@zitadel/api 0.1.0-alpha.4 → 0.1.0-alpha.8

package/src/generated/model/index.ts

@@ -33,15 +33,15 @@ export * from "./createFlow201";
 export * from "./createFlow201Branding";
 export * from "./createFlow201BrandingLayout";
 export * from "./createFlow201Step";
-export * from "./createFlow201StepActions";
+export * from "./createFlow201StepActionsItem";
 export * from "./createFlow201StepChallenge";
 export * from "./createFlow201StepChallengeMethod";
 export * from "./createFlow201StepChallengeOptions";
 export * from "./createFlow201StepComplete";
-export * from "./createFlow201StepFields";
-export * from "./createFlow201StepFieldsType";
-export * from "./createFlow201StepFieldsValidation";
-export * from "./createFlow201StepFieldsValidationFormat";
+export * from "./createFlow201StepFieldsItem";
+export * from "./createFlow201StepFieldsItemType";
+export * from "./createFlow201StepFieldsItemValidation";
+export * from "./createFlow201StepFieldsItemValidationFormat";
 export * from "./createFlow201StepGates";
 export * from "./createFlow201StepGatesConfig";
 export * from "./createFlow201StepGatesKind";
@@ -58,7 +58,7 @@ export * from "./createFlowDefinition201";
 export * from "./createFlowDefinition201FlowDefinition";
 export * from "./createFlowDefinition201FlowDefinitionAudience";
 export * from "./createFlowDefinition201FlowDefinitionStepsItem";
-export * from "./createFlowDefinition201FlowDefinitionStepsItemActions";
+export * from "./createFlowDefinition201FlowDefinitionStepsItemActionsItem";
 export * from "./createFlowDefinition201FlowDefinitionStepsItemComplete";
 export * from "./createFlowDefinition201FlowDefinitionStepsItemGates";
 export * from "./createFlowDefinition201FlowDefinitionStepsItemGatesConfig";
@@ -74,7 +74,7 @@ export * from "./createFlowDefinitionBody";
 export * from "./createFlowDefinitionBodyFlowDefinition";
 export * from "./createFlowDefinitionBodyFlowDefinitionAudience";
 export * from "./createFlowDefinitionBodyFlowDefinitionStepsItem";
-export * from "./createFlowDefinitionBodyFlowDefinitionStepsItemActions";
+export * from "./createFlowDefinitionBodyFlowDefinitionStepsItemActionsItem";
 export * from "./createFlowDefinitionBodyFlowDefinitionStepsItemComplete";
 export * from "./createFlowDefinitionBodyFlowDefinitionStepsItemGates";
 export * from "./createFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig";
@@ -178,7 +178,7 @@ export * from "./getFlowDefinition200";
 export * from "./getFlowDefinition200FlowDefinition";
 export * from "./getFlowDefinition200FlowDefinitionAudience";
 export * from "./getFlowDefinition200FlowDefinitionStepsItem";
-export * from "./getFlowDefinition200FlowDefinitionStepsItemActions";
+export * from "./getFlowDefinition200FlowDefinitionStepsItemActionsItem";
 export * from "./getFlowDefinition200FlowDefinitionStepsItemComplete";
 export * from "./getFlowDefinition200FlowDefinitionStepsItemGates";
 export * from "./getFlowDefinition200FlowDefinitionStepsItemGatesConfig";
@@ -193,15 +193,15 @@ export * from "./getFlowStep200";
 export * from "./getFlowStep200Branding";
 export * from "./getFlowStep200BrandingLayout";
 export * from "./getFlowStep200Step";
-export * from "./getFlowStep200StepActions";
+export * from "./getFlowStep200StepActionsItem";
 export * from "./getFlowStep200StepChallenge";
 export * from "./getFlowStep200StepChallengeMethod";
 export * from "./getFlowStep200StepChallengeOptions";
 export * from "./getFlowStep200StepComplete";
-export * from "./getFlowStep200StepFields";
-export * from "./getFlowStep200StepFieldsType";
-export * from "./getFlowStep200StepFieldsValidation";
-export * from "./getFlowStep200StepFieldsValidationFormat";
+export * from "./getFlowStep200StepFieldsItem";
