200FlowDefinitionStepsItemComplete as B, GetFlowDefinition200FlowDefinitionStepsItem as Ba, CreateAuthAttempt201CompletedFactorsItemMethod as Bc, GetMySession404 as Bi, ListSessions200SessionsItem as Bn, CreateUser403Details as Bo, GetTeam404Details as Br, CreateFlowDefinitionBodyFlowDefinitionStepsItemGates as Bs, SubmitFlowEvent404Details as Bt, UpdateFlowDefinitionBodyStepsItemGatesConfig as C, GetFlowStep200StepGatesConfig as Ca, CreateFlow201StepFieldsValidation as Cc, GetOpenIDConfigurationDefault as Ci, ListUsersDefaultDetails as Cn, ExchangeHandoff200SessionFactorsItemPayload as Co, GetUserByIDDefaultDetails as Cr, CreateSchema201 as Cs, SubmitFlowStep200StepFields as Ct, UpdateFlowDefinition404 as D, GetFlowStep200StepFieldsType as Da, CreateFlow201StepChallenge as Dc, GetOpenIDConfiguration200SubjectTypesSupportedItem as Di, ListUsers400Details as Dn, EndSessionDefaultDetails as Do, GetUserByID401Details as Dr, CreateProject429 as Ds, SubmitFlowStep200StepComplete as Dt, UpdateFlowDefinitionBodyAudience as E, GetFlowStep200StepFieldsValidationFormat as Ea, CreateFlow201StepComplete as Ec, GetOpenIDConfiguration200TokenEndpointAuthMethodsSupportedItem as Ei, ListUsers400 as En, EndSessionDefault as Eo, GetUserByID401 as Er, CreateProjectBody as Es, SubmitFlowStep200StepFieldsType as Et, UpdateFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem as F, GetFlowDefinitionParams as Fa, CreateAuthAttempt201 as Fc, GetMyUser401 as Fi, ListSessions401 as Fn, CreateUserDefaultDetails as Fo, GetToken4xxDetails as Fr, CreateFlowDefinitionBodyFlowDefinition as Fs, SubmitFlowEventDefaultDetails as Ft, SubmitFlowStepBody as G, GetFlowDefinition200FlowDefinitionStepsItemGatesKind as Ga, AuthorizeGetParams as Gc, GetMySession200UserAgent as Gi, ListSessions200SessionsItemFactorsItemPayload as Gn, CreateUser201 as Go, GetSessionDefault as Gr, CreateFlowDefinitionBodyFlowDefinitionAudience as Gs, SetUserPasswordDefaultDetails as Gt, UpdateFlowDefinition200FlowDefinitionAudience as H, GetFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem as Ha, CreateAuthAttempt201ChallengesItemState as Hc, GetMySession401 as Hi, ListSessions200SessionsItemState as Hn, CreateUser401Details as Ho, GetTeam401Details as Hr, CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig as Hs, SubmitFlowEvent400Details as Ht, UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess as I, GetFlowDefinitionDefault as Ia, CreateAuthAttempt201State as Ic, GetMyUser401Details as Ii, ListSessions401Details as In, CreateUserBody as Io, GetTeamParams as Ir, CreateFlowDefinitionBodyFlowDefinitionStepsItem as Is, SubmitFlowEventBody as It, SubmitFlowStepBodyChallengeResponse as J, GetFlowDefinition200FlowDefinitionStepsItemActions as Ja, AuthorizeGet400 as Jc, GetMySession200FactorsItem as Ji, ListFlowDefinitionsPurpose as Jn, CreateTeamDefaultDetails as Jo, GetSession404Details as Jr, CreateFlowDefinition400 as Js, SetUserPassword500Details as Jt, SubmitFlowStepBodyGateProofs as K, GetFlowDefinition200FlowDefinitionStepsItemGatesConfig as Ka, AuthorizeGetDefault as Kc, GetMySession200State as Ki, ListSessions200SessionsItemFactorsItemMethod as Kn, CreateTeamParams as Ko, GetSessionDefaultDetails as Kr, CreateFlowDefinition409 as