@zitadel/api 0.0.0

package/src/generated/endpoints/zitadelNextGen.zod.ts

@@ -0,0 +1,3788 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import * as zod from "zod";
+
+/**
+ * Retrieve the OpenID Connect configuration
+ * @summary Get OpenID Connect configuration
+ */
+export const getOpenIDConfigurationResponseClaimsParameterSupportedDefault = false;
+export const getOpenIDConfigurationResponseRequestParameterSupportedDefault = false;
+export const getOpenIDConfigurationResponseRequestUriParameterSupportedDefault = true;
+export const getOpenIDConfigurationResponseRequireRequestUriRegistrationDefault = false;
+
+export const GetOpenIDConfigurationResponse = zod
+  .object({
+    issuer: zod
+      .url()
+      .describe(
+        "REQUIRED. URL using the https scheme with no query or fragment components that the OP asserts as its Issuer Identifier.",
+      ),
+    authorization_endpoint: zod
+      .url()
+      .describe("REQUIRED. URL of the OP's OAuth 2.0 Authorization Endpoint."),
+    token_endpoint: zod
+      .url()
+      .optional()
+      .describe(
+        "URL of the OP's OAuth 2.0 Token Endpoint. REQUIRED unless only the Implicit Flow is used.",
+      ),
+    userinfo_endpoint: zod
+      .url()
+      .optional()
+      .describe("RECOMMENDED. URL of the OP's UserInfo Endpoint."),
+    jwks_uri: zod
+      .url()
+      .describe(
+        "REQUIRED. URL of the OP's JWK Set document containing the signing key(s) the RP uses to validate signatures from the OP.",
+      ),
+    registration_endpoint: zod
+      .url()
+      .optional()
+      .describe("RECOMMENDED. URL of the OP's Dynamic Client Registration Endpoint."),
+    scopes_supported: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        "RECOMMENDED. JSON array containing a list of the OAuth 2.0 scope values that this server supports. The server MUST support the openid scope value.",
+      ),
+    response_types_supported: zod
+      .array(zod.string())
+      .describe(
+        "REQUIRED. JSON array containing a list of the OAuth 2.0 response_type values that this OP supports.",
+      ),
+    response_modes_supported: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        'OPTIONAL. JSON array containing a list of the OAuth 2.0 response_mode values that this OP supports. Default is [\"query\", \"fragment\"].',
+      ),
+    grant_types_supported: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        'OPTIONAL. JSON array containing a list of the OAuth 2.0 Grant Type values that this OP supports. Default is [\"authorization_code\", \"implicit\"].',
+      ),
+    acr_values_supported: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        "OPTIONAL. JSON array containing a list of the Authentication Context Class References that this OP supports.",
+      ),
+    subject_types_supported: zod
+      .array(zod.enum(["public", "pairwise"]))
+      .describe(
+        "REQUIRED. JSON array containing a list of the Subject Identifier types that this OP supports. Valid types include pairwise and public.",
+      ),
+    id_token_signing_alg_values_supported: zod
+      .array(zod.string())
+      .describe(
+        "REQUIRED. JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for the ID Token. The algorithm RS256 MUST be included.",
+      ),
+    id_token_encryption_alg_values_supported: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token.",
+      ),
+    id_token_encryption_enc_values_supported: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token.",
+      ),
+    userinfo_signing_alg_values_supported: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        "OPTIONAL. JSON array containing a list of the JWS signing algorithms (alg values) supported by the UserInfo Endpoint.",
+      ),
+    userinfo_encryption_alg_values_supported: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (alg values) supported by the UserInfo Endpoint.",
+      ),
+    userinfo_encryption_enc_values_supported: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the UserInfo Endpoint.",
+      ),
+    request_object_signing_alg_values_supported: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        "OPTIONAL. JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects. Servers SHOULD support none and RS256.",
+      ),
+    request_object_encryption_alg_values_supported: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects.",
+      ),
+    request_object_encryption_enc_values_supported: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects.",
+      ),
+    token_endpoint_auth_methods_supported: zod
+      .array(
+        zod.enum([
+          "client_secret_post",
+          "client_secret_basic",
+          "client_secret_jwt",
+          "private_key_jwt",
+        ]),
+      )
+      .optional()
+      .describe(
+        "OPTIONAL. JSON array containing a list of Client Authentication methods supported by the Token Endpoint. Default is client_secret_basic.",
+      ),
+    token_endpoint_auth_signing_alg_values_supported: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        "OPTIONAL. JSON array containing a list of the JWS signing algorithms supported by the Token Endpoint for private_key_jwt and client_secret_jwt authentication. The value none MUST NOT be used.",
+      ),
+    display_values_supported: zod
+      .array(zod.enum(["page", "popup", "touch", "wap"]))
+      .optional()
+      .describe(
+        "OPTIONAL. JSON array containing a list of the display parameter values that the OpenID Provider supports.",
+      ),
+    claim_types_supported: zod
+      .array(zod.enum(["normal", "aggregated", "distributed"]))
+      .optional()
+      .describe(
+        "OPTIONAL. JSON array containing a list of the Claim Types that the OpenID Provider supports. Default is normal.",
+      ),
+    claims_supported: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        "RECOMMENDED. JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for.",
+      ),
+    service_documentation: zod
+      .url()
+      .optional()
+      .describe(
+        "OPTIONAL. URL of a page containing human-readable information for developers using the OpenID Provider.",
+      ),
+    claims_locales_supported: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        "OPTIONAL. Languages and scripts supported for values in Claims being returned, as BCP47 language tag values.",
+      ),
+    ui_locales_supported: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        "OPTIONAL. Languages and scripts supported for the user interface, as BCP47 language tag values.",
+      ),
+    claims_parameter_supported: zod
+      .boolean()
+      .default(getOpenIDConfigurationResponseClaimsParameterSupportedDefault)
+      .describe(
+        "OPTIONAL. Boolean value specifying whether the OP supports use of the claims parameter. Default is false.",
+      ),
+    request_parameter_supported: zod
+      .boolean()
+      .default(getOpenIDConfigurationResponseRequestParameterSupportedDefault)
+      .describe(
+        "OPTIONAL. Boolean value specifying whether the OP supports use of the request parameter. Default is false.",
+      ),
+    request_uri_parameter_supported: zod
+      .boolean()
+      .default(getOpenIDConfigurationResponseRequestUriParameterSupportedDefault)
+      .describe(
+        "OPTIONAL. Boolean value specifying whether the OP supports use of the request_uri parameter. Default is true.",
+      ),
+    require_request_uri_registration: zod
+      .boolean()
+      .default(getOpenIDConfigurationResponseRequireRequestUriRegistrationDefault)
+      .describe(
+        "OPTIONAL. Boolean value specifying whether the OP requires any request_uri values used to be pre-registered. Default is false.",
+      ),
+    op_policy_uri: zod
+      .url()
+      .optional()
+      .describe(
+        "OPTIONAL. URL the OP provides to the person registering the Client about the OP's requirements on how the Relying Party can use the data provided.",
+      ),
+    op_tos_uri: zod
+      .url()
+      .optional()
+      .describe(
+        "OPTIONAL. URL the OP provides to the person registering the Client about the OpenID Provider's terms of service.",
+      ),
+  })
+  .describe(
+    "OpenID Connect configuration according to the OpenID Connect Discovery 1.0 specification.",
+  );
+
+/**
+ * @summary Authorize a user
+ */
+export const AuthorizeGetQueryParams = zod.strictObject({
+  acr_values: zod
+    .string()
+    .optional()
+    .describe(
+      "A space delimited list of Authentication Class References. This can be\nused to specify certain authentication methods or level of assurance \nthat is required for the authentication. For example, you could use \nthis to require multi-factor authentication.\n",
+    ),
+  client_id: zod
+    .string()
+    .describe(
+      "The client ID of the application that is requesting authorization. \nThis is a required parameter and must match the client ID of a \nregistered application.\n",
+    ),
+  code_challenge: zod
+    .string()
+    .optional()
+    .describe(
+      "The code challenge is a cryptographic string used in the PKCE (Proof \nKey for Code Exchange) flow to enhance security.\n",
+    ),
+  code_challenge_method: zod
+    .string()
+    .optional()
+    .describe(
+      'The code challenge method is used in conjunction with the code challenge \nin the PKCE flow. It specifies the method used to generate the code \nchallenge. Common values are \"S256\" for SHA-256 hashing and \"plain\" \nfor no hashing.\n',
+    ),
+  display: zod
+    .string()
+    .optional()
+    .describe(
+      'The display parameter is used to specify how the authorization server \nshould display the authentication and consent user interface. Common \nvalues include \"page\" for a full-page display, \"popup\" for a popup \nwindow, and \"touch\" for a mobile-optimized display.\n',
+    ),
+  id_token_hint: zod
+    .string()
+    .optional()
+    .describe(
+      "The ID token hint is a previously issued ID token that can be used to \npre-fill the authentication form or to provide information about the \nuser to the authorization server. This can be useful for single sign-on \nscenarios or for providing a smoother user experience.\n",
+    ),
+  login_hint: zod
+    .string()
+    .optional()
+    .describe(
+      "The login hint is a hint to the authorization server about the login \nidentifier of the user. This can be used to pre-fill the username or \nemail field in the authentication form, making it easier for the user \nto log in.\n",
+    ),
+  max_age: zod
+    .number()
+    .optional()
+    .describe(
+      "The max age parameter specifies the maximum amount of time in seconds \nthat has passed since the user last authenticated. If the user has not \nauthenticated within this time frame, they will be required to re-authenticate.\n",
+    ),
+  nonce: zod
+    .string()
+    .optional()
+    .describe(
+      "The nonce parameter is a random string that is used to associate a client \nsession with an ID token and to mitigate replay attacks. The authorization \nserver should include this value in the ID token that it issues, and the \nclient should verify that the value in the ID token matches the value it \nsent in the authorization request.\n",
+    ),
+  prompt: zod
+    .string()
+    .optional()
+    .describe(
+      'The prompt parameter is used to specify whether the authorization server \nshould prompt the user for re-authentication and consent. Common values \ninclude \"none\" for no prompts, \"login\" to prompt for re-authentication, \n\"consent\" to prompt for user consent, and \"select_account\" to prompt \nthe user to select an account if they are logged in with multiple accounts.\n',
+    ),
+  redirect_uri: zod
+    .string()
+    .optional()
+    .describe(
+      "The redirect URI is the URI to which the authorization server will redirect \nthe user after they have authorized or denied the request. This must match \none of the redirect URIs registered for the client application.\n",
+    ),
+  response_mode: zod
+    .string()
+    .optional()
+    .describe(
+      'The response mode parameter specifies how the authorization server should \nreturn the authorization response. Common values include \"query\" to return \nparameters in the query string, \"fragment\" to return parameters in the URL \nfragment, and \"form_post\" to return parameters in an HTTP POST request.\n',
+    ),
+  response_type: zod
+    .string()
+    .describe(
+      'The response type parameter specifies the type of response that the client \nis expecting from the authorization server. Common values include \"code\" \nfor the authorization code flow, \"token\" for the implicit flow, and \"id_token\" \nfor OpenID Connect authentication.\n',
+    ),
+  scope: zod
+    .string()
+    .optional()
+    .describe(
+      "The scope parameter is used to specify the permissions that the client is \nrequesting from the user. This is a space-delimited list of scope values, \nand the authorization server will use this information to determine what \naccess to grant to the client application.\n",
+    ),
+  state: zod
+    .string()
+    .optional()
+    .describe(
+      "The state parameter is a random string that is used to maintain state between \nthe authorization request and the callback. It is used to prevent cross-site \nrequest forgery (CSRF) attacks by ensuring that the response received from the \nauthorization server corresponds to the request that was sent.\n",
+    ),
+  ui_locales: zod
+    .string()
+    .optional()
+    .describe(
+      "The ui_locales parameter is used to specify the preferred languages and scripts \nfor the user interface that the authorization server should display. This is a \nspace-delimited list of BCP47 language tag values, and it can be used to provide \na localized user experience for users from different regions and language \npreferences.\n",
+    ),
+});
+
+/**
+ * @summary Authorize a device
+ */
+export const AuthorizeDeviceQueryParams = zod.strictObject({
+  client_id: zod
+    .string()
+    .describe(
+      "The client ID of the application that is requesting authorization. \nThis is a required parameter and must match the client ID of a \nregistered application.\n",
+    ),
+  scope: zod
+    .string()
+    .optional()
+    .describe(
+      "The scope parameter is used to specify the permissions that the client\nis requesting. This is a space delimited list of scopes. For example,\nyou could use this to request access to the user's profile information or\nto request permission to access certain APIs on behalf of the user.\n",
+    ),
+});
+
+export const AuthorizeDeviceResponse = zod.object({
+  device_code: zod
+    .string()
+    .optional()
+    .describe("The device code that the client will use to poll for authorization.\n"),
+  expires_in: zod
+    .number()
+    .optional()
+    .describe("The number of seconds until the device code expires.\n"),
+  interval: zod
+    .number()
+    .optional()
+    .describe(
+      "The minimum amount of time in seconds that the client should wait \nbetween polling requests.\n",
+    ),
+  user_code: zod
+    .string()
+    .optional()
+    .describe("The user code that the user will enter to authorize the device.\n"),
+  verification_uri: zod
+    .string()
+    .optional()
+    .describe("The URI where the user will enter the user code to authorize the device.\n"),
+  verification_uri_complete: zod
+    .string()
+    .optional()
+    .describe(
+      "The complete URI with the user code included, which the user can visit\nto authorize the device.\n",
+    ),
+});
+
+/**
+ * @summary End a session
+ */
+export const EndSessionQueryParams = zod.strictObject({
+  client_id: zod
+    .string()
+    .optional()
+    .describe(
+      "The client ID is the identifier for the client application that is making \nthe request. This is used by the authorization server to identify the \nclient and to determine whether it is authorized to perform the requested \naction.\n",
+    ),
+  id_token_hint: zod
+    .string()
+    .optional()
+    .describe(
+      "The ID token hint is a previously issued ID token that can be used to \npre-fill the authentication form or to provide information about the \nuser to the authorization server. This can be useful for single sign-on \nscenarios or for providing a smoother user experience.\n",
+    ),
+  logout_hint: zod
+    .string()
+    .optional()
+    .describe(
+      "The logout hint is a hint to the authorization server about the login \nidentifier of the user. This can be used to pre-fill the username or email\nfield in the logout form, making it easier for the user to log out.\n",
+    ),
+  post_logout_redirect_uri: zod
+    .string()
+    .optional()
+    .describe(
+      "The post logout redirect URI is the URI to which the user will be \nredirected after they have logged out. This must be a registered URI \nfor the client application and is used to ensure that the user is \nredirected to a safe location after logging out.\n",
+    ),
+  state: zod
+    .string()
+    .optional()
+    .describe(
+      "The state parameter is an opaque value that is used by the client to\nmaintain state between the request and the callback. It is typically used\nto prevent cross-site request forgery (CSRF) attacks by including a unique\nvalue in the request that the client can verify when it receives the callback.\n",
+    ),
+  ui_locales: zod
+    .string()
+    .optional()
+    .describe(
+      "The ui_locales parameter is a space-separated list of BCP47 language tags\nthat are used to indicate the preferred languages and scripts for the user\ninterface. This can be used by the authorization server to display the logout\npage in the user's preferred language.\n",
+    ),
+});
+
+/**
+ * @summary Introspect a token
+ */
+export const IntrospectResponse = zod.object({
+  active: zod.boolean().optional().describe("Indicates whether the token is active"),
+  aud: zod.string().optional().describe("The audience of the token (if applicable)"),
+  client_id: zod.string().optional().describe("The client ID associated with the token"),
+  exp: zod
+    .number()
+    .optional()
+    .describe("The expiration time of the token (in seconds since epoch)"),
+  iat: zod.number().optional().describe("The time the token was issued (in seconds since epoch)"),
+  iss: zod.string().optional().describe("The issuer of the token (if applicable)"),
+  jti: zod.string().optional().describe("The unique identifier for the token (if applicable)"),
+  nbf: zod
+    .number()
+    .optional()
+    .describe("The time before which the token is not valid (in seconds since epoch)"),
+  scope: zod.string().optional().describe("The scopes associated with the token"),
+  sub: zod.string().optional().describe("The subject of the token (if applicable)"),
+  token_type: zod
+    .string()
+    .optional()
+    .describe("The type of the token (access_token or refresh_token)"),
+  username: zod
+    .string()
+    .optional()
+    .describe("The username associated with the token (if applicable)"),
+});
+
+/**
+ * @summary Get public keys
+ */
+export const GetKeysResponse = zod.object({
+  keys: zod
+    .array(
+      zod.object({
+        use: zod.string().optional(),
+        kty: zod.string().optional(),
+        kid: zod.string().optional(),
+        crv: zod.string().optional(),
+        alg: zod.string().optional(),
+        k: zod.string().optional(),
+        x: zod.string().optional(),
+        y: zod.string().optional(),
+        n: zod.string().optional(),
+        e: zod.string().optional(),
+        d: zod.string().optional(),
+        p: zod.string().optional(),
+        q: zod.string().optional(),
+        dp: zod.string().optional(),
+        dq: zod.string().optional(),
+        qi: zod.string().optional(),
+        x5c: zod.array(zod.string()).optional(),
+        x5u: zod.string().optional(),
+        x5t: zod.string().optional(),
+        x5tS256: zod.string().optional(),
+      }),
+    )
+    .optional(),
+});
+
+/**
+ * @summary Get accesstoken
+ */
+export const GetTokenResponse = zod.object({
+  access_token: zod
+    .string()
+    .optional()
+    .describe("The access token issued by the authorization server."),
+  token_type: zod.string().optional().describe("The type of the token issued (e.g., Bearer)."),
+  expires_in: zod.number().optional().describe("The lifetime in seconds of the access token."),
+  refresh_token: zod
+    .string()
+    .optional()
+    .describe("The refresh token which can be used to obtain new access tokens."),
+});
+
+/**
+ * @summary Get user info
+ */
+export const GetUserInfoResponse = zod.object({
+  sub: zod.string().optional().describe("The unique identifier for the user."),
+  name: zod.string().optional().describe("The full name of the user."),
+  email: zod.email().optional().describe("The email address of the user."),
+  preferred_username: zod.string().optional().describe("The preferred username of the user."),
+  picture: zod.url().optional().describe("The URL of the user's profile picture."),
+  given_name: zod.string().optional().describe("The given name of the user."),
+  family_name: zod.string().optional().describe("The family name of the user."),
+});
+
+/**
+ * @summary Create user
+ */
+export const createUserQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const createUserQueryTeamIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const CreateUserQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(createUserQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+  team_id: zod
+    .string()
+    .regex(createUserQueryTeamIdRegExp)
+    .optional()
+    .describe("The unique identifier of the team"),
+});
+
+export const CreateUserBody = zod
+  .record(zod.string(), zod.unknown())
+  .describe(
+    "A user represents an individual identity in the system. It can be used to \nrepresent a human user, but also a service account or any other type of \nidentity. The content of a user is determined by the configured schema for \nusers, this is only a base schema.\n",
+  );
+
+/**
+ * @summary List users
+ */
+export const listUsersQueryOffsetDefault = 0;
+export const listUsersQueryOffsetMin = 0;
+
+export const listUsersQueryLimitDefault = 20;
+export const listUsersQueryLimitMax = 100;
+
+export const ListUsersQueryParams = zod.strictObject({
+  offset: zod
+    .number()
+    .min(listUsersQueryOffsetMin)
+    .default(listUsersQueryOffsetDefault)
+    .describe("Number of items to skip before returning results."),
+  limit: zod
+    .number()
+    .min(1)
+    .max(listUsersQueryLimitMax)
+    .default(listUsersQueryLimitDefault)
+    .describe("Maximum number of items to return."),
+});
+
+export const ListUsersResponseItem = zod.record(zod.string(), zod.unknown());
+export const ListUsersResponse = zod.array(ListUsersResponseItem);
+
+/**
+ * @summary Get user by ID
+ */
+export const getUserByIDPathUserIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+
+export const GetUserByIDParams = zod.object({
+  user_id: zod.string().regex(getUserByIDPathUserIdRegExp),
+});
+
+export const getUserByIDQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getUserByIDQueryTeamIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const GetUserByIDQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(getUserByIDQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+  team_id: zod
+    .string()
+    .regex(getUserByIDQueryTeamIdRegExp)
+    .optional()
+    .describe("The unique identifier of the team"),
+});
+
+export const GetUserByIDResponse = zod.record(zod.string(), zod.unknown());
+
+/**
+ * Resolves a flow definition based on purpose + audience context and returns
+the first capability step. Creates a new session implicitly unless
+`session_id` is provided (for step-up / reauth on an existing session).