+export * from "./getFlowStep200StepFieldsItemType";
+export * from "./getFlowStep200StepFieldsItemValidation";
+export * from "./getFlowStep200StepFieldsItemValidationFormat";
 export * from "./getFlowStep200StepGates";
 export * from "./getFlowStep200StepGatesConfig";
 export * from "./getFlowStep200StepGatesKind";
@@ -410,15 +410,15 @@ export * from "./submitFlowStep200";
 export * from "./submitFlowStep200Branding";
 export * from "./submitFlowStep200BrandingLayout";
 export * from "./submitFlowStep200Step";
-export * from "./submitFlowStep200StepActions";
+export * from "./submitFlowStep200StepActionsItem";
 export * from "./submitFlowStep200StepChallenge";
 export * from "./submitFlowStep200StepChallengeMethod";
 export * from "./submitFlowStep200StepChallengeOptions";
 export * from "./submitFlowStep200StepComplete";
-export * from "./submitFlowStep200StepFields";
-export * from "./submitFlowStep200StepFieldsType";
-export * from "./submitFlowStep200StepFieldsValidation";
-export * from "./submitFlowStep200StepFieldsValidationFormat";
+export * from "./submitFlowStep200StepFieldsItem";
+export * from "./submitFlowStep200StepFieldsItemType";
+export * from "./submitFlowStep200StepFieldsItemValidation";
+export * from "./submitFlowStep200StepFieldsItemValidationFormat";
 export * from "./submitFlowStep200StepGates";
 export * from "./submitFlowStep200StepGatesConfig";
 export * from "./submitFlowStep200StepGatesKind";
@@ -428,15 +428,15 @@ export * from "./submitFlowStep400";
 export * from "./submitFlowStep400Branding";
 export * from "./submitFlowStep400BrandingLayout";
 export * from "./submitFlowStep400Step";
-export * from "./submitFlowStep400StepActions";
+export * from "./submitFlowStep400StepActionsItem";
 export * from "./submitFlowStep400StepChallenge";
 export * from "./submitFlowStep400StepChallengeMethod";
 export * from "./submitFlowStep400StepChallengeOptions";
 export * from "./submitFlowStep400StepComplete";
-export * from "./submitFlowStep400StepFields";
-export * from "./submitFlowStep400StepFieldsType";
-export * from "./submitFlowStep400StepFieldsValidation";
-export * from "./submitFlowStep400StepFieldsValidationFormat";
+export * from "./submitFlowStep400StepFieldsItem";
+export * from "./submitFlowStep400StepFieldsItemType";
+export * from "./submitFlowStep400StepFieldsItemValidation";
+export * from "./submitFlowStep400StepFieldsItemValidationFormat";
 export * from "./submitFlowStep400StepGates";
 export * from "./submitFlowStep400StepGatesConfig";
 export * from "./submitFlowStep400StepGatesKind";
@@ -455,7 +455,7 @@ export * from "./updateFlowDefinition200";
 export * from "./updateFlowDefinition200FlowDefinition";
 export * from "./updateFlowDefinition200FlowDefinitionAudience";
 export * from "./updateFlowDefinition200FlowDefinitionStepsItem";
-export * from "./updateFlowDefinition200FlowDefinitionStepsItemActions";
+export * from "./updateFlowDefinition200FlowDefinitionStepsItemActionsItem";
 export * from "./updateFlowDefinition200FlowDefinitionStepsItemComplete";
 export * from "./updateFlowDefinition200FlowDefinitionStepsItemGates";
 export * from "./updateFlowDefinition200FlowDefinitionStepsItemGatesConfig";
@@ -470,7 +470,7 @@ export * from "./updateFlowDefinition404Details";
 export * from "./updateFlowDefinitionBody";
 export * from "./updateFlowDefinitionBodyAudience";
 export * from "./updateFlowDefinitionBodyStepsItem";
-export * from "./updateFlowDefinitionBodyStepsItemActions";
+export * from "./updateFlowDefinitionBodyStepsItemActionsItem";
 export * from "./updateFlowDefinitionBodyStepsItemComplete";
 export * from "./updateFlowDefinitionBodyStepsItemGates";
 export * from "./updateFlowDefinitionBodyStepsItemGatesConfig";