Ks, SetUserPasswordBody as Kt, UpdateFlowDefinition200FlowDefinitionStepsItemGates as L, GetFlowDefinitionDefaultDetails as La, CreateAuthAttempt201RequiredFactorsItem as Lc, GetMyUser200 as Li, ListSessions400 as Ln, CreateUser409 as Lo, GetTeamDefault as Lr, CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions as Ls, SubmitFlowEventBodyType as Lt, UpdateFlowDefinition200FlowDefinition as M, GetFlowStep200StepActions as Ma, CreateFlow201BrandingLayout as Mc, GetMyUserDefault as Mi, ListSessionsDefaultDetails as Mn, DeleteFlowDefinitionDefaultDetails as Mo, GetTokenBodyGrantType as Mr, CreateFlowDefinitionDefault as Ms, SubmitFlowStep200Branding as Mt, UpdateFlowDefinition200FlowDefinitionStepsItem as N, GetFlowStep200Branding as Na, CreateAuthAttemptDefault as Nc, GetMyUserDefaultDetails as Ni, ListSessions403 as Nn, CreateUserParams as No, GetToken200 as Nr, CreateFlowDefinitionDefaultDetails as Ns, SubmitFlowStep200BrandingLayout as Nt, UpdateFlowDefinition404Details as O, GetFlowStep200StepComplete as Oa, CreateFlow201StepChallengeOptions as Oc, GetOpenIDConfiguration200DisplayValuesSupportedItem as Oi, ListUsers200Item as On, EndSession400 as Oo, GetUserByID200 as Or, CreateProject429Details as Os, SubmitFlowStep200StepChallenge as Ot, UpdateFlowDefinition200FlowDefinitionStepsItemTransitions as P, GetFlowStep200BrandingLayout as Pa, CreateAuthAttemptBody as Pc, GetMyUser404 as Pi, ListSessions403Details as Pn, CreateUserDefault as Po, GetToken4xx as Pr, CreateFlowDefinitionBody as Ps, SubmitFlowEventDefault as Pt, SubmitFlowStep400 as Q, GetAuthAttempt200State as Qa, AuthorizeDeviceDefaultDetails as Qc, GetLiveDefaultDetails as Qi, ListFlowDefinitions400Details as Qn, CreateTeam400 as Qo, GetSession200UserAgent as Qr, CreateFlowDefinition201FlowDefinitionStepsItem as Qs, SetUserPassword400Details as Qt, UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind as R, GetFlowDefinition200 as Ra, CreateAuthAttempt201CompletedFactorsItem as Rc, GetMySessionDefault as Ri, ListSessions400Details as Rn, CreateUser409Details as Ro, GetTeamDefaultDetails as Rr, CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem as Rs, SubmitFlowEventBodyPayload as Rt, UpdateFlowDefinitionBodyStepsItemGatesKind as S, GetFlowStep200StepGatesKind as Sa, CreateFlow201StepFields as Sc, GetProject200 as Si, ListUsersDefault as Sn, ExchangeHandoff200SessionFactorsItem as So, GetUserByIDDefault as Sr, CreateSchema400Details as Ss, SubmitFlowStep200StepGatesConfig as St, UpdateFlowDefinitionBodyStepsItemActions as T, GetFlowStep200StepFieldsValidation as Ta, CreateFlow201StepFieldsType as Tc, GetOpenIDConfiguration200 as Ti, ListUsers500Details as Tn, EndSessionParams as To, GetUserByID404Details as Tr, CreateProjectDefaultDetails as Ts, SubmitFlowStep200StepFieldsValidationFormat as Tt, SubmitFlowStepDefault as U, GetFlowDefinition200FlowDefinitionStepsItemOnSuccess as Ua, CreateAuthAttempt201ChallengesItemPayload as Uc, GetMySession401Details as Ui, ListSessions200SessionsItemMetadata as Un, CreateUser400 as Uo, GetTeam200 as Ur, CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete as Us, SetUserPasswordParams as Ut, UpdateFlowDefinition200FlowDefinitionStepsItemActions as V, GetFlowDefinition200FlowDefinitionStepsItemTransitions