+
+The response contains an `id` field — the flow handle. Use it as the path
+parameter for all subsequent `/flow/{id}/submit` and `/flow/{id}/event` calls.
+
+The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
+the flow's orchestration state (current step, collected data, history).
+The server is stateless between requests — all flow state lives in this
+cookie. The browser sends it automatically on subsequent requests.
+
+ * @summary Start a new flow
+ */
+export const createFlowBodyProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const createFlowBodyFlowDefinitionNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
+export const createFlowBodySchemaVersionRegExp = new RegExp("^\\d+\\.\\d+\\.\\d+$");
+
+export const CreateFlowBody = zod.object({
+  project_id: zod.string().regex(createFlowBodyProjectIdRegExp),
+  purpose: zod.enum(["login", "register", "recovery", "profiling", "reauth", "link_account"]),
+  flow_definition_name: zod
+    .string()
+    .regex(createFlowBodyFlowDefinitionNameRegExp)
+    .optional()
+    .describe(
+      "Name of a specific flow definition to use.\nWhen omitted, the engine selects the best-matching definition\nbased on purpose + audience context.\n",
+    ),
+  schema_version: zod
+    .string()
+    .regex(createFlowBodySchemaVersionRegExp)
+    .optional()
+    .describe(
+      "Semver version of the flow definition JSON Schema to use.\nWhen omitted, the latest version is used.\n",
+    ),
+  challenge_nonce: zod
+    .string()
+    .optional()
+    .describe(
+      "Origin-bound, single-use nonce obtained from `POST \/bootstrap\/challenge`.\nBinds the request to the browser that initiated the flow, preventing\ncross-origin replay.\n",
+    ),
+  session_id: zod
+    .string()
+    .optional()
+    .describe(
+      "Existing session to attach to (for step-up \/ reauth).\nOmit to let the flow create a new session implicitly.\n",
+    ),
+  auth_request_id: zod
+    .string()
+    .optional()
+    .describe("OIDC\/SAML auth request ID (links flow to protocol request)."),
+  redirect_uri: zod.url().optional(),
+  hint: zod
+    .object({
+      login_name: zod
+        .string()
+        .optional()
+        .describe("Auto-submits identifier step (maps to OIDC login_hint)."),
+      team_id: zod.string().optional().describe("Scopes flow resolution to a team."),
+      user_schema_id: zod.string().optional().describe("Scopes to a specific user type."),
+      app_id: zod.string().optional().describe("Scopes to a specific application."),
+    })
+    .optional(),
+});
+
+/**
+ * Returns the current capability step without advancing the state machine.
+Useful for page reloads or re-rendering after a network error.
+
+ * @summary Get current step (re-render)
+ */
+export const GetFlowStepParams = zod.object({
+  id: zod
+    .string()
+    .describe(
+      "Flow ID returned by POST \/flow or the latest POST \/flow\/{id}\/submit.\nUsed to look up the correct flow state from the encrypted cookie,\nwhich can hold multiple concurrent flows. May change between responses\nwhen a flow pivot or pop occurs — always use the `id` from the latest response.\n",
+    ),
+});
+
+export const getFlowStepResponseStepFieldsRequiredDefault = false;
+export const getFlowStepResponseStepFieldsValidationMinLengthMin = 0;
+
+export const getFlowStepResponseStepFieldsValidationMaxLengthMin = 0;
+
+export const getFlowStepResponseStepFieldsDefault = {} as const;
+export const getFlowStepResponseStepActionsPrimaryDefault = false;
+export const getFlowStepResponseStepActionsDefault = {} as const;
+export const getFlowStepResponseStepGatesDefault = {} as const;
+export const getFlowStepResponseStepSsoProvidersDefault = [];
+export const getFlowStepResponseBrandingLayoutDefault = `centered`;
+
+export const GetFlowStepResponse = zod.object({
+  id: zod
+    .string()
+    .describe(
+      "Flow handle. Use this as the path parameter for subsequent\nsubmit\/event calls. May change between responses when a\nflow pivot or pop occurs.\n",
+    ),
+  session_id: zod.string().describe("Underlying session ID. Stable across all stacked flows."),
+  session_token: zod
+    .string()
+    .optional()
+    .describe(
+      "Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today.",
+    ),
+  step: zod
+    .object({
+      name: zod.string().describe("Step name from the flow definition."),
+      texts: zod
+        .object({
+          title_key: zod.string().optional().describe("Localization key for the step heading."),
+          description_key: zod
+            .union([zod.string(), zod.null()])
+            .optional()
+            .describe("Localization key for explanatory text."),
+        })
+        .optional()
+        .describe(
+          "Step-level localization keys. Resolved client-side via the `| t` LiquidJS filter.\nThe backend never sends display text — only semantic keys.\n",
+        ),
+      error: zod
+        .union([zod.string(), zod.null()])
+        .optional()
+        .describe("Error message from a previous failed submission."),
+      complete: zod
+        .enum(["redirect", "show"])
+        .optional()
+        .describe(
+          "Present only on terminal steps. Tells the frontend what to do:\n- redirect: navigate to redirect_uri immediately (OIDC\/SAML done)\n- show: render the step as a success screen (e.g., registration confirmed)\n",
+        ),
+      redirect_url: zod
+        .url()
+        .optional()
+        .describe("URL to navigate to (e.g., SSO provider redirect)."),
+      fields: zod
+        .record(
+          zod.string(),
+          zod
+            .object({
+              type: zod
+                .enum(["text", "email", "password", "tel", "number", "url", "date", "hidden"])
+                .describe(
+                  "The input kind the client should render. Encodes the formats that\nhave a matching HTML input type (email, url, date). For other\nformats (e.g. uuid) the type is `text` and `validation.format`\ncarries the rule.\n",
+                ),
+              text_key: zod.string().describe("Localization key for the field label."),
+              required: zod
+                .boolean()
+                .default(getFlowStepResponseStepFieldsRequiredDefault)
+                .describe(
+                  "The field MUST be present and non-empty on submit. Mirrors the\nschema's top-level `required` array.\n",
+                ),
+              value: zod
+                .unknown()
+                .optional()
+                .describe("Pre-filled value (e.g., an identifier carried over from a pivot)."),
+              validation: zod
+                .object({
+                  format: zod
+                    .enum(["email", "date-time", "uuid", "uri"])
+                    .optional()
+                    .describe(
+                      "Semantic format the value must match. Values mirror the user\nmeta-schema. When `type` already encodes the format (email,\nurl, date), this key is informative and the input type is\nsufficient for client-side validation. When `type` is `text`\n(e.g. `format: uuid`), this key is the only signal.\n",
+                    ),
+                  min_length: zod
+                    .number()
+                    .min(getFlowStepResponseStepFieldsValidationMinLengthMin)
+                    .optional()
+                    .describe("Minimum length in characters (inclusive). Mirrors `minLength`."),
+                  max_length: zod
+                    .number()
+                    .min(getFlowStepResponseStepFieldsValidationMaxLengthMin)
+                    .optional()
+                    .describe("Maximum length in characters (inclusive). Mirrors `maxLength`."),
+                })
+                .optional()
+                .describe(
+                  "Schema-derived rules the frontend SHOULD apply at input time. The\nserver runs the same rules on submit and is the only authority on\nwhether the step advances — these rules are a UX hint to reduce\nround trips, not a contract guarantee.\n\nOmitted entirely when the field has no rules beyond its `type`.\nEach key mirrors a JSON Schema keyword on the underlying user\nproperty; absent keys mean no rule.\n",
+                ),
+            })
+            .describe(
+              "A data input capability. Describes what the user must provide.\nDoes not contain display text — only a `text_key` resolved client-side.\n",
+            ),
+        )
+        .default(getFlowStepResponseStepFieldsDefault)
+        .describe(
+          "Unordered dictionary of input fields to collect. Keyed by field name.\nThe LiquidJS template controls which fields appear and in what order.\nField metadata (type, validation) is resolved by the engine from the\nflow's user schema.\n",
+        ),
+      actions: zod
+        .record(
+          zod.string(),
+          zod
+            .object({
+              primary: zod
+                .boolean()
+                .default(getFlowStepResponseStepActionsPrimaryDefault)
+                .describe(
+                  "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
+                ),
+              text_key: zod
+                .string()
+                .optional()
+                .describe(
+                  "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
+                ),
+            })
+            .describe(
+              "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
+            ),
+        )
+        .default(getFlowStepResponseStepActionsDefault)
+        .describe(
+          "Unordered dictionary of available user actions. Keyed by action name.\nThe LiquidJS template controls positioning and presentation.\n",
+        ),
+      gates: zod
+        .record(
+          zod.string(),
+          zod
+            .object({
+              kind: zod
+                .enum(["captcha"])
+                .describe(
+                  "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
+                ),
+              provider: zod
+                .string()
+                .describe(
+                  "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                ),
+              config: zod
+                .record(zod.string(), zod.unknown())
+                .optional()
+                .describe(
+                  "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                ),
+            })
+            .describe(
+              "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
+            ),
+        )
+        .default(getFlowStepResponseStepGatesDefault)
+        .describe(
+          "Security gates that must be satisfied before the step can be submitted.\nThe engine injects gates dynamically based on policy, even if they\nare not declared in the flow definition.\n",
+        ),
+      sso_providers: zod
+        .array(
+          zod
+            .object({
+              id: zod.string().describe("Provider instance identifier."),
+              name: zod.string().describe("Display name for the provider."),
+              template: zod.string().describe("Template hint for rendering (logo, colors)."),
+            })
+            .describe("An available SSO identity provider."),
+        )
+        .default(getFlowStepResponseStepSsoProvidersDefault)
+        .describe("Available SSO identity providers for this step."),
+      challenge: zod
+        .object({
+          method: zod
+            .enum(["passkey"])
+            .optional()
+            .describe("Challenge method. Determines which component handles the ceremony."),
+          challenge_id: zod
+            .string()
+            .optional()
+            .describe(
+              "Server-side challenge identifier. Included in the proof submission\nso the server can match the response to the original challenge.\n",
+            ),
+          options: zod
+            .record(zod.string(), zod.unknown())
+            .optional()
+            .describe(
+              "Protocol-specific challenge options. For passkey, this is the\n`PublicKeyCredentialRequestOptions` (authenticate) or\n`PublicKeyCredentialCreationOptions` (register). Passed directly\nto the browser's `navigator.credentials` API.\n",
+            ),
+        })
+        .optional()
+        .describe(
+          'A pending authentication challenge issued by the server. Present when the\nflow engine has issued a challenge via auth_attempts (e.g., after the user\nsubmits `action: \"passkey\"`). The `<zl-passkey>` component reads this and\ntriggers the appropriate WebAuthn ceremony.\n\nThe challenge is NOT present on the initial step — it appears only after\nthe user explicitly selects a ceremony-based action.\n',
+        ),
+    })
+    .describe(
+      "A step contains unordered capability dictionaries: what to collect (fields),\nwhat the user can do (actions), and what security gates must be satisfied (gates).\nLayout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.\n",
+    ),
+  branding: zod
+    .object({
+      layout: zod
+        .enum(["centered", "split"])
+        .default(getFlowStepResponseBrandingLayoutDefault)
+        .describe(
+          "Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely.\n",
+        ),
+      liquid_template: zod
+        .string()
+        .optional()
+        .describe(
+          "The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n",
+        ),
+      logo_url: zod.url().optional().describe("Team logo URL."),
+      font_url: zod.url().optional().describe("Custom font URL (e.g., Google Fonts CSS)."),
+      hero_url: zod.url().optional().describe("Hero\/background image URL (used by split layout)."),
+    })
+    .optional()
+    .describe(
+      "Resolved branding configuration. Inherited from the app → team → project\nhierarchy at flow creation time (most specific wins). Read-only projection —\nbranding is configured via the Team\/App Branding API, not the Flow API.\n",
+    ),
+  redirect_uri: zod.url().optional().describe("Present when `step.complete` is `redirect`."),
+  handoff_token: zod
+    .string()
+    .optional()
+    .describe(
+      "Short-lived, audience-bound token produced on flow completion.\nExchange it for a session via `POST \/sessions\/exchange`.\nOnly present when `step.complete` is set.\n",
+    ),
+  handoff_token_expires_at: zod.iso
+    .datetime({ offset: true })
+    .optional()
+    .describe("Expiry timestamp for `handoff_token`. Only present when\n`handoff_token` is set.\n"),
+});
+
+/**
+ * Submits user input for the current step. The server validates,
+processes (e.g., verifies a credential), advances the state machine
+through any invisible steps, and returns the next visible step.