package/src/generated/model/submitFlowStep200.ts

@@ -18,9 +18,10 @@ export type SubmitFlowStep200 = {
   session_id: string;
   /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */
   session_token?: string;
-  /** A step contains unordered capability dictionaries: what to collect (fields),
+  /** A step contains ordered capability arrays: what to collect (fields),
   what the user can do (actions), and what security gates must be satisfied (gates).
-  Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+  The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+  and builds name-keyed indexes locally for lookup.
    */
   step: SubmitFlowStep200Step;
   /** Resolved branding configuration. Inherited from the app → team → project

package/src/generated/model/submitFlowStep200Step.ts

@@ -5,18 +5,19 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { SubmitFlowStep200StepActions } from "./submitFlowStep200StepActions";
+import type { SubmitFlowStep200StepActionsItem } from "./submitFlowStep200StepActionsItem";
 import type { SubmitFlowStep200StepChallenge } from "./submitFlowStep200StepChallenge";
 import type { SubmitFlowStep200StepComplete } from "./submitFlowStep200StepComplete";
-import type { SubmitFlowStep200StepFields } from "./submitFlowStep200StepFields";
+import type { SubmitFlowStep200StepFieldsItem } from "./submitFlowStep200StepFieldsItem";
 import type { SubmitFlowStep200StepGates } from "./submitFlowStep200StepGates";
 import type { SubmitFlowStep200StepSsoProvidersItem } from "./submitFlowStep200StepSsoProvidersItem";
 import type { SubmitFlowStep200StepTexts } from "./submitFlowStep200StepTexts";
 
 /**
- * A step contains unordered capability dictionaries: what to collect (fields),
+ * A step contains ordered capability arrays: what to collect (fields),
 what the user can do (actions), and what security gates must be satisfied (gates).
-Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+and builds name-keyed indexes locally for lookup.
 
  */
 export type SubmitFlowStep200Step = {
@@ -35,16 +36,16 @@ export type SubmitFlowStep200Step = {
   complete?: SubmitFlowStep200StepComplete;
   /** URL to navigate to (e.g., SSO provider redirect). */
   redirect_url?: string;
-  /** Unordered dictionary of input fields to collect. Keyed by field name.
-  The LiquidJS template controls which fields appear and in what order.
-  Field metadata (type, validation) is resolved by the engine from the
-  flow's user schema.
+  /** Ordered list of input fields to collect. Field metadata (type, validation)
+  is resolved by the engine from the flow's user schema. The LiquidJS
+  template iterates this array; for keyed lookup it builds a name-indexed
+  map locally.
    */
-  fields: SubmitFlowStep200StepFields;
-  /** Unordered dictionary of available user actions. Keyed by action name.
-  The LiquidJS template controls positioning and presentation.
+  fields: SubmitFlowStep200StepFieldsItem[];
+  /** Ordered list of available user actions. The LiquidJS template iterates
+  this array and builds a name-indexed map locally for keyed lookup.
    */
-  actions: SubmitFlowStep200StepActions;
+  actions: SubmitFlowStep200StepActionsItem[];
   /** Security gates that must be satisfied before the step can be submitted.
   The engine injects gates dynamically based on policy, even if they
   are not declared in the flow definition.

package/src/generated/model/{getFlowStep200StepActions.ts → submitFlowStep200StepActionsItem.ts}

@@ -7,22 +7,22 @@
  */
 
 /**
- * Unordered dictionary of available user actions. Keyed by action name.
-The LiquidJS template controls positioning and presentation.
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
 
  */
-export type GetFlowStep200StepActions = {
-  [key: string]: {
-    /** Marks this as the default/primary action. The runtime template uses
+export type SubmitFlowStep200StepActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */
+  name: string;
+  /** Marks this as the default/primary action. The runtime template uses
   this hint to choose visual emphasis. At most one action per step
   should be primary; this is not enforced here.
    */
-    primary?: boolean;
-    /** Optional localization key override for the action's label. When
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
   omitted, the engine derives a key from the step and action names.
   Display text is resolved client-side from a locale dictionary, never
   by the engine.
    */
-    text_key?: string;
-  };
+  text_key?: string;
 };