as Va, CreateAuthAttempt201ChallengesItem as Vc, GetMySession404Details as Vi, ListSessions200SessionsItemUserAgent as Vn, CreateUser401 as Vo, GetTeam401 as Vr, CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind as Vs, SubmitFlowEvent400 as Vt, SubmitFlowStepDefaultDetails as W, GetFlowDefinition200FlowDefinitionStepsItemGates as Wa, CreateAuthAttempt201ChallengesItemMethod as Wc, GetMySession200 as Wi, ListSessions200SessionsItemFactorsItem as Wn, CreateUser400Details as Wo, GetSessionParams as Wr, CreateFlowDefinitionBodyFlowDefinitionStepsItemActions as Ws, SetUserPasswordDefault as Wt, SubmitFlowStep409 as X, GetAuthAttemptDefault as Xa, AuthorizeDeviceParams as Xc, GetMySession200FactorsItemMethod as Xi, ListFlowDefinitionsDefaultDetails as Xn, CreateTeam429 as Xo, GetSession401Details as Xr, CreateFlowDefinition201 as Xs, SetUserPassword404Details as Xt, SubmitFlowStepBodyChallengeResponseProof as Y, GetFlowDefinition200FlowDefinitionAudience as Ya, AuthorizeGet400Details as Yc, GetMySession200FactorsItemPayload as Yi, ListFlowDefinitionsDefault as Yn, CreateTeamBody as Yo, GetSession401 as Yr, CreateFlowDefinition400Details as Ys, SetUserPassword404 as Yt, SubmitFlowStep409Details as Z, GetAuthAttempt200 as Za, AuthorizeDeviceDefault as Zc, GetLiveDefault as Zi, ListFlowDefinitions400 as Zn, CreateTeam429Details as Zo, GetSession200 as Zr, CreateFlowDefinition201FlowDefinition as Zs, SetUserPassword400 as Zt, UpdateFlowDefinitionBodyStepsItem as _, GetFlowStep200 as _a, CreateFlow201StepTexts as _c, GetProjectDefaultDetails as _i, RevokeMySession404 as _n, ExchangeHandoff200 as _o, GetUserInfoDefaultDetails as _r, CreateSchemaDefaultDetails as _s, SubmitFlowStep200Step as _t, VerifyChallengeProof200RequiredFactorsItem as a, GetKeys4xx as aa, CreateFlowDefinition201FlowDefinitionStepsItemComplete as ac, GetSchemaByIdDefault as ai, RevokeSessionDefault as an, GetAuthAttempt200ChallengesItemPayload as ao, IssueChallengeBodyMethod as ar, CreateSession400 as as, SubmitFlowStep400StepFields as at, UpdateFlowDefinitionBodyStepsItemOnSuccess as b, GetFlowStep200StepSsoProvidersItem as ba, CreateFlow201StepGatesKind as bc, GetProject401 as bi, RevokeMySession401Details as bn, ExchangeHandoff200SessionState as bo, GetUserInfo4xxDetails as br, CreateSchema409Details as bs, SubmitFlowStep200StepGates as bt, VerifyChallengeProof200CompletedFactorsItemMethod as c, GetHealthDefaultDetails as ca, CreateFlowDefault as cc, GetSchemaById404Details as ci, RevokeSession409Details as cn, ExchangeHandoffDefault as co, IssueChallenge201Payload as cr, CreateSession201Session as cs, SubmitFlowStep400StepFieldsType as ct, VerifyChallengeProof200ChallengesItemPayload as d, GetFlowStepDefault as da, CreateFlowBodyPurpose as dc, GetSchemaById200 as di, RevokeSession401 as dn, ExchangeHandoff410 as do, IntrospectDefaultDetails as dr, CreateSession201SessionMetadata as ds, SubmitFlowStep400StepChallengeOptions as dt, GetLive4xxDetails as ea, CreateFlowDefinition201FlowDefinitionStepsItemSsoProvidersItem as ec, GetSession200Metadata as ei, AuthorizeDevice400Details as el, RevokeTokenDefaultDetails as en, GetAuthAttempt200CompletedFactorsItem as eo, ListFlowDefinitions200FlowDefinitionsItem as