+
+The response sets an updated encrypted `HttpOnly` cookie (`_zflow`)
+with the new flow state. The server is stateless — all orchestration
+state is carried in this cookie between requests.
+
+**Important:** The `id` in the response may differ from the `id` used in
+the request. This happens when a flow pivots (pushes a new flow onto the
+stack) or when a stacked flow completes (auto-pops to the parent flow).
+Always use the `id` from the latest response for the next request.
+
+## Flow completion
+
+When `step.type` is `complete`, the flow is terminal. The `step.behavior`
+field tells the frontend what to do:
+
+| `behavior`   | Action                                                     |
+|------------- |------------------------------------------------------------|
+| `redirect`   | Navigate to `redirect_uri` (OIDC/SAML auth request done). |
+| `show`       | Render the step as a success screen (e.g., registration).  |
+
+A `complete` step is only returned when the **entire flow stack** is done.
+If a stacked flow (e.g., recovery pivoted from login) finishes, the server
+auto-pops to the parent flow and returns the parent's next step — the
+frontend never sees a `complete` for intermediate flows.
+
+ * @summary Submit step data and advance
+ */
+export const SubmitFlowStepParams = zod.object({
+  id: zod
+    .string()
+    .describe(
+      "Flow ID returned by POST \/flow or the latest POST \/flow\/{id}\/submit.\nUsed to look up the correct flow state from the encrypted cookie,\nwhich can hold multiple concurrent flows. May change between responses\nwhen a flow pivot or pop occurs — always use the `id` from the latest response.\n",
+    ),
+});
+
+export const SubmitFlowStepBody = zod.object({
+  session_token: zod
+    .string()
+    .optional()
+    .describe(
+      "Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today.",
+    ),
+  action: zod
+    .string()
+    .describe(
+      'Which action to take. Must be a key from the step\'s `actions` dictionary:\n- A regular action (e.g., \"submit\", \"register\", \"back\")\n- The reserved value \"sso\" — triggers SSO redirect (requires `sso_provider_id`)\n',
+    ),
+  fields: zod
+    .record(zod.string(), zod.unknown())
+    .optional()
+    .describe("User input values. Keys match field names from the step's `fields` dictionary.\n"),
+  gate_proofs: zod
+    .record(zod.string(), zod.string())
+    .optional()
+    .describe(
+      "Solutions for security gates. Keys match gate names from the step's `gates` dictionary.\nThe orchestrator collects these from `<zl-captcha>` component events.\n",
+    ),
+  challenge_response: zod
+    .object({
+      challenge_id: zod
+        .string()
+        .optional()
+        .describe(
+          "The challenge identifier from `step.challenge.challenge_id`.\nMatches the server-side challenge for verification.\n",
+        ),
+      method: zod
+        .string()
+        .optional()
+        .describe("Which auth method this response is for (e.g., 'passkey')."),
+      proof: zod
+        .record(zod.string(), zod.unknown())
+        .optional()
+        .describe(
+          "Method-specific proof payload.\nFor passkeys, this is the WebAuthn JSON serialization of PublicKeyCredential.\n",
+        ),
+    })
+    .optional()
+    .describe(
+      "Response to a pending challenge on the step. Required when the step has a\n`challenge` property (e.g., after submitting a passkey action).\nThe `<zl-passkey>` component populates this after the WebAuthn ceremony.\n",
+    ),
+  sso_provider_id: zod
+    .string()
+    .optional()
+    .describe(
+      'ID of the selected SSO provider (from `sso_providers[].id`).\nRequired when `action` is \"sso\".\n',
+    ),
+});
+
+export const submitFlowStepResponseStepFieldsRequiredDefault = false;
+export const submitFlowStepResponseStepFieldsValidationMinLengthMin = 0;
+
+export const submitFlowStepResponseStepFieldsValidationMaxLengthMin = 0;
+
+export const submitFlowStepResponseStepFieldsDefault = {} as const;
+export const submitFlowStepResponseStepActionsPrimaryDefault = false;
+export const submitFlowStepResponseStepActionsDefault = {} as const;
+export const submitFlowStepResponseStepGatesDefault = {} as const;
+export const submitFlowStepResponseStepSsoProvidersDefault = [];
+export const submitFlowStepResponseBrandingLayoutDefault = `centered`;
+
+export const SubmitFlowStepResponse = zod.object({
+  id: zod
+    .string()
+    .describe(
+      "Flow handle. Use this as the path parameter for subsequent\nsubmit\/event calls. May change between responses when a\nflow pivot or pop occurs.\n",
+    ),
+  session_id: zod.string().describe("Underlying session ID. Stable across all stacked flows."),
+  session_token: zod
+    .string()
+    .optional()
+    .describe(
+      "Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today.",
+    ),
+  step: zod
+    .object({
+      name: zod.string().describe("Step name from the flow definition."),
+      texts: zod
+        .object({
+          title_key: zod.string().optional().describe("Localization key for the step heading."),
+          description_key: zod
+            .union([zod.string(), zod.null()])
+            .optional()
+            .describe("Localization key for explanatory text."),
+        })
+        .optional()
+        .describe(
+          "Step-level localization keys. Resolved client-side via the `| t` LiquidJS filter.\nThe backend never sends display text — only semantic keys.\n",
+        ),
+      error: zod
+        .union([zod.string(), zod.null()])
+        .optional()
+        .describe("Error message from a previous failed submission."),
+      complete: zod
+        .enum(["redirect", "show"])
+        .optional()
+        .describe(
+          "Present only on terminal steps. Tells the frontend what to do:\n- redirect: navigate to redirect_uri immediately (OIDC\/SAML done)\n- show: render the step as a success screen (e.g., registration confirmed)\n",
+        ),
+      redirect_url: zod
+        .url()
+        .optional()
+        .describe("URL to navigate to (e.g., SSO provider redirect)."),
+      fields: zod
+        .record(
+          zod.string(),
+          zod
+            .object({
+              type: zod
+                .enum(["text", "email", "password", "tel", "number", "url", "date", "hidden"])
+                .describe(
+                  "The input kind the client should render. Encodes the formats that\nhave a matching HTML input type (email, url, date). For other\nformats (e.g. uuid) the type is `text` and `validation.format`\ncarries the rule.\n",
+                ),
+              text_key: zod.string().describe("Localization key for the field label."),
+              required: zod
+                .boolean()
+                .default(submitFlowStepResponseStepFieldsRequiredDefault)
+                .describe(
+                  "The field MUST be present and non-empty on submit. Mirrors the\nschema's top-level `required` array.\n",
+                ),
+              value: zod
+                .unknown()
+                .optional()
+                .describe("Pre-filled value (e.g., an identifier carried over from a pivot)."),
+              validation: zod
+                .object({
+                  format: zod
+                    .enum(["email", "date-time", "uuid", "uri"])
+                    .optional()
+                    .describe(
+                      "Semantic format the value must match. Values mirror the user\nmeta-schema. When `type` already encodes the format (email,\nurl, date), this key is informative and the input type is\nsufficient for client-side validation. When `type` is `text`\n(e.g. `format: uuid`), this key is the only signal.\n",
+                    ),
+                  min_length: zod
+                    .number()
+                    .min(submitFlowStepResponseStepFieldsValidationMinLengthMin)
+                    .optional()
+                    .describe("Minimum length in characters (inclusive). Mirrors `minLength`."),
+                  max_length: zod
+                    .number()
+                    .min(submitFlowStepResponseStepFieldsValidationMaxLengthMin)
+                    .optional()
+                    .describe("Maximum length in characters (inclusive). Mirrors `maxLength`."),
+                })
+                .optional()
+                .describe(
+                  "Schema-derived rules the frontend SHOULD apply at input time. The\nserver runs the same rules on submit and is the only authority on\nwhether the step advances — these rules are a UX hint to reduce\nround trips, not a contract guarantee.\n\nOmitted entirely when the field has no rules beyond its `type`.\nEach key mirrors a JSON Schema keyword on the underlying user\nproperty; absent keys mean no rule.\n",
+                ),
+            })
+            .describe(
+              "A data input capability. Describes what the user must provide.\nDoes not contain display text — only a `text_key` resolved client-side.\n",
+            ),
+        )
+        .default(submitFlowStepResponseStepFieldsDefault)
+        .describe(
+          "Unordered dictionary of input fields to collect. Keyed by field name.\nThe LiquidJS template controls which fields appear and in what order.\nField metadata (type, validation) is resolved by the engine from the\nflow's user schema.\n",
+        ),
+      actions: zod
+        .record(
+          zod.string(),
+          zod
+            .object({
+              primary: zod
+                .boolean()
+                .default(submitFlowStepResponseStepActionsPrimaryDefault)
+                .describe(
+                  "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
+                ),
+              text_key: zod
+                .string()
+                .optional()
+                .describe(
+                  "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
+                ),
+            })
+            .describe(
+              "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
+            ),
+        )
+        .default(submitFlowStepResponseStepActionsDefault)
+        .describe(
+          "Unordered dictionary of available user actions. Keyed by action name.\nThe LiquidJS template controls positioning and presentation.\n",
+        ),
+      gates: zod
+        .record(
+          zod.string(),
+          zod
+            .object({
+              kind: zod
+                .enum(["captcha"])
+                .describe(
+                  "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
+                ),
+              provider: zod
+                .string()
+                .describe(
+                  "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                ),
+              config: zod
+                .record(zod.string(), zod.unknown())
+                .optional()
+                .describe(
+                  "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                ),
+            })
+            .describe(
+              "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
+            ),
+        )
+        .default(submitFlowStepResponseStepGatesDefault)
+        .describe(
+          "Security gates that must be satisfied before the step can be submitted.\nThe engine injects gates dynamically based on policy, even if they\nare not declared in the flow definition.\n",
+        ),
+      sso_providers: zod
+        .array(
+          zod
+            .object({
+              id: zod.string().describe("Provider instance identifier."),
+              name: zod.string().describe("Display name for the provider."),
+              template: zod.string().describe("Template hint for rendering (logo, colors)."),
+            })
+            .describe("An available SSO identity provider."),
+        )
+        .default(submitFlowStepResponseStepSsoProvidersDefault)
+        .describe("Available SSO identity providers for this step."),
+      challenge: zod
+        .object({
+          method: zod
+            .enum(["passkey"])
+            .optional()
+            .describe("Challenge method. Determines which component handles the ceremony."),
+          challenge_id: zod
+            .string()
+            .optional()
+            .describe(
+              "Server-side challenge identifier. Included in the proof submission\nso the server can match the response to the original challenge.\n",
+            ),
+          options: zod
+            .record(zod.string(), zod.unknown())
+            .optional()
+            .describe(
+              "Protocol-specific challenge options. For passkey, this is the\n`PublicKeyCredentialRequestOptions` (authenticate) or\n`PublicKeyCredentialCreationOptions` (register). Passed directly\nto the browser's `navigator.credentials` API.\n",
+            ),
+        })
+        .optional()
+        .describe(
+          'A pending authentication challenge issued by the server. Present when the\nflow engine has issued a challenge via auth_attempts (e.g., after the user\nsubmits `action: \"passkey\"`). The `<zl-passkey>` component reads this and\ntriggers the appropriate WebAuthn ceremony.\n\nThe challenge is NOT present on the initial step — it appears only after\nthe user explicitly selects a ceremony-based action.\n',
+        ),
+    })
+    .describe(
+      "A step contains unordered capability dictionaries: what to collect (fields),\nwhat the user can do (actions), and what security gates must be satisfied (gates).\nLayout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.\n",
+    ),
+  branding: zod
+    .object({
+      layout: zod
+        .enum(["centered", "split"])
+        .default(submitFlowStepResponseBrandingLayoutDefault)
+        .describe(
+          "Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely.\n",
+        ),
+      liquid_template: zod
+        .string()
+        .optional()
+        .describe(
+          "The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n",
+        ),
+      logo_url: zod.url().optional().describe("Team logo URL."),
+      font_url: zod.url().optional().describe("Custom font URL (e.g., Google Fonts CSS)."),
+      hero_url: zod.url().optional().describe("Hero\/background image URL (used by split layout)."),
+    })
+    .optional()
+    .describe(
+      "Resolved branding configuration. Inherited from the app → team → project\nhierarchy at flow creation time (most specific wins). Read-only projection —\nbranding is configured via the Team\/App Branding API, not the Flow API.\n",
+    ),
+  redirect_uri: zod.url().optional().describe("Present when `step.complete` is `redirect`."),
+  handoff_token: zod
+    .string()
+    .optional()
+    .describe(
+      "Short-lived, audience-bound token produced on flow completion.\nExchange it for a session via `POST \/sessions\/exchange`.\nOnly present when `step.complete` is set.\n",
+    ),
+  handoff_token_expires_at: zod.iso
+    .datetime({ offset: true })
+    .optional()
+    .describe("Expiry timestamp for `handoff_token`. Only present when\n`handoff_token` is set.\n"),
+});
+
+/**
+ * Submits telemetry or fingerprint data from the frontend.
+Does not advance the state machine. Used for risk evaluation.
+
+ * @summary Submit client-side event
+ */
+export const SubmitFlowEventParams = zod.object({
+  id: zod
+    .string()
+    .describe(
+      "Flow ID returned by POST \/flow or the latest POST \/flow\/{id}\/submit.\nUsed to look up the correct flow state from the encrypted cookie,\nwhich can hold multiple concurrent flows. May change between responses\nwhen a flow pivot or pop occurs — always use the `id` from the latest response.\n",
+    ),
+});
+
+export const SubmitFlowEventBody = zod.object({
+  session_token: zod
+    .string()
+    .optional()
+    .describe(
+      "Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today.",
+    ),
+  type: zod.enum(["fingerprint", "telemetry"]),
+  payload: zod
+    .record(zod.string(), zod.unknown())
+    .optional()
+    .describe("Event payload (fingerprint hash, timing data, etc.)."),
+});
+
+/**
+ * Starts a new authentication attempt. This is the entry point for the auth_attempts state machine.
+
+An attempt is an ephemeral (15-minute TTL) state machine that drives a single authentication round.
+It accepts factor challenges, verifies proofs, and completes into a session or handoff token.
+
+Accepts a project_id and challenge_nonce (from POST /bootstrap/challenge). For step-up re-auth,
+also include session_id to add factors to an existing session.
+
+ * @summary Create a new authentication attempt
+ */
+export const createAuthAttemptBodyProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const createAuthAttemptBodySessionIdOneRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const CreateAuthAttemptBody = zod
+  .object({
+    project_id: zod.string().regex(createAuthAttemptBodyProjectIdRegExp),
+    challenge_nonce: zod
+      .string()
+      .optional()
+      .describe(
+        "Origin-bound, single-use nonce obtained from `POST \/bootstrap\/challenge`.\nBinds the request to the browser that initiated the flow, preventing\ncross-origin replay.\n",
+      ),
+    session_id: zod
+      .union([
+        zod
+          .string()
+          .regex(createAuthAttemptBodySessionIdOneRegExp)
+          .describe("Unique identifier for this session."),
+        zod.null(),
+      ])
+      .optional()
+      .describe(
+        "Optional. If provided, this attempt adds factors to an existing session (step-up auth).\nIf omitted, a new session is created implicitly on successful handoff.\n",
+      ),
+  })
+  .describe("Request to create a new authentication attempt");
+
+/**
+ * Polls the current state of an authentication attempt.
+
+Returns the attempt's state, available factors for the next challenge,
+challenges issued so far, and any errors preventing progress.
+
+Use this for polling during long-running factor verifications (e.g., waiting for
+a federated IdP callback or a device flow).