package/src/generated/model/submitFlowStep200StepFieldsItem.ts

@@ -0,0 +1,46 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { SubmitFlowStep200StepFieldsItemType } from "./submitFlowStep200StepFieldsItemType";
+import type { SubmitFlowStep200StepFieldsItemValidation } from "./submitFlowStep200StepFieldsItemValidation";
+
+/**
+ * A data input capability. Describes what the user must provide.
+Does not contain display text — only a `text_key` resolved client-side.
+
+ */
+export type SubmitFlowStep200StepFieldsItem = {
+  /** Field name, matching a property in the flow's user schema. Carries
+  the submitted value back to the engine.
+   */
+  name: string;
+  /** The input kind the client should render. Encodes the formats and
+  JSON types that map to a familiar HTML input: `email`, `url`,
+  `date` come from `format`; `checkbox` from JSON `type: boolean`;
+  `select` from a closed `enum`. For other formats (e.g. uuid) the
+  type is `text` and `validation.format` carries the rule.
+   */
+  type: SubmitFlowStep200StepFieldsItemType;
+  /** Localization key for the field label. */
+  text_key: string;
+  /** The field MUST be present and non-empty on submit. Mirrors the
+  schema's top-level `required` array.
+   */
+  required?: boolean;
+  /** Pre-filled value (e.g., an identifier carried over from a pivot). */
+  value?: unknown;
+  /** Schema-derived rules the frontend SHOULD apply at input time. The
+  server runs the same rules on submit and is the only authority on
+  whether the step advances — these rules are a UX hint to reduce
+  round trips, not a contract guarantee.
+
+  Omitted entirely when the field has no rules beyond its `type`.
+  Each key mirrors a JSON Schema keyword on the underlying user
+  property; absent keys mean no rule.
+   */
+  validation?: SubmitFlowStep200StepFieldsItemValidation;
+};

package/src/generated/model/submitFlowStep200StepFieldsItemType.ts

@@ -0,0 +1,31 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The input kind the client should render. Encodes the formats and
+JSON types that map to a familiar HTML input: `email`, `url`,
+`date` come from `format`; `checkbox` from JSON `type: boolean`;
+`select` from a closed `enum`. For other formats (e.g. uuid) the
+type is `text` and `validation.format` carries the rule.
+
+ */
+export type SubmitFlowStep200StepFieldsItemType =
+  (typeof SubmitFlowStep200StepFieldsItemType)[keyof typeof SubmitFlowStep200StepFieldsItemType];
+
+export const SubmitFlowStep200StepFieldsItemType = {
+  text: "text",
+  email: "email",
+  password: "password",
+  tel: "tel",
+  number: "number",
+  url: "url",
+  date: "date",
+  hidden: "hidden",
+  checkbox: "checkbox",
+  select: "select",
+} as const;

package/src/generated/model/{submitFlowStep200StepFieldsValidation.ts → submitFlowStep200StepFieldsItemValidation.ts}

@@ -5,7 +5,7 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { SubmitFlowStep200StepFieldsValidationFormat } from "./submitFlowStep200StepFieldsValidationFormat";
+import type { SubmitFlowStep200StepFieldsItemValidationFormat } from "./submitFlowStep200StepFieldsItemValidationFormat";
 
 /**
  * Schema-derived rules the frontend SHOULD apply at input time. The
@@ -18,14 +18,14 @@ Each key mirrors a JSON Schema keyword on the underlying user
 property; absent keys mean no rule.
 
  */
-export type SubmitFlowStep200StepFieldsValidation = {
+export type SubmitFlowStep200StepFieldsItemValidation = {
   /** Semantic format the value must match. Values mirror the user
   meta-schema. When `type` already encodes the format (email,
   url, date), this key is informative and the input type is
   sufficient for client-side validation. When `type` is `text`
   (e.g. `format: uuid`), this key is the only signal.
    */
-  format?: SubmitFlowStep200StepFieldsValidationFormat;
+  format?: SubmitFlowStep200StepFieldsItemValidationFormat;
   /**
    * Minimum length in characters (inclusive). Mirrors `minLength`.
    * @minimum 0
@@ -36,4 +36,10 @@ export type SubmitFlowStep200StepFieldsValidation = {
    * @minimum 0
    */
   max_length?: number;
+  /** Closed list of allowed values. Mirrors the JSON Schema `enum`
+  keyword on the underlying user property. When `type` is
+  `select` the client renders these as options; for other types
+  the rule still applies as a membership check.
+   */
+  enum?: string[];
 };

package/src/generated/model/{createFlow201StepFieldsValidationFormat.ts → submitFlowStep200StepFieldsItemValidationFormat.ts}

@@ -14,10 +14,10 @@ sufficient for client-side validation. When `type` is `text`
 (e.g. `format: uuid`), this key is the only signal.
 