er, CreateTeam201 as es, SubmitFlowStep400StepTexts as et, VerifyChallengeProof200ChallengesItemMethod as f, GetFlowStepDefaultDetails as fa, CreateFlowBodyHint as fc, GetReadyDefault as fi, RevokeSession401Details as fn, ExchangeHandoff410Details as fo, IntrospectBody as fr, CreateSession201SessionFactorsItem as fs, SubmitFlowStep400StepChallengeMethod as ft, UpdateFlowDefinitionBody as g, GetFlowStep404Details as ga, CreateFlow201Step as gc, GetProjectDefault as gi, RevokeMySession409Details as gn, ExchangeHandoff400Details as go, GetUserInfoDefault as gr, CreateSchemaDefault as gs, SubmitFlowStep200 as gt, UpdateFlowDefinitionDefaultDetails as h, GetFlowStep404 as ha, CreateFlow201 as hc, GetReady4xxDetails as hi, RevokeMySession409 as hn, ExchangeHandoff400 as ho, Introspect200 as hr, CreateSchemaParams as hs, SubmitFlowStep400BrandingLayout as ht, VerifyChallengeProof200State as i, GetKeys200KeysItem as ia, CreateFlowDefinition201FlowDefinitionStepsItemGatesConfig as ic, GetSchemaByIdParams as ii, RevokeSessionParams as in, GetAuthAttempt200ChallengesItemState as io, IssueChallengeBodyPasskeyOptionsUserVerification as ir, CreateSessionBodyUserAgent as is, SubmitFlowStep400StepGatesConfig as it, UpdateFlowDefinition200 as j, GetFlowStep200StepChallengeMethod as ja, CreateFlow201Branding as jc, GetOpenIDConfiguration4xxDetails as ji, ListSessionsDefault as jn, DeleteFlowDefinitionDefault as jo, GetTokenBody as jr, CreateHandoff200 as js, SubmitFlowStep200StepActions as jt, UpdateFlowDefinition400 as k, GetFlowStep200StepChallenge as ka, CreateFlow201StepChallengeMethod as kc, GetOpenIDConfiguration200ClaimTypesSupportedItem as ki, ListSessionsParams as kn, EndSession400Details as ko, GetTokenDefault as kr, CreateProject201 as ks, SubmitFlowStep200StepChallengeOptions as kt, VerifyChallengeProof200ChallengesItem as l, GetHealth4xx as la, CreateFlowDefaultDetails as lc, GetSchemaById400 as li, RevokeSession404 as ln, ExchangeHandoffDefaultDetails as lo, IssueChallenge201Method as lr, CreateSession201SessionUserAgent as ls, SubmitFlowStep400StepComplete as lt, UpdateFlowDefinitionDefault as m, GetFlowStep410Details as ma, CreateFlow400Details as mc, GetReady4xx as mi, RevokeMySessionDefaultDetails as mn, ExchangeHandoff401Details as mo, Introspect400Details as mr, CreateSession201SessionFactorsItemMethod as ms, SubmitFlowStep400Branding as mt, VerifyChallengeProofBody as n, GetKeysDefaultDetails as na, CreateFlowDefinition201FlowDefinitionStepsItemGates as nc, GetSession200FactorsItemPayload as ni, RevokeToken4xx as nn, GetAuthAttempt200CompletedFactorsItemMethod as no, IssueChallengeBody as nr, CreateSessionDefaultDetails as ns, SubmitFlowStep400StepGates as nt, VerifyChallengeProof200CompletedFactorsItem as o, GetKeys4xxDetails as oa, CreateFlowDefinition201FlowDefinitionStepsItemActions as oc, GetSchemaByIdDefaultDetails as oi, RevokeSessionDefaultDetails as on, GetAuthAttempt200ChallengesItemMethod as oo, IssueChallenge201 as or, CreateSession400Details as os, SubmitFlowStep400StepFieldsValidation as ot, UpdateFlowDefinitionParams as p, GetFlowStep410 as pa, CreateFlow400 as pc, GetReadyDefaultDetails as pi, RevokeMySessionDefault as pn, ExchangeHandoff401 as po, Introspect400 as