+
+ * @summary Get authentication attempt state
+ */
+export const getAuthAttemptPathAttemptIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const GetAuthAttemptParams = zod.object({
+  attempt_id: zod
+    .string()
+    .regex(getAuthAttemptPathAttemptIdRegExp)
+    .describe("The unique identifier of the authentication attempt"),
+});
+
+export const getAuthAttemptResponseAttemptIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getAuthAttemptResponseProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getAuthAttemptResponseSessionIdOneRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getAuthAttemptResponseUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+export const getAuthAttemptResponseCompletedFactorsItemPayloadOneUserIdRegExp = new RegExp(
+  "^user_[a-zA-Z0-9_-]+$",
+);
+export const getAuthAttemptResponseChallengesItemChallengeIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const GetAuthAttemptResponse = zod
+  .object({
+    attempt_id: zod
+      .string()
+      .regex(getAuthAttemptResponseAttemptIdRegExp)
+      .describe("Unique identifier for this authentication attempt"),
+    project_id: zod.string().regex(getAuthAttemptResponseProjectIdRegExp),
+    state: zod
+      .enum(["in_progress", "completed", "failed", "expired"])
+      .describe(
+        "Overall state of the authentication attempt:\n- `in_progress`: factors are still being collected; continue issuing challenges.\n- `completed`: all required factors have been verified; the attempt is ready for handoff.\n- `failed`: the attempt has failed (e.g. too many failed proofs) and cannot be continued.\n- `expired`: the 15-minute TTL has been exceeded.\n",
+      ),
+    session_id: zod
+      .union([
+        zod
+          .string()
+          .regex(getAuthAttemptResponseSessionIdOneRegExp)
+          .describe("Unique identifier for this session."),
+        zod.null(),
+      ])
+      .optional()
+      .describe(
+        "The session being authenticated into. Either newly created or passed in on POST.\nFor step-up (re-auth), this is the existing session_id provided on creation.\n",
+      ),
+    user_id: zod
+      .union([zod.string().regex(getAuthAttemptResponseUserIdOneRegExp), zod.null()])
+      .optional()
+      .describe(
+        "The user ID, if known at this point in the flow.\nNull until an identifier challenge has been verified.\n",
+      ),
+    required_factors: zod
+      .array(
+        zod
+          .enum(["identifier", "password", "passkey"])
+          .describe("An authentication factor method."),
+      )
+      .optional()
+      .describe(
+        "The authentication factor methods that the project policy requires in order\nto complete this attempt. Computed by the server from the project's auth policy.\nClients should use this to determine which challenges still need to be issued.\n",
+      ),
+    completed_factors: zod
+      .array(
+        zod
+          .object({
+            method: zod
+              .enum(["identifier", "password", "passkey"])
+              .describe("An authentication factor method."),
+            verified_at: zod.iso
+              .datetime({ offset: true })
+              .describe("When this factor was successfully verified"),
+            payload: zod
+              .union([
+                zod
+                  .object({
+                    user_id: zod
+                      .string()
+                      .regex(getAuthAttemptResponseCompletedFactorsItemPayloadOneUserIdRegExp),
+                  })
+                  .describe("Identifier-specific factor metadata"),
+                zod
+                  .object({})
+                  .describe(
+                    "Password authentication has no additional metadata beyond the base factor fields",
+                  ),
+                zod
+                  .object({
+                    credential_id: zod.string().describe("The credential ID that was used"),
+                    user_verified: zod
+                      .boolean()
+                      .describe("Whether user verification was performed (PIN\/biometric)"),
+                    backup_eligible: zod
+                      .boolean()
+                      .optional()
+                      .describe("Whether the credential is backup eligible (can be synced)"),
+                    backup_state: zod
+                      .boolean()
+                      .optional()
+                      .describe("Whether the credential is currently backed up"),
+                    authenticator_attachment: zod
+                      .enum(["platform", "cross-platform"])
+                      .optional()
+                      .describe("Authenticator attachment modality"),
+                  })
+                  .describe(
+                    "Passkey-specific factor metadata including credential and verification details",
+                  ),
+              ])
+              .optional()
+              .describe(
+                "Method-specific factor metadata. Structure depends on the `method` field.\n- `identifier`: includes user_id\n- `password`: no additional data\n- `passkey`: includes credential details and verification flags\n",
+              ),
+          })
+          .describe(
+            "A successfully verified authentication factor with verification metadata.\nMethod-specific details are included in the `payload` field.\n",
+          ),
+      )
+      .optional()
+      .describe(
+        "The factors that have been successfully verified in this attempt so far.\nEach item includes method-specific metadata in the payload field.\n\nThe flow engine uses verified_at timestamps to enforce time-based policies, such as\nrequiring password verification within the last 5 minutes for step-up auth to\naccess sensitive operations.\n\nA factor appears here once its challenge reaches `verified` state.\n",
+      ),
+    challenges: zod
+      .array(
+        zod
+          .object({
+            challenge_id: zod
+              .string()
+              .regex(getAuthAttemptResponseChallengesItemChallengeIdRegExp)
+              .describe("Unique identifier for this challenge"),
+            method: zod
+              .enum(["identifier", "password", "passkey"])
+              .describe("An authentication factor method."),
+            state: zod
+              .enum(["pending", "failed", "expired"])
+              .describe(
+                "Current state of this challenge:\n- `pending`: awaiting proof submission\n- `failed`: proof rejected (invalid credential, wrong code, etc.)\n- `expired`: challenge TTL exceeded without verification\n",
+              ),
+            created_at: zod.iso
+              .datetime({ offset: true })
+              .describe("When this challenge was issued"),
+            expires_at: zod
+              .union([zod.iso.datetime({ offset: true }), zod.null()])
+              .optional()
+              .describe("When this challenge expires"),
+            payload: zod
+              .union([
+                zod
+                  .object({})
+                  .describe(
+                    "Identifier challenge has no additional data beyond base challenge fields",
+                  ),
+                zod
+                  .object({})
+                  .describe(
+                    "Password challenge has no additional data beyond base challenge fields",
+                  ),
+                zod
+                  .object({
+                    public_key: zod
+                      .object({
+                        challenge: zod.string().describe("Base64-encoded WebAuthn challenge"),
+                        allowed_credentials: zod
+                          .array(
+                            zod.object({
+                              id: zod.string().describe("Base64-encoded credential ID"),
+                              type: zod.enum(["public-key"]),
+                            }),
+                          )
+                          .optional()
+                          .describe(
+                            "List of credential IDs that can be used for this authentication",
+                          ),
+                        user_verification: zod
+                          .enum(["required", "preferred", "discouraged"])
+                          .optional()
+                          .describe("User verification requirement for this challenge"),
+                        rp_id: zod.string().optional().describe("Relying Party ID for WebAuthn"),
+                      })
+                      .describe(
+                        "Contains the options for the Assertion Generation (dictionary PublicKeyCredentialRequestOptions).\nSee also: https:\/\/www.w3.org\/TR\/webauthn\/#dictdef-publickeycredentialrequestoptions\n",
+                      ),
+                  })
+                  .describe("WebAuthn-specific challenge data for passkey authentication"),
+              ])
+              .optional()
+              .describe(
+                "Method-specific challenge data. Structure depends on the `method` field.\n- `identifier`, `password`: null (no additional data needed)\n- `passkey`: WebAuthn challenge and credential options\n- `idp`: Authorization URL and provider information\n",
+              ),
+          })
+          .describe(
+            "A factor challenge issued within an authentication attempt.\n\nA challenge presents a single-factor verification prompt (password entry, TOTP code, passkey assertion, etc.).\nThe client verifies the proof by POST \/auth_attempts\/{attempt_id}\/challenges\/{challenge_id}\/verify.\n",
+          ),
+      )
+      .optional()
+      .describe(
+        "All challenges issued within this attempt, in creation order.\nUse this to track the state of each factor challenge (pending, verified, failed, expired).\n",
+      ),
+    expires_at: zod.iso
+      .datetime({ offset: true })
+      .optional()
+      .describe("When this attempt expires (15-minute TTL from creation)"),
+    created_at: zod.iso.datetime({ offset: true }).describe("When this attempt was created"),
+  })
+  .describe(
+    "The current state of an authentication attempt.\n\nAn attempt is an ephemeral state machine (15-minute TTL) that drives a single authentication round.\nIt accepts factor challenges, verifies proofs, and completes into a handoff token.\nClients drive the attempt by:\n1. Issuing challenges: POST \/auth_attempts\/{attempt_id}\/challenges\n2. Verifying proofs: POST \/auth_attempts\/{attempt_id}\/challenges\/{challenge_id}\/verify\n3. Completing: POST \/auth_attempts\/{attempt_id}\/handoff\n",
+  );
+
+/**
+ * Issues a single-factor verification challenge within an auth attempt.
+
+This advances the authentication state machine by requesting a specific factor method
+(password, passkey, TOTP, OTP via SMS, etc.). The server responds with challenge details
+including method, metadata, and any UI hints. The client then verifies the proof
+by calling POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.
+
+ * @summary Issue a factor challenge
+ */
+export const issueChallengePathAttemptIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const IssueChallengeParams = zod.object({
+  attempt_id: zod
+    .string()
+    .regex(issueChallengePathAttemptIdRegExp)
+    .describe("The unique identifier of the authentication attempt"),
+});
+
+export const IssueChallengeBody = zod
+  .object({
+    method: zod
+      .enum(["identifier", "password", "passkey"])
+      .describe("An authentication factor method."),
+    passkey_options: zod
+      .object({
+        rp_id: zod
+          .string()
+          .optional()
+          .describe(
+            "Relying Party ID for WebAuthn. Optional; if not provided, the server may use a default value.",
+          ),
+        rp_origins: zod
+          .array(zod.url())
+          .optional()
+          .describe(
+            "List of allowed origins for this WebAuthn challenge. Optional; if not provided, the server may use a default value.",
+          ),
+        user_verification: zod.enum(["required", "preferred", "discouraged"]).optional(),
+      })
+      .optional()
+      .describe("Optional WebAuthn ceremony options. Only relevant when `method` is `passkey`."),
+  })
+  .describe(
+    "Request to issue a factor challenge.\n\nThe `method` field selects which factor to challenge. Additional fields are\nonly relevant for specific methods:\n- `passkey_options` is optional and only used when `method` is `passkey`.\n- `idp_provider` is required when `method` is `idp` and must be omitted otherwise.\n  This conditional requirement is enforced server-side.\n",
+  );
+
+/**
+ * Submits a proof (credential, code, assertion) to verify a factor challenge.
+
+The proof format depends on the challenge method. For example:
+- `password` method: { password: "…" }
+- `totp` method: { totp: { code: "123456" } }
+- `passkey` method: { passkey: { assertion: "…" } }
+- `recovery_code` method: { recovery_code: "…" }
+
+On successful verification, the factor is written to the auth attempt.
+The attempt moves to the next pending challenge or completes if all required factors are verified.
+
+ * @summary Verify a factor proof
+ */
+export const verifyChallengeProofPathAttemptIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const verifyChallengeProofPathChallengeIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const VerifyChallengeProofParams = zod.object({
+  attempt_id: zod
+    .string()
+    .regex(verifyChallengeProofPathAttemptIdRegExp)
+    .describe("The unique identifier of the authentication attempt"),
+  challenge_id: zod
+    .string()
+    .regex(verifyChallengeProofPathChallengeIdRegExp)
+    .describe("The unique identifier of this challenge."),
+});
+
+export const VerifyChallengeProofHeader = zod.strictObject({
+  "Idempotency-Key": zod
+    .string()
+    .optional()
+    .describe(
+      "Optional retry key for safe retries of the call.\nRetries carrying the same key within the call window return the cached\npayload without creating a new resource. See details in the endpoint description.\n",
+    ),
+});
+
+export const VerifyChallengeProofBody = zod
+  .union([
+    zod
+      .object({
+        login_name: zod.string().describe("The login name or email being identified"),
+      })
+      .describe("Proof for `identifier` method"),
+    zod
+      .object({
+        password: zod.string().describe("The password being verified"),
+      })
+      .describe("Proof for `password` method"),
+    zod
+      .object({
+        passkey: zod
+          .object({
+            assertion: zod
+              .record(zod.string(), zod.unknown())
+              .describe("The WebAuthn AssertionResponse object"),
+          })
+          .describe("WebAuthn passkey assertion"),
+      })
+      .describe("Proof for `passkey` method"),
+  ])
+  .describe(
+    "Proof for verifying a factor challenge.\n\nThe exact format depends on the challenge method. The proof object should contain\nonly the credential\/code\/assertion relevant to the challenge method being verified.\n",
+  );
+
+export const verifyChallengeProofResponseAttemptIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const verifyChallengeProofResponseProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const verifyChallengeProofResponseSessionIdOneRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const verifyChallengeProofResponseUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+export const verifyChallengeProofResponseCompletedFactorsItemPayloadOneUserIdRegExp = new RegExp(
+  "^user_[a-zA-Z0-9_-]+$",
+);
+export const verifyChallengeProofResponseChallengesItemChallengeIdRegExp = new RegExp(
+  "^[a-zA-Z0-9_-]+$",
+);
+
+export const VerifyChallengeProofResponse = zod
+  .object({
+    attempt_id: zod
+      .string()
+      .regex(verifyChallengeProofResponseAttemptIdRegExp)
+      .describe("Unique identifier for this authentication attempt"),
+    project_id: zod.string().regex(verifyChallengeProofResponseProjectIdRegExp),
+    state: zod
+      .enum(["in_progress", "completed", "failed", "expired"])
+      .describe(
+        "Overall state of the authentication attempt:\n- `in_progress`: factors are still being collected; continue issuing challenges.\n- `completed`: all required factors have been verified; the attempt is ready for handoff.\n- `failed`: the attempt has failed (e.g. too many failed proofs) and cannot be continued.\n- `expired`: the 15-minute TTL has been exceeded.\n",
+      ),
+    session_id: zod
+      .union([
+        zod
+          .string()
+          .regex(verifyChallengeProofResponseSessionIdOneRegExp)
+          .describe("Unique identifier for this session."),
+        zod.null(),
+      ])
+      .optional()
+      .describe(
+        "The session being authenticated into. Either newly created or passed in on POST.\nFor step-up (re-auth), this is the existing session_id provided on creation.\n",
+      ),
+    user_id: zod
+      .union([zod.string().regex(verifyChallengeProofResponseUserIdOneRegExp), zod.null()])
+      .optional()
+      .describe(
+        "The user ID, if known at this point in the flow.\nNull until an identifier challenge has been verified.\n",
+      ),
+    required_factors: zod
+      .array(
+        zod
+          .enum(["identifier", "password", "passkey"])
+          .describe("An authentication factor method."),
+      )
+      .optional()
+      .describe(
+        "The authentication factor methods that the project policy requires in order\nto complete this attempt. Computed by the server from the project's auth policy.\nClients should use this to determine which challenges still need to be issued.\n",
+      ),
+    completed_factors: zod
+      .array(
+        zod
+          .object({
+            method: zod
+              .enum(["identifier", "password", "passkey"])
+              .describe("An authentication factor method."),
+            verified_at: zod.iso
+              .datetime({ offset: true })
+              .describe("When this factor was successfully verified"),
+            payload: zod
+              .union([
+                zod
+                  .object({
+                    user_id: zod
+                      .string()
+                      .regex(
+                        verifyChallengeProofResponseCompletedFactorsItemPayloadOneUserIdRegExp,
+                      ),
+                  })
+                  .describe("Identifier-specific factor metadata"),
+                zod
+                  .object({})
+                  .describe(
+                    "Password authentication has no additional metadata beyond the base factor fields",
+                  ),
+                zod
+                  .object({
+                    credential_id: zod.string().describe("The credential ID that was used"),
+                    user_verified: zod
+                      .boolean()
+                      .describe("Whether user verification was performed (PIN\/biometric)"),
+                    backup_eligible: zod
+                      .boolean()
+                      .optional()
+                      .describe("Whether the credential is backup eligible (can be synced)"),
+                    backup_state: zod
+                      .boolean()
+                      .optional()
+                      .describe("Whether the credential is currently backed up"),
+                    authenticator_attachment: zod
+                      .enum(["platform", "cross-platform"])
+                      .optional()
+                      .describe("Authenticator attachment modality"),
+                  })
+                  .describe(
+                    "Passkey-specific factor metadata including credential and verification details",
+                  ),
+              ])
+              .optional()
+              .describe(
+                "Method-specific factor metadata. Structure depends on the `method` field.\n- `identifier`: includes user_id\n- `password`: no additional data\n- `passkey`: includes credential details and verification flags\n",
+              ),
+          })
+          .describe(
+            "A successfully verified authentication factor with verification metadata.\nMethod-specific details are included in the `payload` field.\n",
+          ),
+      )
+      .optional()
+      .describe(
+        "The factors that have been successfully verified in this attempt so far.\nEach item includes method-specific metadata in the payload field.\n\nThe flow engine uses verified_at timestamps to enforce time-based policies, such as\nrequiring password verification within the last 5 minutes for step-up auth to\naccess sensitive operations.\n\nA factor appears here once its challenge reaches `verified` state.\n",
+      ),
+    challenges: zod
+      .array(
+        zod
+          .object({
+            challenge_id: zod
+              .string()
+              .regex(verifyChallengeProofResponseChallengesItemChallengeIdRegExp)
+              .describe("Unique identifier for this challenge"),
+            method: zod
+              .enum(["identifier", "password", "passkey"])
+              .describe("An authentication factor method."),
+            state: zod
+              .enum(["pending", "failed", "expired"])
+              .describe(
+                "Current state of this challenge:\n- `pending`: awaiting proof submission\n- `failed`: proof rejected (invalid credential, wrong code, etc.)\n- `expired`: challenge TTL exceeded without verification\n",
+              ),
+            created_at: zod.iso
+              .datetime({ offset: true })
+              .describe("When this challenge was issued"),
+            expires_at: zod
+              .union([zod.iso.datetime({ offset: true }), zod.null()])
+              .optional()
+              .describe("When this challenge expires"),
+            payload: zod
+              .union([
+                zod
+                  .object({})
+                  .describe(
+                    "Identifier challenge has no additional data beyond base challenge fields",
+                  ),
+                zod
+                  .object({})
+                  .describe(
+                    "Password challenge has no additional data beyond base challenge fields",
+                  ),
+                zod
+                  .object({
+                    public_key: zod
+                      .object({
+                        challenge: zod.string().describe("Base64-encoded WebAuthn challenge"),
+                        allowed_credentials: zod
+                          .array(
+                            zod.object({
+                              id: zod.string().describe("Base64-encoded credential ID"),
+                              type: zod.enum(["public-key"]),
+                            }),
+                          )
+                          .optional()
+                          .describe(
+                            "List of credential IDs that can be used for this authentication",
+                          ),
+                        user_verification: zod
+                          .enum(["required", "preferred", "discouraged"])
+                          .optional()
+                          .describe("User verification requirement for this challenge"),
+                        rp_id: zod.string().optional().describe("Relying Party ID for WebAuthn"),
+                      })
+                      .describe(
+                        "Contains the options for the Assertion Generation (dictionary PublicKeyCredentialRequestOptions).\nSee also: https:\/\/www.w3.org\/TR\/webauthn\/#dictdef-publickeycredentialrequestoptions\n",
+                      ),
+                  })
+                  .describe("WebAuthn-specific challenge data for passkey authentication"),
+              ])
+              .optional()
+              .describe(
+                "Method-specific challenge data. Structure depends on the `method` field.\n- `identifier`, `password`: null (no additional data needed)\n- `passkey`: WebAuthn challenge and credential options\n- `idp`: Authorization URL and provider information\n",
+              ),
+          })
+          .describe(
+            "A factor challenge issued within an authentication attempt.\n\nA challenge presents a single-factor verification prompt (password entry, TOTP code, passkey assertion, etc.).\nThe client verifies the proof by POST \/auth_attempts\/{attempt_id}\/challenges\/{challenge_id}\/verify.\n",
+          ),
+      )
+      .optional()
+      .describe(
+        "All challenges issued within this attempt, in creation order.\nUse this to track the state of each factor challenge (pending, verified, failed, expired).\n",
+      ),
+    expires_at: zod.iso
+      .datetime({ offset: true })
+      .optional()
+      .describe("When this attempt expires (15-minute TTL from creation)"),
+    created_at: zod.iso.datetime({ offset: true }).describe("When this attempt was created"),
+  })
+  .describe(
+    "The current state of an authentication attempt.\n\nAn attempt is an ephemeral state machine (15-minute TTL) that drives a single authentication round.\nIt accepts factor challenges, verifies proofs, and completes into a handoff token.\nClients drive the attempt by:\n1. Issuing challenges: POST \/auth_attempts\/{attempt_id}\/challenges\n2. Verifying proofs: POST \/auth_attempts\/{attempt_id}\/challenges\/{challenge_id}\/verify\n3. Completing: POST \/auth_attempts\/{attempt_id}\/handoff\n",
+  );
+
+/**
+ * Completes the authentication attempt and mints a `handoff_token`.