  */
-export type CreateFlow201StepFieldsValidationFormat =
-  (typeof CreateFlow201StepFieldsValidationFormat)[keyof typeof CreateFlow201StepFieldsValidationFormat];
+export type SubmitFlowStep200StepFieldsItemValidationFormat =
+  (typeof SubmitFlowStep200StepFieldsItemValidationFormat)[keyof typeof SubmitFlowStep200StepFieldsItemValidationFormat];
 
-export const CreateFlow201StepFieldsValidationFormat = {
+export const SubmitFlowStep200StepFieldsItemValidationFormat = {
   email: "email",
   "date-time": "date-time",
   uuid: "uuid",

package/src/generated/model/submitFlowStep400.ts

@@ -18,9 +18,10 @@ export type SubmitFlowStep400 = {
   session_id: string;
   /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */
   session_token?: string;
-  /** A step contains unordered capability dictionaries: what to collect (fields),
+  /** A step contains ordered capability arrays: what to collect (fields),
   what the user can do (actions), and what security gates must be satisfied (gates).
-  Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+  The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+  and builds name-keyed indexes locally for lookup.
    */
   step: SubmitFlowStep400Step;
   /** Resolved branding configuration. Inherited from the app → team → project

package/src/generated/model/submitFlowStep400Step.ts

@@ -5,18 +5,19 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { SubmitFlowStep400StepActions } from "./submitFlowStep400StepActions";
+import type { SubmitFlowStep400StepActionsItem } from "./submitFlowStep400StepActionsItem";
 import type { SubmitFlowStep400StepChallenge } from "./submitFlowStep400StepChallenge";
 import type { SubmitFlowStep400StepComplete } from "./submitFlowStep400StepComplete";
-import type { SubmitFlowStep400StepFields } from "./submitFlowStep400StepFields";
+import type { SubmitFlowStep400StepFieldsItem } from "./submitFlowStep400StepFieldsItem";
 import type { SubmitFlowStep400StepGates } from "./submitFlowStep400StepGates";
 import type { SubmitFlowStep400StepSsoProvidersItem } from "./submitFlowStep400StepSsoProvidersItem";
 import type { SubmitFlowStep400StepTexts } from "./submitFlowStep400StepTexts";
 
 /**
- * A step contains unordered capability dictionaries: what to collect (fields),
+ * A step contains ordered capability arrays: what to collect (fields),
 what the user can do (actions), and what security gates must be satisfied (gates).
-Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+and builds name-keyed indexes locally for lookup.
 
  */
 export type SubmitFlowStep400Step = {
@@ -35,16 +36,16 @@ export type SubmitFlowStep400Step = {
   complete?: SubmitFlowStep400StepComplete;
   /** URL to navigate to (e.g., SSO provider redirect). */
   redirect_url?: string;
-  /** Unordered dictionary of input fields to collect. Keyed by field name.
-  The LiquidJS template controls which fields appear and in what order.
-  Field metadata (type, validation) is resolved by the engine from the
-  flow's user schema.
+  /** Ordered list of input fields to collect. Field metadata (type, validation)
+  is resolved by the engine from the flow's user schema. The LiquidJS
+  template iterates this array; for keyed lookup it builds a name-indexed
+  map locally.
    */
-  fields: SubmitFlowStep400StepFields;
-  /** Unordered dictionary of available user actions. Keyed by action name.
-  The LiquidJS template controls positioning and presentation.
+  fields: SubmitFlowStep400StepFieldsItem[];
+  /** Ordered list of available user actions. The LiquidJS template iterates
+  this array and builds a name-indexed map locally for keyed lookup.
    */
-  actions: SubmitFlowStep400StepActions;
+  actions: SubmitFlowStep400StepActionsItem[];
   /** Security gates that must be satisfied before the step can be submitted.
   The engine injects gates dynamically based on policy, even if they
   are not declared in the flow definition.