pr, CreateSession201SessionFactorsItemPayload as ps, SubmitFlowStep400StepActions as pt, SubmitFlowStepBodyFields as q, GetFlowDefinition200FlowDefinitionStepsItemComplete as qa, AuthorizeGetDefaultDetails as qc, GetMySession200Metadata as qi, ListFlowDefinitionsParams as qn, CreateTeamDefault as qo, GetSession404 as qr, CreateFlowDefinition409Details as qs, SetUserPassword500 as qt, VerifyChallengeProof200 as r, GetKeys200 as ra, CreateFlowDefinition201FlowDefinitionStepsItemGatesKind as rc, GetSession200FactorsItemMethod as ri, RevokeToken4xxDetails as rn, GetAuthAttempt200ChallengesItem as ro, IssueChallengeBodyPasskeyOptions as rr, CreateSessionBody as rs, SubmitFlowStep400StepGatesKind as rt, VerifyChallengeProof200CompletedFactorsItemPayload as s, GetHealthDefault as sa, CreateFlowDefinition201FlowDefinitionAudience as sc, GetSchemaById404 as si, RevokeSession409 as sn, ExchangeHandoffParams as so, IssueChallenge201State as sr, CreateSession201 as ss, SubmitFlowStep400StepFieldsValidationFormat as st, VerifyChallengeProofDefault as t, GetKeysDefault as ta, CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess as tc, GetSession200FactorsItem as ti, AuthorizeDevice200 as tl, RevokeTokenBody as tn, GetAuthAttempt200CompletedFactorsItemPayload as to, IssueChallengeDefault as tr, CreateSessionDefault as ts, SubmitFlowStep400StepSsoProvidersItem as tt, VerifyChallengeProof200ChallengesItemState as u, GetHealth4xxDetails as ua, CreateFlowBody as uc, GetSchemaById400Details as ui, RevokeSession404Details as un, ExchangeHandoffBody as uo, IntrospectDefault as ur, CreateSession201SessionState as us, SubmitFlowStep400StepChallenge as ut, UpdateFlowDefinitionBodyStepsItemTransitions as v, GetFlowStep200Step as va, CreateFlow201StepSsoProvidersItem as vc, GetProject404 as vi, RevokeMySession404Details as vn, ExchangeHandoff200Session as vo, GetUserInfo200 as vr, CreateSchemaBody as vs, SubmitFlowStep200StepTexts as vt, UpdateFlowDefinitionBodyStepsItemComplete as w, GetFlowStep200StepFields as wa, CreateFlow201StepFieldsValidationFormat as wc, GetOpenIDConfigurationDefaultDetails as wi, ListUsers500 as wn, ExchangeHandoff200SessionFactorsItemMethod as wo, GetUserByID404 as wr, CreateProjectDefault as ws, SubmitFlowStep200StepFieldsValidation as wt, UpdateFlowDefinitionBodyStepsItemGates as x, GetFlowStep200StepGates as xa, CreateFlow201StepGatesConfig as xc, GetProject401Details as xi, ListUsersParams as xn, ExchangeHandoff200SessionMetadata as xo, GetUserByIDParams as xr, CreateSchema400 as xs, SubmitFlowStep200StepGatesKind as xt, UpdateFlowDefinitionBodyStepsItemSsoProvidersItem as y, GetFlowStep200StepTexts as ya, CreateFlow201StepGates as yc, GetProject404Details as yi, RevokeMySession401 as yn, ExchangeHandoff200SessionUserAgent as yo, GetUserInfo4xx as yr, CreateSchema409 as ys, SubmitFlowStep200StepSsoProvidersItem as yt, UpdateFlowDefinition200FlowDefinitionStepsItemGatesConfig as z, GetFlowDefinition200FlowDefinition as za, CreateAuthAttempt201CompletedFactorsItemPayload as zc, GetMySessionDefaultDetails as zi, ListSessions200 as zn, CreateUser403 as zo, GetTeam404 as zr, CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess as zs, SubmitFlowEvent404 as zt };
+//# sourceMappingURL=index-DyBulyp9.d.mts.map