+
+Call this after all required factors have been verified and the attempt is in `completed` state.
+The handoff token is short-lived (≤60 seconds) and must be exchanged at
+POST /sessions/exchange to receive the final session and session_token.
+
+The handoff token is:
+- Single-use (atomic exchange, no retry)
+- Audience-bound (requires matching project key for exchange)
+- Idempotency-safe within a 5-minute window (see conventions)
+
+ * @summary Complete authentication and create handoff token
+ */
+export const createHandoffPathAttemptIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const CreateHandoffParams = zod.object({
+  attempt_id: zod
+    .string()
+    .regex(createHandoffPathAttemptIdRegExp)
+    .describe("The unique identifier of the authentication attempt"),
+});
+
+export const CreateHandoffHeader = zod.strictObject({
+  "Idempotency-Key": zod
+    .string()
+    .optional()
+    .describe(
+      "Optional retry key for safe retries of the call.\nRetries carrying the same key within the call window return the cached\npayload without creating a new resource. See details in the endpoint description.\n",
+    ),
+});
+
+export const CreateHandoffResponse = zod
+  .object({
+    handoff_token: zod
+      .string()
+      .describe(
+        "The short-lived handoff token for session exchange.\n\nExchange at: POST \/sessions\/exchange\n\nRequirements:\n- Single-use (atomic GETDEL on exchange)\n- TTL ≤ 60 seconds\n- Audience-bound to project (exchange requires sk_proj_… for matching project)\n- Idempotency-safe (Category B, 5-minute window)\n",
+      ),
+    expires_at: zod.iso.datetime({ offset: true }).describe("When this handoff token expires"),
+  })
+  .describe(
+    "The handoff token and metadata for session exchange.\n\nThis is a short-lived credential (TTL ≤ 60 seconds) that the client must exchange\nat POST \/sessions\/exchange to receive the final session and session_token.\nThe handoff token is single-use and audience-bound to the project.\n",
+  );
+
+/**
+ * @summary Create project
+ */
+export const CreateProjectBody = zod.object({
+  previewOrigins: zod
+    .array(zod.string())
+    .optional()
+    .describe("Origins which are allowed for previewing and testing the project.\n"),
+});
+
+/**
+ * Returns the current state of a project.
+
+ * @summary Get project
+ */
+export const getProjectPathProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const GetProjectParams = zod.object({
+  project_id: zod.string().regex(getProjectPathProjectIdRegExp),
+});
+
+export const GetProjectResponse = zod
+  .object({
+    id: zod.string().describe("The unique identifier of the project."),
+    createdAt: zod.iso
+      .datetime({ offset: true })
+      .describe("The time when the project was created."),
+    updatedAt: zod.iso
+      .datetime({ offset: true })
+      .describe("The time when the project was last updated."),
+  })
+  .describe("The current state of a project.");
+
+/**
+ * Creates an anonymous session shell with no user and no factors (`state: building`).
+
+This is optional — an `auth_attempt` will create a session implicitly if none is provided.
+Use this explicitly when you want to:
+- Pre-allocate a `session_id` before the user is known, so device/telemetry signals
+  can be correlated with the eventual authenticated session from the start.
+- Track anonymous state (bot detection, device fingerprint) that survives until authentication.
+
+The returned `session_token` authorises GET and DELETE on this session.
+It is superseded when a handoff exchange completes — clients must replace it at that point.
+
+Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
+full session TTL when the first authentication factor is written via a completing `auth_attempt`.
+
+ * @summary Create an anonymous session shell
+ */
+export const createSessionBodyProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const CreateSessionBody = zod
+  .object({
+    project_id: zod.string().regex(createSessionBodyProjectIdRegExp),
+    user_agent: zod
+      .object({
+        fingerprint: zod.string().optional().describe("Client-supplied device fingerprint."),
+        ip: zod.string().optional().describe("IP address of the client."),
+      })
+      .optional()
+      .describe(
+        "Optional user agent \/ device context to attach to the session.\nUseful for correlating telemetry and device signals with the eventual\nauthenticated session from the start.\n",
+      ),
+  })
+  .describe("Request to create an anonymous session shell.");
+
+/**
+ * Returns a paginated list of sessions for a project.
+Requires a project service key (OAuth2 client credentials).
+
+ * @summary List sessions
+ */
+export const listSessionsQueryLimitDefault = 20;
+export const listSessionsQueryLimitMax = 100;
+
+export const listSessionsQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const listSessionsQueryUserIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+
+export const ListSessionsQueryParams = zod.strictObject({
+  limit: zod
+    .number()
+    .min(1)
+    .max(listSessionsQueryLimitMax)
+    .default(listSessionsQueryLimitDefault)
+    .describe("Maximum number of items to return."),
+  page_token: zod
+    .string()
+    .optional()
+    .describe(
+      "Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n",
+    ),
+  project_id: zod
+    .string()
+    .regex(listSessionsQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+  state: zod
+    .enum(["building", "active", "expired", "revoked"])
+    .optional()
+    .describe("Filter sessions by lifecycle state."),
+  user_id: zod
+    .string()
+    .regex(listSessionsQueryUserIdRegExp)
+    .optional()
+    .describe("Filter sessions by user."),
+});
+
+export const listSessionsResponseSessionsItemSessionIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const listSessionsResponseSessionsItemProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const listSessionsResponseSessionsItemUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+export const listSessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp = new RegExp(
+  "^user_[a-zA-Z0-9_-]+$",
+);
+
+export const ListSessionsResponse = zod
+  .object({
+    sessions: zod.array(
+      zod
+        .object({
+          session_id: zod
+            .string()
+            .regex(listSessionsResponseSessionsItemSessionIdRegExp)
+            .describe("Unique identifier for this session."),
+          project_id: zod.string().regex(listSessionsResponseSessionsItemProjectIdRegExp),
+          state: zod
+            .enum(["building", "active", "expired", "revoked"])
+            .describe(
+              "Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n- `revoked`: explicitly revoked via DELETE\n",
+            ),
+          user_id: zod
+            .union([
+              zod.string().regex(listSessionsResponseSessionsItemUserIdOneRegExp),
+              zod.null(),
+            ])
+            .optional()
+            .describe(
+              "The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n",
+            ),
+          factors: zod
+            .array(
+              zod
+                .object({
+                  method: zod
+                    .enum(["identifier", "password", "passkey"])
+                    .describe("An authentication factor method."),
+                  verified_at: zod.iso
+                    .datetime({ offset: true })
+                    .describe("When this factor was successfully verified"),
+                  payload: zod
+                    .union([
+                      zod
+                        .object({
+                          user_id: zod
+                            .string()
+                            .regex(
+                              listSessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp,
+                            ),
+                        })
+                        .describe("Identifier-specific factor metadata"),
+                      zod
+                        .object({})
+                        .describe(
+                          "Password authentication has no additional metadata beyond the base factor fields",
+                        ),
+                      zod
+                        .object({
+                          credential_id: zod.string().describe("The credential ID that was used"),
+                          user_verified: zod
+                            .boolean()
+                            .describe("Whether user verification was performed (PIN\/biometric)"),
+                          backup_eligible: zod
+                            .boolean()
+                            .optional()
+                            .describe("Whether the credential is backup eligible (can be synced)"),
+                          backup_state: zod
+                            .boolean()
+                            .optional()
+                            .describe("Whether the credential is currently backed up"),
+                          authenticator_attachment: zod
+                            .enum(["platform", "cross-platform"])
+                            .optional()
+                            .describe("Authenticator attachment modality"),
+                        })
+                        .describe(
+                          "Passkey-specific factor metadata including credential and verification details",
+                        ),
+                    ])
+                    .optional()
+                    .describe(
+                      "Method-specific factor metadata. Structure depends on the `method` field.\n- `identifier`: includes user_id\n- `password`: no additional data\n- `passkey`: includes credential details and verification flags\n",
+                    ),
+                })
+                .describe(
+                  "A successfully verified authentication factor with verification metadata.\nMethod-specific details are included in the `payload` field.\n",
+                ),
+            )
+            .describe(
+              "Verified authentication factors accumulated by this session.\nEach key is a factor type (e.g. `password`, `totp`, `passkey`).\nEach value is a factor event object with at least `verified_at` and\nmethod-specific properties (e.g. `user_verified`, `hardware` for passkeys).\n",
+            ),
+          assurance_levels: zod
+            .array(zod.string())
+            .optional()
+            .describe(
+              'All assurance levels whose schemas the current session factors satisfy.\nThis list shrinks as factor freshness windows expire and grows when step-up\nauth_attempts add or refresh factors.\nWhether any level is \"enough\" is determined by the request context, not the session.\n',
+            ),
+          metadata: zod
+            .union([zod.record(zod.string(), zod.unknown()), zod.null()])
+            .optional()
+            .describe("Arbitrary key\/value metadata attached to the session."),
+          user_agent: zod
+            .union([
+              zod.object({
+                fingerprint: zod
+                  .string()
+                  .optional()
+                  .describe("Client-supplied device fingerprint."),
+                ip: zod
+                  .string()
+                  .optional()
+                  .describe("IP address of the client at session creation."),
+              }),
+              zod.null(),
+            ])
+            .optional()
+            .describe("User agent information captured at session creation."),
+          created_at: zod.iso.datetime({ offset: true }).describe("When this session was created."),
+          expires_at: zod.iso
+            .datetime({ offset: true })
+            .describe(
+              "When this session expires. Short TTL (10 min) for anonymous sessions;\nreset to the full configured session TTL once the first authentication factor is written.\n",
+            ),
+        })
+        .describe(
+          "The current state of a session.\n\nA session is the durable post-auth primitive. It accumulates verified authentication\nfactors and exposes `assurance_levels[]` — the set of assurance profiles its current\nfactors satisfy. Sessions are read-only from the client's perspective: factors flow\nin through `auth_attempts`.\n",
+        ),
+    ),
+    next_page_token: zod
+      .union([zod.string(), zod.null()])
+      .optional()
+      .describe(
+        "Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results.\n",
+      ),
+  })
+  .describe("Paginated list of sessions.");
+
+/**
+ * Consumes a one-time `handoff_token` minted by `POST /auth_attempts/{id}/handoff`
+and returns the resulting session and a `session_token`.
+
+The server resolves the originating `auth_attempt` from the token and then:
+
+| Originating auth_attempt | Outcome |
+|---|---|
+| No `session_id` | A new authenticated session is **created**. |
+| `session_id` points to an anonymous shell | Existing session is **upgraded** — user and factors written in, TTL reset to full session TTL. |
+| `session_id` points to an active session (step-up) | Existing session is **upgraded** — new factors merged, `assurance_levels[]` expanded. |
+
+The response shape is identical in all three cases.
+
+The `session_token` supersedes any previously issued `session_token` for the same session.
+Clients must replace their stored token at this point.
+
+Requires a project service key (OAuth2 client credentials).