package/src/generated/model/{submitFlowStep400StepActions.ts → submitFlowStep400StepActionsItem.ts}

@@ -7,22 +7,22 @@
  */
 
 /**
- * Unordered dictionary of available user actions. Keyed by action name.
-The LiquidJS template controls positioning and presentation.
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
 
  */
-export type SubmitFlowStep400StepActions = {
-  [key: string]: {
-    /** Marks this as the default/primary action. The runtime template uses
+export type SubmitFlowStep400StepActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */
+  name: string;
+  /** Marks this as the default/primary action. The runtime template uses
   this hint to choose visual emphasis. At most one action per step
   should be primary; this is not enforced here.
    */
-    primary?: boolean;
-    /** Optional localization key override for the action's label. When
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
   omitted, the engine derives a key from the step and action names.
   Display text is resolved client-side from a locale dictionary, never
   by the engine.
    */
-    text_key?: string;
-  };
+  text_key?: string;
 };

package/src/generated/model/submitFlowStep400StepFieldsItem.ts

@@ -0,0 +1,46 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { SubmitFlowStep400StepFieldsItemType } from "./submitFlowStep400StepFieldsItemType";
+import type { SubmitFlowStep400StepFieldsItemValidation } from "./submitFlowStep400StepFieldsItemValidation";
+
+/**
+ * A data input capability. Describes what the user must provide.
+Does not contain display text — only a `text_key` resolved client-side.
+
+ */
+export type SubmitFlowStep400StepFieldsItem = {
+  /** Field name, matching a property in the flow's user schema. Carries
+  the submitted value back to the engine.
+   */
+  name: string;
+  /** The input kind the client should render. Encodes the formats and
+  JSON types that map to a familiar HTML input: `email`, `url`,
+  `date` come from `format`; `checkbox` from JSON `type: boolean`;
+  `select` from a closed `enum`. For other formats (e.g. uuid) the
+  type is `text` and `validation.format` carries the rule.
+   */
+  type: SubmitFlowStep400StepFieldsItemType;
+  /** Localization key for the field label. */
+  text_key: string;
+  /** The field MUST be present and non-empty on submit. Mirrors the
+  schema's top-level `required` array.
+   */
+  required?: boolean;
+  /** Pre-filled value (e.g., an identifier carried over from a pivot). */
+  value?: unknown;
+  /** Schema-derived rules the frontend SHOULD apply at input time. The
+  server runs the same rules on submit and is the only authority on
+  whether the step advances — these rules are a UX hint to reduce
+  round trips, not a contract guarantee.
+
+  Omitted entirely when the field has no rules beyond its `type`.
+  Each key mirrors a JSON Schema keyword on the underlying user
+  property; absent keys mean no rule.
+   */
+  validation?: SubmitFlowStep400StepFieldsItemValidation;
+};

package/src/generated/model/submitFlowStep400StepFieldsItemType.ts

@@ -0,0 +1,31 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The input kind the client should render. Encodes the formats and
+JSON types that map to a familiar HTML input: `email`, `url`,
+`date` come from `format`; `checkbox` from JSON `type: boolean`;
+`select` from a closed `enum`. For other formats (e.g. uuid) the
+type is `text` and `validation.format` carries the rule.
+
+ */
+export type SubmitFlowStep400StepFieldsItemType =
+  (typeof SubmitFlowStep400StepFieldsItemType)[keyof typeof SubmitFlowStep400StepFieldsItemType];
+
+export const SubmitFlowStep400StepFieldsItemType = {
+  text: "text",
+  email: "email",
+  password: "password",
+  tel: "tel",
+  number: "number",
+  url: "url",
+  date: "date",
+  hidden: "hidden",
+  checkbox: "checkbox",
+  select: "select",
+} as const;

package/src/generated/model/{submitFlowStep400StepFieldsValidation.ts → submitFlowStep400StepFieldsItemValidation.ts}

@@ -5,7 +5,7 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { SubmitFlowStep400StepFieldsValidationFormat } from "./submitFlowStep400StepFieldsValidationFormat";
+import type { SubmitFlowStep400StepFieldsItemValidationFormat } from "./submitFlowStep400StepFieldsItemValidationFormat";
 
 /**
  * Schema-derived rules the frontend SHOULD apply at input time. The
@@ -18,14 +18,14 @@ Each key mirrors a JSON Schema keyword on the underlying user
 property; absent keys mean no rule.
 