+
+ * @summary Exchange handoff token for a session
+ */
+export const exchangeHandoffQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const ExchangeHandoffQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(exchangeHandoffQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+export const ExchangeHandoffHeader = zod.strictObject({
+  "Idempotency-Key": zod
+    .string()
+    .optional()
+    .describe(
+      "Optional retry key for safe retries of the call.\nRetries carrying the same key within the call window return the cached\npayload without creating a new resource. See details in the endpoint description.\n",
+    ),
+});
+
+export const ExchangeHandoffBody = zod
+  .object({
+    handoff_token: zod
+      .string()
+      .describe(
+        "The one-time handoff token minted by `POST \/auth_attempts\/{id}\/handoff`.\nSingle-use — replaying it after a successful exchange returns `410 Gone`.\n",
+      ),
+    ttl: zod
+      .string()
+      .optional()
+      .describe(
+        "Optional session lifetime after exchange as an ISO-8601 duration. When omitted, the server\nuses the configured default. Must not exceed the configured maximum.\n",
+      ),
+  })
+  .describe("Request to exchange a handoff token for a session and session_token.");
+
+export const exchangeHandoffResponseSessionSessionIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const exchangeHandoffResponseSessionProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const exchangeHandoffResponseSessionUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+export const exchangeHandoffResponseSessionFactorsItemPayloadOneUserIdRegExp = new RegExp(
+  "^user_[a-zA-Z0-9_-]+$",
+);
+
+export const ExchangeHandoffResponse = zod
+  .object({
+    session: zod
+      .object({
+        session_id: zod
+          .string()
+          .regex(exchangeHandoffResponseSessionSessionIdRegExp)
+          .describe("Unique identifier for this session."),
+        project_id: zod.string().regex(exchangeHandoffResponseSessionProjectIdRegExp),
+        state: zod
+          .enum(["building", "active", "expired", "revoked"])
+          .describe(
+            "Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n- `revoked`: explicitly revoked via DELETE\n",
+          ),
+        user_id: zod
+          .union([zod.string().regex(exchangeHandoffResponseSessionUserIdOneRegExp), zod.null()])
+          .optional()
+          .describe(
+            "The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n",
+          ),
+        factors: zod
+          .array(
+            zod
+              .object({
+                method: zod
+                  .enum(["identifier", "password", "passkey"])
+                  .describe("An authentication factor method."),
+                verified_at: zod.iso
+                  .datetime({ offset: true })
+                  .describe("When this factor was successfully verified"),
+                payload: zod
+                  .union([
+                    zod
+                      .object({
+                        user_id: zod
+                          .string()
+                          .regex(exchangeHandoffResponseSessionFactorsItemPayloadOneUserIdRegExp),
+                      })
+                      .describe("Identifier-specific factor metadata"),
+                    zod
+                      .object({})
+                      .describe(
+                        "Password authentication has no additional metadata beyond the base factor fields",
+                      ),
+                    zod
+                      .object({
+                        credential_id: zod.string().describe("The credential ID that was used"),
+                        user_verified: zod
+                          .boolean()
+                          .describe("Whether user verification was performed (PIN\/biometric)"),
+                        backup_eligible: zod
+                          .boolean()
+                          .optional()
+                          .describe("Whether the credential is backup eligible (can be synced)"),
+                        backup_state: zod
+                          .boolean()
+                          .optional()
+                          .describe("Whether the credential is currently backed up"),
+                        authenticator_attachment: zod
+                          .enum(["platform", "cross-platform"])
+                          .optional()
+                          .describe("Authenticator attachment modality"),
+                      })
+                      .describe(
+                        "Passkey-specific factor metadata including credential and verification details",
+                      ),
+                  ])
+                  .optional()
+                  .describe(
+                    "Method-specific factor metadata. Structure depends on the `method` field.\n- `identifier`: includes user_id\n- `password`: no additional data\n- `passkey`: includes credential details and verification flags\n",
+                  ),
+              })
+              .describe(
+                "A successfully verified authentication factor with verification metadata.\nMethod-specific details are included in the `payload` field.\n",
+              ),
+          )
+          .describe(
+            "Verified authentication factors accumulated by this session.\nEach key is a factor type (e.g. `password`, `totp`, `passkey`).\nEach value is a factor event object with at least `verified_at` and\nmethod-specific properties (e.g. `user_verified`, `hardware` for passkeys).\n",
+          ),
+        assurance_levels: zod
+          .array(zod.string())
+          .optional()
+          .describe(
+            'All assurance levels whose schemas the current session factors satisfy.\nThis list shrinks as factor freshness windows expire and grows when step-up\nauth_attempts add or refresh factors.\nWhether any level is \"enough\" is determined by the request context, not the session.\n',
+          ),
+        metadata: zod
+          .union([zod.record(zod.string(), zod.unknown()), zod.null()])
+          .optional()
+          .describe("Arbitrary key\/value metadata attached to the session."),
+        user_agent: zod
+          .union([
+            zod.object({
+              fingerprint: zod.string().optional().describe("Client-supplied device fingerprint."),
+              ip: zod.string().optional().describe("IP address of the client at session creation."),
+            }),
+            zod.null(),
+          ])
+          .optional()
+          .describe("User agent information captured at session creation."),
+        created_at: zod.iso.datetime({ offset: true }).describe("When this session was created."),
+        expires_at: zod.iso
+          .datetime({ offset: true })
+          .describe(
+            "When this session expires. Short TTL (10 min) for anonymous sessions;\nreset to the full configured session TTL once the first authentication factor is written.\n",
+          ),
+      })
+      .describe(
+        "The current state of a session.\n\nA session is the durable post-auth primitive. It accumulates verified authentication\nfactors and exposes `assurance_levels[]` — the set of assurance profiles its current\nfactors satisfy. Sessions are read-only from the client's perspective: factors flow\nin through `auth_attempts`.\n",
+      ),
+    session_token: zod
+      .string()
+      .describe(
+        "Bearer token authorising management of this session (GET and DELETE).\nFor anonymous sessions this token is superseded when a handoff exchange completes —\nclients must replace their stored token at that point.\n",
+      ),
+  })
+  .describe(
+    "Response for session creation and handoff exchange.\nIncludes the session state and the session_token required to manage it.\n",
+  );
+
+/**
+ * Returns the current state of a session including its factors and all currently
+satisfied assurance levels.
+
+`assurance_levels[]` may shrink over time as factor freshness windows expire,
+without the session itself expiring. Use step-up authentication (a new `auth_attempt`
+against the same `session_id`) to restore a dropped assurance level.
+
+ * @summary Get session state
+ */
+export const getSessionPathSessionIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const GetSessionParams = zod.object({
+  session_id: zod
+    .string()
+    .regex(getSessionPathSessionIdRegExp)
+    .describe("The unique identifier of the session."),
+});
+
+export const getSessionQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const GetSessionQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(getSessionQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+export const getSessionResponseSessionIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getSessionResponseProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getSessionResponseUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+export const getSessionResponseFactorsItemPayloadOneUserIdRegExp = new RegExp(
+  "^user_[a-zA-Z0-9_-]+$",
+);
+
+export const GetSessionResponse = zod
+  .object({
+    session_id: zod
+      .string()
+      .regex(getSessionResponseSessionIdRegExp)
+      .describe("Unique identifier for this session."),
+    project_id: zod.string().regex(getSessionResponseProjectIdRegExp),
+    state: zod
+      .enum(["building", "active", "expired", "revoked"])
+      .describe(
+        "Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n- `revoked`: explicitly revoked via DELETE\n",
+      ),
+    user_id: zod
+      .union([zod.string().regex(getSessionResponseUserIdOneRegExp), zod.null()])
+      .optional()
+      .describe(
+        "The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n",
+      ),
+    factors: zod
+      .array(
+        zod
+          .object({
+            method: zod
+              .enum(["identifier", "password", "passkey"])
+              .describe("An authentication factor method."),
+            verified_at: zod.iso
+              .datetime({ offset: true })
+              .describe("When this factor was successfully verified"),
+            payload: zod
+              .union([
+                zod
+                  .object({
+                    user_id: zod
+                      .string()
+                      .regex(getSessionResponseFactorsItemPayloadOneUserIdRegExp),
+                  })
+                  .describe("Identifier-specific factor metadata"),
+                zod
+                  .object({})
+                  .describe(
+                    "Password authentication has no additional metadata beyond the base factor fields",
+                  ),
+                zod
+                  .object({
+                    credential_id: zod.string().describe("The credential ID that was used"),
+                    user_verified: zod
+                      .boolean()
+                      .describe("Whether user verification was performed (PIN\/biometric)"),
+                    backup_eligible: zod
+                      .boolean()
+                      .optional()
+                      .describe("Whether the credential is backup eligible (can be synced)"),
+                    backup_state: zod
+                      .boolean()
+                      .optional()
+                      .describe("Whether the credential is currently backed up"),
+                    authenticator_attachment: zod
+                      .enum(["platform", "cross-platform"])
+                      .optional()
+                      .describe("Authenticator attachment modality"),
+                  })
+                  .describe(
+                    "Passkey-specific factor metadata including credential and verification details",
+                  ),
+              ])
+              .optional()
+              .describe(
+                "Method-specific factor metadata. Structure depends on the `method` field.\n- `identifier`: includes user_id\n- `password`: no additional data\n- `passkey`: includes credential details and verification flags\n",
+              ),
+          })
+          .describe(
+            "A successfully verified authentication factor with verification metadata.\nMethod-specific details are included in the `payload` field.\n",
+          ),
+      )
+      .describe(
+        "Verified authentication factors accumulated by this session.\nEach key is a factor type (e.g. `password`, `totp`, `passkey`).\nEach value is a factor event object with at least `verified_at` and\nmethod-specific properties (e.g. `user_verified`, `hardware` for passkeys).\n",
+      ),
+    assurance_levels: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        'All assurance levels whose schemas the current session factors satisfy.\nThis list shrinks as factor freshness windows expire and grows when step-up\nauth_attempts add or refresh factors.\nWhether any level is \"enough\" is determined by the request context, not the session.\n',
+      ),
+    metadata: zod
+      .union([zod.record(zod.string(), zod.unknown()), zod.null()])
+      .optional()
+      .describe("Arbitrary key\/value metadata attached to the session."),
+    user_agent: zod
+      .union([
+        zod.object({
+          fingerprint: zod.string().optional().describe("Client-supplied device fingerprint."),
+          ip: zod.string().optional().describe("IP address of the client at session creation."),
+        }),
+        zod.null(),
+      ])
+      .optional()
+      .describe("User agent information captured at session creation."),
+    created_at: zod.iso.datetime({ offset: true }).describe("When this session was created."),
+    expires_at: zod.iso
+      .datetime({ offset: true })
+      .describe(
+        "When this session expires. Short TTL (10 min) for anonymous sessions;\nreset to the full configured session TTL once the first authentication factor is written.\n",
+      ),
+  })
+  .describe(
+    "The current state of a session.\n\nA session is the durable post-auth primitive. It accumulates verified authentication\nfactors and exposes `assurance_levels[]` — the set of assurance profiles its current\nfactors satisfy. Sessions are read-only from the client's perspective: factors flow\nin through `auth_attempts`.\n",
+  );
+
+/**
+ * Revokes the session immediately (`state: revoked`). This is the logout operation.
+
+The session_token issued at creation (or superseded by a handoff exchange) is required.
+After revocation, any tokens derived from this session are invalidated.
+
+ * @summary Revoke session
+ */
+export const revokeSessionPathSessionIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const RevokeSessionParams = zod.object({
+  session_id: zod
+    .string()
+    .regex(revokeSessionPathSessionIdRegExp)
+    .describe("The unique identifier of the session."),
+});
+
+export const revokeSessionQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const RevokeSessionQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(revokeSessionQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+/**
+ * Returns the current state of the current session including its factors and all currently
+satisfied assurance levels.
+
+`assurance_levels[]` may shrink over time as factor freshness windows expire,
+without the session itself expiring. Use step-up authentication (a new `auth_attempt`
+against the same `session_id`) to restore a dropped assurance level.
+
+ * @summary Get my session state
+ */
+export const getMySessionResponseSessionIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getMySessionResponseProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getMySessionResponseUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+export const getMySessionResponseFactorsItemPayloadOneUserIdRegExp = new RegExp(
+  "^user_[a-zA-Z0-9_-]+$",
+);
+
+export const GetMySessionResponse = zod
+  .object({
+    session_id: zod
+      .string()
+      .regex(getMySessionResponseSessionIdRegExp)
+      .describe("Unique identifier for this session."),
+    project_id: zod.string().regex(getMySessionResponseProjectIdRegExp),
+    state: zod
+      .enum(["building", "active", "expired", "revoked"])
+      .describe(
+        "Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n- `revoked`: explicitly revoked via DELETE\n",
+      ),
+    user_id: zod
+      .union([zod.string().regex(getMySessionResponseUserIdOneRegExp), zod.null()])
+      .optional()
+      .describe(
+        "The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n",
+      ),
+    factors: zod
+      .array(
+        zod
+          .object({
+            method: zod
+              .enum(["identifier", "password", "passkey"])
+              .describe("An authentication factor method."),
+            verified_at: zod.iso
+              .datetime({ offset: true })
+              .describe("When this factor was successfully verified"),
+            payload: zod
+              .union([
+                zod
+                  .object({
+                    user_id: zod
+                      .string()
+                      .regex(getMySessionResponseFactorsItemPayloadOneUserIdRegExp),
+                  })
+                  .describe("Identifier-specific factor metadata"),
+                zod
+                  .object({})
+                  .describe(
+                    "Password authentication has no additional metadata beyond the base factor fields",
+                  ),
+                zod
+                  .object({
+                    credential_id: zod.string().describe("The credential ID that was used"),
+                    user_verified: zod
+                      .boolean()
+                      .describe("Whether user verification was performed (PIN\/biometric)"),
+                    backup_eligible: zod
+                      .boolean()
+                      .optional()
+                      .describe("Whether the credential is backup eligible (can be synced)"),
+                    backup_state: zod
+                      .boolean()
+                      .optional()
+                      .describe("Whether the credential is currently backed up"),
+                    authenticator_attachment: zod
+                      .enum(["platform", "cross-platform"])
+                      .optional()
+                      .describe("Authenticator attachment modality"),
+                  })
+                  .describe(
+                    "Passkey-specific factor metadata including credential and verification details",
+                  ),
+              ])
+              .optional()
+              .describe(
+                "Method-specific factor metadata. Structure depends on the `method` field.\n- `identifier`: includes user_id\n- `password`: no additional data\n- `passkey`: includes credential details and verification flags\n",
+              ),
+          })
+          .describe(
+            "A successfully verified authentication factor with verification metadata.\nMethod-specific details are included in the `payload` field.\n",
+          ),
+      )
+      .describe(
+        "Verified authentication factors accumulated by this session.\nEach key is a factor type (e.g. `password`, `totp`, `passkey`).\nEach value is a factor event object with at least `verified_at` and\nmethod-specific properties (e.g. `user_verified`, `hardware` for passkeys).\n",
+      ),
+    assurance_levels: zod
+      .array(zod.string())
+      .optional()
+      .describe(
+        'All assurance levels whose schemas the current session factors satisfy.\nThis list shrinks as factor freshness windows expire and grows when step-up\nauth_attempts add or refresh factors.\nWhether any level is \"enough\" is determined by the request context, not the session.\n',
+      ),
+    metadata: zod
+      .union([zod.record(zod.string(), zod.unknown()), zod.null()])
+      .optional()
+      .describe("Arbitrary key\/value metadata attached to the session."),
+    user_agent: zod
+      .union([
+        zod.object({
+          fingerprint: zod.string().optional().describe("Client-supplied device fingerprint."),
+          ip: zod.string().optional().describe("IP address of the client at session creation."),
+        }),
+        zod.null(),
+      ])
+      .optional()
+      .describe("User agent information captured at session creation."),
+    created_at: zod.iso.datetime({ offset: true }).describe("When this session was created."),
+    expires_at: zod.iso
+      .datetime({ offset: true })
+      .describe(
+        "When this session expires. Short TTL (10 min) for anonymous sessions;\nreset to the full configured session TTL once the first authentication factor is written.\n",
+      ),
+  })
+  .describe(
+    "The current state of a session.\n\nA session is the durable post-auth primitive. It accumulates verified authentication\nfactors and exposes `assurance_levels[]` — the set of assurance profiles its current\nfactors satisfy. Sessions are read-only from the client's perspective: factors flow\nin through `auth_attempts`.\n",
+  );
+
+/**
+ * Create a new schema. The schema definition must include a unique $id field,
+which will be used to identify the schema in future requests. The $id must
+be a valid URI and should ideally point to the location where the schema
+can be accessed.
+
+The schema can either be a concrete schema, e.g. a user schema, or a
+schema-url which will be resolved by the server.
+
+ * @summary Create new schema
+ */
+export const createSchemaQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const createSchemaQueryTeamIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const CreateSchemaQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(createSchemaQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+  team_id: zod
+    .string()
+    .regex(createSchemaQueryTeamIdRegExp)
+    .optional()
+    .describe("The unique identifier of the team"),
+});
+
+export const createSchemaBodyOneXAuthMethodsPasswordPositionMin = 0;
+
+export const createSchemaBodyOneXAuthMethodsPasskeyPositionMin = 0;
+
+export const createSchemaBodyOneXAuthMethodsMagicLinkPositionMin = 0;
+
+export const createSchemaBodyOneXAuthMethodsSsoPositionMin = 0;
+
+export const createSchemaBodyOneXAuthMethodsOtpPositionMin = 0;
+
+export const createSchemaBodyOnePropertiesXEditableDefault = true;
+export const createSchemaBodyOnePropertiesXSensitiveDefault = false;
+export const createSchemaBodyOnePropertiesXMfaDefault = false;
+
+export const CreateSchemaBody = zod.union([
+  zod
+    .object({
+      kind: zod
+        .literal("user-schema")
+        .describe("Discriminator value for a user schema create request."),
+      metaSchema: zod.url().describe("The user Schema version used for this schema."),
+      "x-auth-methods": zod
+        .object({
+          password: zod
+            .object({
+              enabled: zod
+                .boolean()
+                .describe("Whether the authentication method is enabled or not"),
+              position: zod
+                .number()
+                .min(createSchemaBodyOneXAuthMethodsPasswordPositionMin)
+                .describe(
+                  "The position of the authentication method in the list of supported methods",
+                ),
+            })
+            .optional(),
+          passkey: zod
+            .object({
+              enabled: zod
+                .boolean()
+                .describe("Whether the authentication method is enabled or not"),
+              position: zod
+                .number()
+                .min(createSchemaBodyOneXAuthMethodsPasskeyPositionMin)
+                .describe(
+                  "The position of the authentication method in the list of supported methods",
+                ),
+            })
+            .optional(),
+          magic_link: zod
+            .object({
+              enabled: zod
+                .boolean()
+                .describe("Whether the authentication method is enabled or not"),
+              position: zod
+                .number()
+                .min(createSchemaBodyOneXAuthMethodsMagicLinkPositionMin)
+                .describe(
+                  "The position of the authentication method in the list of supported methods",
+                ),
+            })
+            .optional(),
+          sso: zod
+            .object({
+              enabled: zod
+                .boolean()
+                .describe("Whether the authentication method is enabled or not"),
+              position: zod
+                .number()
+                .min(createSchemaBodyOneXAuthMethodsSsoPositionMin)
+                .describe(
+                  "The position of the authentication method in the list of supported methods",
+                ),
+            })
+            .optional(),
+          otp: zod
+            .object({
+              enabled: zod
+                .boolean()
+                .describe("Whether the authentication method is enabled or not"),
+              position: zod
+                .number()
+                .min(createSchemaBodyOneXAuthMethodsOtpPositionMin)
+                .describe(
+                  "The position of the authentication method in the list of supported methods",
+                ),
+            })
+            .optional(),
+        })
+        .describe("A list of authentication methods supported by the user definition."),
+      properties: zod
+        .record(
+          zod.string(),
+          zod
+            .object({
+              "x-verify": zod
+                .union([zod.string(), zod.null()])
+                .optional()
+                .describe("The verification method for this property, if applicable"),
+              "x-unique": zod
+                .union([zod.enum(["unspecified", "project", "team"]), zod.null()])
+                .optional()
+                .describe("The level of uniqueness for this property, if applicable"),
+              "x-claim": zod
+                .union([zod.string(), zod.null()])
+                .optional()
+                .describe("The claim name for this property, if applicable"),
+              "x-editable": zod
+                .boolean()
+                .default(createSchemaBodyOnePropertiesXEditableDefault)
+                .describe("Whether this property is editable by the user or not"),
+              "x-sensitive": zod
+                .boolean()
+                .default(createSchemaBodyOnePropertiesXSensitiveDefault)
+                .describe("Whether this property contains sensitive information or not"),
+              "x-mfa": zod
+                .boolean()
+                .default(createSchemaBodyOnePropertiesXMfaDefault)
+                .describe("Whether this property is used for multi-factor authentication or not"),
+              properties: zod
+                .record(zod.string(), zod.unknown())
+                .optional()
+                .describe(
+                  "A map of additional properties for the user definition, where the key is the property name and the value is the property schema",
+                ),
+            })
+            .describe(
+              'This schema is missing `\"allOf\": [{\"$ref\": \"https:\/\/json-schema.org\/draft\/2020-12\/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n',
+            ),
+        )
+        .optional()
+        .describe(
+          "A map of additional properties for the user definition, where the key is the property name and the value is the property schema",
+        ),
+    })
+    .describe(
+      'This schema is missing `\"allOf\": [{\"$ref\": \"https:\/\/json-schema.org\/draft\/2020-12\/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n',
+    ),
+  zod
+    .object({
+      kind: zod
+        .literal("schema-url")
+        .describe("Discriminator value for a user schema create request."),
+      url: zod.url().describe("URL to the schema definition."),
+    })
+    .describe(
+      "A schema definition that references an external schema via a URL. It is \non creation, validated against its metaschema and cached in the database.\n",
+    ),
+]);
+
+/**
+ * Get a schema by its ID. This will return the default revision of the schema.
+ * @summary Get schema by ID
+ */
+export const GetSchemaByIdParams = zod.object({
+  id: zod.string(),
+});
+
+export const getSchemaByIdQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getSchemaByIdQueryTeamIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const GetSchemaByIdQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(getSchemaByIdQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+  team_id: zod
+    .string()
+    .regex(getSchemaByIdQueryTeamIdRegExp)
+    .optional()
+    .describe("The unique identifier of the team"),
+});
+
+export const getSchemaByIdResponseOneXAuthMethodsPasswordPositionMin = 0;
+
+export const getSchemaByIdResponseOneXAuthMethodsPasskeyPositionMin = 0;
+
+export const getSchemaByIdResponseOneXAuthMethodsMagicLinkPositionMin = 0;
+
+export const getSchemaByIdResponseOneXAuthMethodsSsoPositionMin = 0;
+
+export const getSchemaByIdResponseOneXAuthMethodsOtpPositionMin = 0;
+
+export const getSchemaByIdResponseOnePropertiesXEditableDefault = true;
+export const getSchemaByIdResponseOnePropertiesXSensitiveDefault = false;
+export const getSchemaByIdResponseOnePropertiesXMfaDefault = false;
+
+export const GetSchemaByIdResponse = zod
+  .object({
+    kind: zod
+      .literal("user-schema")
+      .describe("Discriminator value for a user schema create request."),
+    metaSchema: zod.url().describe("The user Schema version used for this schema."),
+    "x-auth-methods": zod
+      .object({
+        password: zod
+          .object({
+            enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
+            position: zod
+              .number()
+              .min(getSchemaByIdResponseOneXAuthMethodsPasswordPositionMin)
+              .describe(
+                "The position of the authentication method in the list of supported methods",
+              ),
+          })
+          .optional(),
+        passkey: zod
+          .object({
+            enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
+            position: zod
+              .number()
+              .min(getSchemaByIdResponseOneXAuthMethodsPasskeyPositionMin)
+              .describe(
+                "The position of the authentication method in the list of supported methods",
+              ),
+          })
+          .optional(),
+        magic_link: zod
+          .object({
+            enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
+            position: zod
+              .number()
+              .min(getSchemaByIdResponseOneXAuthMethodsMagicLinkPositionMin)
+              .describe(
+                "The position of the authentication method in the list of supported methods",
+              ),
+          })
+          .optional(),
+        sso: zod
+          .object({
+            enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
+            position: zod
+              .number()
+              .min(getSchemaByIdResponseOneXAuthMethodsSsoPositionMin)
+              .describe(
+                "The position of the authentication method in the list of supported methods",
+              ),
+          })
+          .optional(),
+        otp: zod
+          .object({
+            enabled: zod.boolean().describe("Whether the authentication method is enabled or not"),
+            position: zod
+              .number()
+              .min(getSchemaByIdResponseOneXAuthMethodsOtpPositionMin)
+              .describe(
+                "The position of the authentication method in the list of supported methods",
+              ),
+          })
+          .optional(),
+      })
+      .describe("A list of authentication methods supported by the user definition."),
+    properties: zod
+      .record(
+        zod.string(),
+        zod
+          .object({
+            "x-verify": zod
+              .union([zod.string(), zod.null()])
+              .optional()
+              .describe("The verification method for this property, if applicable"),
+            "x-unique": zod
+              .union([zod.enum(["unspecified", "project", "team"]), zod.null()])
+              .optional()
+              .describe("The level of uniqueness for this property, if applicable"),
+            "x-claim": zod
+              .union([zod.string(), zod.null()])
+              .optional()
+              .describe("The claim name for this property, if applicable"),
+            "x-editable": zod
+              .boolean()
+              .default(getSchemaByIdResponseOnePropertiesXEditableDefault)
+              .describe("Whether this property is editable by the user or not"),
+            "x-sensitive": zod
+              .boolean()
+              .default(getSchemaByIdResponseOnePropertiesXSensitiveDefault)
+              .describe("Whether this property contains sensitive information or not"),
+            "x-mfa": zod
+              .boolean()
+              .default(getSchemaByIdResponseOnePropertiesXMfaDefault)
+              .describe("Whether this property is used for multi-factor authentication or not"),
+            properties: zod
+              .record(zod.string(), zod.unknown())
+              .optional()
+              .describe(
+                "A map of additional properties for the user definition, where the key is the property name and the value is the property schema",
+              ),
+          })
+          .describe(
+            'This schema is missing `\"allOf\": [{\"$ref\": \"https:\/\/json-schema.org\/draft\/2020-12\/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n',
+          ),
+      )
+      .optional()
+      .describe(
+        "A map of additional properties for the user definition, where the key is the property name and the value is the property schema",
+      ),
+  })
+  .describe(
+    'This schema is missing `\"allOf\": [{\"$ref\": \"https:\/\/json-schema.org\/draft\/2020-12\/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n',
+  );
+
+/**
+ * Creates a new flow definition.
+Flow definitions are templates that define the sequence of steps (capabilities)
+for a particular user journey (e.g., registration, login, password reset).
+
+Flow definitions are created based on the flow meta schema, which includes the flow's purpose, audience, and the steps involved.
+
+ * @summary Create a new flow definition
+ */
+export const createFlowDefinitionBodyProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const createFlowDefinitionBodyFlowDefinitionNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
+export const createFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault = [];
+export const createFlowDefinitionBodyFlowDefinitionStepsItemActionsPrimaryDefault = false;
+export const createFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault = {} as const;
+export const createFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault = {} as const;
+export const createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault = [];
+
+export const CreateFlowDefinitionBody = zod.object({
+  project_id: zod.string().regex(createFlowDefinitionBodyProjectIdRegExp),
+  schema_uri: zod
+    .url()
+    .optional()
+    .describe(
+      "URI of the server-published flow definition schema this definition was\nauthored against. The server uses this to validate the definition.\nIf not provided, the engine will use the latest schema version for validation.\n",
+    ),
+  flow_definition: zod
+    .object({
+      name: zod
+        .string()
+        .regex(createFlowDefinitionBodyFlowDefinitionNameRegExp)
+        .describe(
+          "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
+        ),
+      user_schema: zod
+        .url()
+        .describe(
+          "User schema this flow operates on. Step `fields` reference properties\ndefined in this schema. The engine resolves field types, validation,\nand implicit outcomes from schema annotations at runtime.\n",
+        ),
+      purposes: zod
+        .record(zod.string(), zod.string())
+        .describe(
+          "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login\/register\nflow) by listing one entry per purpose.\n",
+        ),
+      audience: zod
+        .object({
+          team_ids: zod
+            .array(zod.string())
+            .optional()
+            .describe(
+              "Restrict to specific teams (organizations). Empty means no team restriction.",
+            ),
+          app_ids: zod
+            .array(zod.string())
+            .optional()
+            .describe("Restrict to specific applications. Empty means no app restriction."),
+        })
+        .optional()
+        .describe(
+          'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
+        ),
+      steps: zod
+        .array(
+          zod
+            .object({
+              name: zod
+                .string()
+                .describe(
+                  "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
+                ),
+              fields: zod
+                .array(zod.string())
+                .default(createFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault)
+                .describe(
+                  "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
+                ),
+              actions: zod
+                .record(
+                  zod.string(),
+                  zod
+                    .object({
+                      primary: zod
+                        .boolean()
+                        .default(
+                          createFlowDefinitionBodyFlowDefinitionStepsItemActionsPrimaryDefault,
+                        )
+                        .describe(
+                          "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
+                        ),
+                      text_key: zod
+                        .string()
+                        .optional()
+                        .describe(
+                          "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
+                        ),
+                    })
+                    .describe(
+                      "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
+                    ),
+                )
+                .default(createFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault)
+                .describe(
+                  "Actions the user can take. Keyed by action name.\nThe action name is what the frontend sends back in the submit request.\nIf omitted, the engine provides a default `submit` action.\n",
+                ),
+              gates: zod
+                .record(
+                  zod.string(),
+                  zod
+                    .object({
+                      kind: zod
+                        .enum(["captcha"])
+                        .describe(
+                          "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
+                        ),
+                      provider: zod
+                        .string()
+                        .describe(
+                          "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                        ),
+                      config: zod
+                        .record(zod.string(), zod.unknown())
+                        .optional()
+                        .describe(
+                          "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                        ),
+                    })
+                    .describe(
+                      "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
+                    ),
+                )
+                .default(createFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault)
+                .describe(
+                  'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
+                ),
+              sso_providers: zod
+                .array(
+                  zod
+                    .object({
+                      id: zod.string().describe("Provider instance identifier."),
+                      name: zod.string().describe("Display name for the provider."),
+                      template: zod
+                        .string()
+                        .describe("Template hint for rendering (logo, colors)."),
+                    })
+                    .describe("An available SSO identity provider."),
+                )
+                .default(createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault)
+                .describe("Available SSO identity providers for this step."),
+              on_success: zod
+                .enum(["create_user"])
+                .optional()
+                .describe(
+                  "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
+                ),
+              complete: zod
+                .enum(["redirect", "show"])
+                .optional()
+                .describe(
+                  "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
+                ),
+              transitions: zod
+                .record(
+                  zod.string(),
+                  zod.object({
+                    target: zod
+                      .string()
+                      .describe(
+                        "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
+                      ),
+                    action: zod
+                      .union([zod.enum(["switch", "pivot"]), zod.null()])
+                      .optional()
+                      .describe(
+                        "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
+                      ),
+                  }),
+                )
+                .optional()
+                .describe(
+                  "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` dict. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
+                ),
+            })
+            .describe(
+              "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
+            ),
+        )
+        .min(1)
+        .describe(
+          "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
+        ),
+    })
+    .describe(
+      "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project\/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST \/flow.\n",
+    ),
+});
+
+/**
+ * Retrieves a list of all flow definitions.
+This endpoint can be used to view existing flow definitions and their configurations.
+
+ * @summary List flow definitions
+ */
+export const listFlowDefinitionsQueryLimitDefault = 20;
+export const listFlowDefinitionsQueryLimitMax = 100;
+
+export const listFlowDefinitionsQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const ListFlowDefinitionsQueryParams = zod.strictObject({
+  limit: zod
+    .number()
+    .min(1)
+    .max(listFlowDefinitionsQueryLimitMax)
+    .default(listFlowDefinitionsQueryLimitDefault)
+    .describe("Maximum number of items to return."),
+  page_token: zod
+    .string()
+    .optional()
+    .describe(
+      "Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n",
+    ),
+  project_id: zod
+    .string()
+    .regex(listFlowDefinitionsQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+  purpose: zod
+    .enum(["login", "register", "recovery", "profiling", "reauth", "link_account"])
+    .optional()
+    .describe("Filter flow definitions by purpose (e.g., registration, login)."),
+});
+
+export const listFlowDefinitionsResponseFlowDefinitionsItemNameRegExp = new RegExp(
+  "^[a-z][a-z0-9-]\*$",
+);
+
+export const ListFlowDefinitionsResponse = zod.object({
+  flow_definitions: zod.array(
+    zod
+      .object({
+        id: zod.string().describe("Unique identifier for the created flow definition."),
+        name: zod
+          .string()
+          .regex(listFlowDefinitionsResponseFlowDefinitionsItemNameRegExp)
+          .describe("Stable identifier for this flow (echoed from the request).\n"),
+        project_id: zod
+          .string()
+          .describe("Identifier of the project this flow definition belongs to."),
+        schema_uri: zod
+          .url()
+          .describe(
+            "URI of the flow definition schema this definition was authored against.\nIf the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.\n",
+          ),
+        status: zod.string().describe("Status of the flow definition."),
+        created_at: zod.iso
+          .datetime({ offset: true })
+          .describe("Timestamp when the flow definition was created."),
+        updated_at: zod.iso
+          .datetime({ offset: true })
+          .describe("Timestamp when the flow definition was last updated."),
+      })
+      .describe("Response object for a flow definition after creation.\n"),
+  ),
+  next_page_token: zod
+    .union([zod.string(), zod.null()])
+    .optional()
+    .describe(
+      "The token to retrieve the next page of results. Absent if there are no more results.",
+    ),
+});
+
+/**
+ * Get a flow definition by id
+ * @summary Get a flow definition by id
+ */
+export const GetFlowDefinitionParams = zod.object({
+  id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
+});
+
+export const getFlowDefinitionResponseOneNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
+export const getFlowDefinitionResponseOneStepsItemFieldsDefault = [];
+export const getFlowDefinitionResponseOneStepsItemActionsPrimaryDefault = false;
+export const getFlowDefinitionResponseOneStepsItemActionsDefault = {} as const;
+export const getFlowDefinitionResponseOneStepsItemGatesDefault = {} as const;
+export const getFlowDefinitionResponseOneStepsItemSsoProvidersDefault = [];
+
+export const GetFlowDefinitionResponse = zod
+  .object({
+    name: zod
+      .string()
+      .regex(getFlowDefinitionResponseOneNameRegExp)
+      .describe(
+        "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
+      ),
+    user_schema: zod
+      .url()
+      .describe(
+        "User schema this flow operates on. Step `fields` reference properties\ndefined in this schema. The engine resolves field types, validation,\nand implicit outcomes from schema annotations at runtime.\n",
+      ),
+    purposes: zod
+      .record(zod.string(), zod.string())
+      .describe(
+        "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login\/register\nflow) by listing one entry per purpose.\n",
+      ),
+    audience: zod
+      .object({
+        team_ids: zod
+          .array(zod.string())
+          .optional()
+          .describe("Restrict to specific teams (organizations). Empty means no team restriction."),
+        app_ids: zod
+          .array(zod.string())
+          .optional()
+          .describe("Restrict to specific applications. Empty means no app restriction."),
+      })
+      .optional()
+      .describe(
+        'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
+      ),
+    steps: zod
+      .array(
+        zod
+          .object({
+            name: zod
+              .string()
+              .describe(
+                "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
+              ),
+            fields: zod
+              .array(zod.string())
+              .default(getFlowDefinitionResponseOneStepsItemFieldsDefault)
+              .describe(
+                "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
+              ),
+            actions: zod
+              .record(
+                zod.string(),
+                zod
+                  .object({
+                    primary: zod
+                      .boolean()
+                      .default(getFlowDefinitionResponseOneStepsItemActionsPrimaryDefault)
+                      .describe(
+                        "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
+                      ),
+                    text_key: zod
+                      .string()
+                      .optional()
+                      .describe(
+                        "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
+                      ),
+                  })
+                  .describe(
+                    "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
+                  ),
+              )
+              .default(getFlowDefinitionResponseOneStepsItemActionsDefault)
+              .describe(
+                "Actions the user can take. Keyed by action name.\nThe action name is what the frontend sends back in the submit request.\nIf omitted, the engine provides a default `submit` action.\n",
+              ),
+            gates: zod
+              .record(
+                zod.string(),
+                zod
+                  .object({
+                    kind: zod
+                      .enum(["captcha"])
+                      .describe(
+                        "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
+                      ),
+                    provider: zod
+                      .string()
+                      .describe(
+                        "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                      ),
+                    config: zod
+                      .record(zod.string(), zod.unknown())
+                      .optional()
+                      .describe(
+                        "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                      ),
+                  })
+                  .describe(
+                    "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
+                  ),
+              )
+              .default(getFlowDefinitionResponseOneStepsItemGatesDefault)
+              .describe(
+                'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
+              ),
+            sso_providers: zod
+              .array(
+                zod
+                  .object({
+                    id: zod.string().describe("Provider instance identifier."),
+                    name: zod.string().describe("Display name for the provider."),
+                    template: zod.string().describe("Template hint for rendering (logo, colors)."),
+                  })
+                  .describe("An available SSO identity provider."),
+              )
+              .default(getFlowDefinitionResponseOneStepsItemSsoProvidersDefault)
+              .describe("Available SSO identity providers for this step."),
+            on_success: zod
+              .enum(["create_user"])
+              .optional()
+              .describe(
+                "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
+              ),
+            complete: zod
+              .enum(["redirect", "show"])
+              .optional()
+              .describe(
+                "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
+              ),
+            transitions: zod
+              .record(
+                zod.string(),
+                zod.object({
+                  target: zod
+                    .string()
+                    .describe(
+                      "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
+                    ),
+                  action: zod
+                    .union([zod.enum(["switch", "pivot"]), zod.null()])
+                    .optional()
+                    .describe(
+                      "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
+                    ),
+                }),
+              )
+              .optional()
+              .describe(
+                "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` dict. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
+              ),
+          })
+          .describe(
+            "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
+          ),
+      )
+      .min(1)
+      .describe(
+        "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
+      ),
+  })
+  .describe(
+    "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project\/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST \/flow.\n",
+  )
+  .and(
+    zod.object({
+      id: zod.string().describe("Unique identifier for the flow definition."),
+      project_id: zod
+        .string()
+        .describe("Identifier of the project this flow definition belongs to."),
+      schema_uri: zod
+        .url()
+        .describe(
+          "URI of the flow definition schema this definition was authored against.\nIf the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.\n",
+        ),
+      status: zod.string().describe("Status of the flow definition."),
+      created_at: zod.iso.datetime({ offset: true }),
+      updated_at: zod.iso.datetime({ offset: true }),
+    }),
+  );
+
+/**
+ * Update a flow definition by id
+ * @summary Update a flow definition by id
+ */
+export const UpdateFlowDefinitionParams = zod.object({
+  id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
+});
+
+export const updateFlowDefinitionBodyStepsItemFieldsDefault = [];
+export const updateFlowDefinitionBodyStepsItemActionsPrimaryDefault = false;
+export const updateFlowDefinitionBodyStepsItemActionsDefault = {} as const;
+export const updateFlowDefinitionBodyStepsItemGatesDefault = {} as const;
+export const updateFlowDefinitionBodyStepsItemSsoProvidersDefault = [];
+
+export const UpdateFlowDefinitionBody = zod
+  .object({
+    user_schema: zod
+      .url()
+      .optional()
+      .describe("User schema this flow operates on. Replaces the current value if provided.\n"),
+    purposes: zod
+      .record(zod.string(), zod.string())
+      .optional()
+      .describe(
+        "Replaces the full purpose-to-entry-step map if provided. Keys are\npurpose names; values must match a `name` in `steps`.\n",
+      ),
+    audience: zod
+      .object({
+        team_ids: zod
+          .array(zod.string())
+          .optional()
+          .describe("Restrict to specific teams (organizations). Empty means no team restriction."),
+        app_ids: zod
+          .array(zod.string())
+          .optional()
+          .describe("Restrict to specific applications. Empty means no app restriction."),
+      })
+      .optional()
+      .describe(
+        'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
+      ),
+    steps: zod
+      .array(
+        zod
+          .object({
+            name: zod
+              .string()
+              .describe(
+                "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
+              ),
+            fields: zod
+              .array(zod.string())
+              .default(updateFlowDefinitionBodyStepsItemFieldsDefault)
+              .describe(
+                "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
+              ),
+            actions: zod
+              .record(
+                zod.string(),
+                zod
+                  .object({
+                    primary: zod
+                      .boolean()
+                      .default(updateFlowDefinitionBodyStepsItemActionsPrimaryDefault)
+                      .describe(
+                        "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
+                      ),
+                    text_key: zod
+                      .string()
+                      .optional()
+                      .describe(
+                        "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
+                      ),
+                  })
+                  .describe(
+                    "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
+                  ),
+              )
+              .default(updateFlowDefinitionBodyStepsItemActionsDefault)
+              .describe(
+                "Actions the user can take. Keyed by action name.\nThe action name is what the frontend sends back in the submit request.\nIf omitted, the engine provides a default `submit` action.\n",
+              ),
+            gates: zod
+              .record(
+                zod.string(),
+                zod
+                  .object({
+                    kind: zod
+                      .enum(["captcha"])
+                      .describe(
+                        "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
+                      ),
+                    provider: zod
+                      .string()
+                      .describe(
+                        "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                      ),
+                    config: zod
+                      .record(zod.string(), zod.unknown())
+                      .optional()
+                      .describe(
+                        "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                      ),
+                  })
+                  .describe(
+                    "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
+                  ),
+              )
+              .default(updateFlowDefinitionBodyStepsItemGatesDefault)
+              .describe(
+                'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
+              ),
+            sso_providers: zod
+              .array(
+                zod
+                  .object({
+                    id: zod.string().describe("Provider instance identifier."),
+                    name: zod.string().describe("Display name for the provider."),
+                    template: zod.string().describe("Template hint for rendering (logo, colors)."),
+                  })
+                  .describe("An available SSO identity provider."),
+              )
+              .default(updateFlowDefinitionBodyStepsItemSsoProvidersDefault)
+              .describe("Available SSO identity providers for this step."),
+            on_success: zod
+              .enum(["create_user"])
+              .optional()
+              .describe(
+                "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
+              ),
+            complete: zod
+              .enum(["redirect", "show"])
+              .optional()
+              .describe(
+                "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
+              ),
+            transitions: zod
+              .record(
+                zod.string(),
+                zod.object({
+                  target: zod
+                    .string()
+                    .describe(
+                      "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
+                    ),
+                  action: zod
+                    .union([zod.enum(["switch", "pivot"]), zod.null()])
+                    .optional()
+                    .describe(
+                      "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
+                    ),
+                }),
+              )
+              .optional()
+              .describe(
+                "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` dict. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
+              ),
+          })
+          .describe(
+            "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
+          ),
+      )
+      .min(1)
+      .optional()
+      .describe(
+        "Replaces the full steps array if provided. Partial step lists are not\nsupported — supply all steps when updating this field.\n",
+      ),
+  })
+  .describe(
+    "Partial update for a flow definition. Only provided fields are replaced;\nomitted fields retain their current server-side values.\n\nCollection fields (`steps`, `purposes`) are treated atomically: if\nprovided, the entire array\/object is replaced. If omitted, the current\nvalue is preserved unchanged.\n\n`name` is a stable identifier and cannot be changed after creation.\n",
+  );
+
+export const updateFlowDefinitionResponseOneNameRegExp = new RegExp("^[a-z][a-z0-9-]\*$");
+export const updateFlowDefinitionResponseOneStepsItemFieldsDefault = [];
+export const updateFlowDefinitionResponseOneStepsItemActionsPrimaryDefault = false;
+export const updateFlowDefinitionResponseOneStepsItemActionsDefault = {} as const;
+export const updateFlowDefinitionResponseOneStepsItemGatesDefault = {} as const;
+export const updateFlowDefinitionResponseOneStepsItemSsoProvidersDefault = [];
+
+export const UpdateFlowDefinitionResponse = zod
+  .object({
+    name: zod
+      .string()
+      .regex(updateFlowDefinitionResponseOneNameRegExp)
+      .describe(
+        "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Renaming is not supported — the\n`name` is part of the public contract another definition may\nreference. Acts as the human display label as well; no separate slug.\n",
+      ),
+    user_schema: zod
+      .url()
+      .describe(
+        "User schema this flow operates on. Step `fields` reference properties\ndefined in this schema. The engine resolves field types, validation,\nand implicit outcomes from schema annotations at runtime.\n",
+      ),
+    purposes: zod
+      .record(zod.string(), zod.string())
+      .describe(
+        "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login\/register\nflow) by listing one entry per purpose.\n",
+      ),
+    audience: zod
+      .object({
+        team_ids: zod
+          .array(zod.string())
+          .optional()
+          .describe("Restrict to specific teams (organizations). Empty means no team restriction."),
+        app_ids: zod
+          .array(zod.string())
+          .optional()
+          .describe("Restrict to specific applications. Empty means no app restriction."),
+      })
+      .optional()
+      .describe(
+        'Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n',
+      ),
+    steps: zod
+      .array(
+        zod
+          .object({
+            name: zod
+              .string()
+              .describe(
+                "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
+              ),
+            fields: zod
+              .array(zod.string())
+              .default(updateFlowDefinitionResponseOneStepsItemFieldsDefault)
+              .describe(
+                "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
+              ),
+            actions: zod
+              .record(
+                zod.string(),
+                zod
+                  .object({
+                    primary: zod
+                      .boolean()
+                      .default(updateFlowDefinitionResponseOneStepsItemActionsPrimaryDefault)
+                      .describe(
+                        "Marks this as the default\/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
+                      ),
+                    text_key: zod
+                      .string()
+                      .optional()
+                      .describe(
+                        "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
+                      ),
+                  })
+                  .describe(
+                    "Configuration for a user-invokable action on a step. Keyed by action name\nin the parent dictionary. The action name is sent back in the submit\nrequest as `action`.\n",
+                  ),
+              )
+              .default(updateFlowDefinitionResponseOneStepsItemActionsDefault)
+              .describe(
+                "Actions the user can take. Keyed by action name.\nThe action name is what the frontend sends back in the submit request.\nIf omitted, the engine provides a default `submit` action.\n",
+              ),
+            gates: zod
+              .record(
+                zod.string(),
+                zod
+                  .object({
+                    kind: zod
+                      .enum(["captcha"])
+                      .describe(
+                        "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
+                      ),
+                    provider: zod
+                      .string()
+                      .describe(
+                        "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+                      ),
+                    config: zod
+                      .record(zod.string(), zod.unknown())
+                      .optional()
+                      .describe(
+                        "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+                      ),
+                  })
+                  .describe(
+                    "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
+                  ),
+              )
+              .default(updateFlowDefinitionResponseOneStepsItemGatesDefault)
+              .describe(
+                'Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n',
+              ),
+            sso_providers: zod
+              .array(
+                zod
+                  .object({
+                    id: zod.string().describe("Provider instance identifier."),
+                    name: zod.string().describe("Display name for the provider."),
+                    template: zod.string().describe("Template hint for rendering (logo, colors)."),
+                  })
+                  .describe("An available SSO identity provider."),
+              )
+              .default(updateFlowDefinitionResponseOneStepsItemSsoProvidersDefault)
+              .describe("Available SSO identity providers for this step."),
+            on_success: zod
+              .enum(["create_user"])
+              .optional()
+              .describe(
+                "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
+              ),
+            complete: zod
+              .enum(["redirect", "show"])
+              .optional()
+              .describe(
+                "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC\/SAML callback done)\n- show: render as a success\/info screen\n",
+              ),
+            transitions: zod
+              .record(
+                zod.string(),
+                zod.object({
+                  target: zod
+                    .string()
+                    .describe(
+                      "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
+                    ),
+                  action: zod
+                    .union([zod.enum(["switch", "pivot"]), zod.null()])
+                    .optional()
+                    .describe(
+                      "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n",
+                    ),
+                }),
+              )
+              .optional()
+              .describe(
+                "Maps action\/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` dict. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
+              ),
+          })
+          .describe(
+            "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
+          ),
+      )
+      .min(1)
+      .describe(
+        "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
+      ),
+  })
+  .describe(
+    "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project\/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST \/flow.\n",
+  )
+  .and(
+    zod.object({
+      id: zod.string().describe("Unique identifier for the flow definition."),
+      project_id: zod
+        .string()
+        .describe("Identifier of the project this flow definition belongs to."),
+      schema_uri: zod
+        .url()
+        .describe(
+          "URI of the flow definition schema this definition was authored against.\nIf the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.\n",
+        ),
+      status: zod.string().describe("Status of the flow definition."),
+      created_at: zod.iso.datetime({ offset: true }),
+      updated_at: zod.iso.datetime({ offset: true }),
+    }),
+  );
+
+/**
+ * Delete a flow definition by id
+ * @summary Delete a flow definition by id
+ */
+export const DeleteFlowDefinitionParams = zod.object({
+  id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
+});
+
+/**
+ * @summary Create team
+ */
+export const createTeamQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const CreateTeamQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(createTeamQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+export const CreateTeamBody = zod.looseObject({});
+
+/**
+ * Returns the current state of a team.
+
+ * @summary Get team
+ */
+export const getTeamPathTeamIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const GetTeamParams = zod.object({
+  team_id: zod.string().regex(getTeamPathTeamIdRegExp),
+});
+
+export const getTeamQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const GetTeamQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(getTeamQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+export const GetTeamResponse = zod
+  .object({
+    id: zod.string().describe("The unique identifier of the team."),
+    createdAt: zod.iso.datetime({ offset: true }).describe("The time when the team was created."),
+    updatedAt: zod.iso
+      .datetime({ offset: true })
+      .describe("The time when the team was last updated."),
+  })
+  .describe("The current state of a team.");