  */
-export type SubmitFlowStep400StepFieldsValidation = {
+export type SubmitFlowStep400StepFieldsItemValidation = {
   /** Semantic format the value must match. Values mirror the user
   meta-schema. When `type` already encodes the format (email,
   url, date), this key is informative and the input type is
   sufficient for client-side validation. When `type` is `text`
   (e.g. `format: uuid`), this key is the only signal.
    */
-  format?: SubmitFlowStep400StepFieldsValidationFormat;
+  format?: SubmitFlowStep400StepFieldsItemValidationFormat;
   /**
    * Minimum length in characters (inclusive). Mirrors `minLength`.
    * @minimum 0
@@ -36,4 +36,10 @@ export type SubmitFlowStep400StepFieldsValidation = {
    * @minimum 0
    */
   max_length?: number;
+  /** Closed list of allowed values. Mirrors the JSON Schema `enum`
+  keyword on the underlying user property. When `type` is
+  `select` the client renders these as options; for other types
+  the rule still applies as a membership check.
+   */
+  enum?: string[];
 };

package/src/generated/model/{getFlowStep200StepFieldsValidationFormat.ts → submitFlowStep400StepFieldsItemValidationFormat.ts}

@@ -14,10 +14,10 @@ sufficient for client-side validation. When `type` is `text`
 (e.g. `format: uuid`), this key is the only signal.
 
  */
-export type GetFlowStep200StepFieldsValidationFormat =
-  (typeof GetFlowStep200StepFieldsValidationFormat)[keyof typeof GetFlowStep200StepFieldsValidationFormat];
+export type SubmitFlowStep400StepFieldsItemValidationFormat =
+  (typeof SubmitFlowStep400StepFieldsItemValidationFormat)[keyof typeof SubmitFlowStep400StepFieldsItemValidationFormat];
 
-export const GetFlowStep200StepFieldsValidationFormat = {
+export const SubmitFlowStep400StepFieldsItemValidationFormat = {
   email: "email",
   "date-time": "date-time",
   uuid: "uuid",

package/src/generated/model/updateFlowDefinition200FlowDefinitionStepsItem.ts

@@ -5,7 +5,7 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { UpdateFlowDefinition200FlowDefinitionStepsItemActions } from "./updateFlowDefinition200FlowDefinitionStepsItemActions";
+import type { UpdateFlowDefinition200FlowDefinitionStepsItemActionsItem } from "./updateFlowDefinition200FlowDefinitionStepsItemActionsItem";
 import type { UpdateFlowDefinition200FlowDefinitionStepsItemComplete } from "./updateFlowDefinition200FlowDefinitionStepsItemComplete";
 import type { UpdateFlowDefinition200FlowDefinitionStepsItemGates } from "./updateFlowDefinition200FlowDefinitionStepsItemGates";
 import type { UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess } from "./updateFlowDefinition200FlowDefinitionStepsItemOnSuccess";
@@ -36,11 +36,11 @@ export type UpdateFlowDefinition200FlowDefinitionStepsItem = {
   transition outcome).
    */
   fields?: string[];
-  /** Actions the user can take. Keyed by action name.
-  The action name is what the frontend sends back in the submit request.
-  If omitted, the engine provides a default `submit` action.
+  /** Ordered list of actions the user can take. The action name is what the
+  frontend sends back in the submit request. If omitted, the engine
+  provides a default `submit` action.
    */
-  actions?: UpdateFlowDefinition200FlowDefinitionStepsItemActions;
+  actions?: UpdateFlowDefinition200FlowDefinitionStepsItemActionsItem[];
   /** Security gates that must be satisfied before submission. Keyed by gate
   name. Each gate selects a kind (e.g. "captcha") and provider-specific
   configuration. The engine may also inject gates dynamically based on
@@ -62,7 +62,7 @@ export type UpdateFlowDefinition200FlowDefinitionStepsItem = {
   complete?: UpdateFlowDefinition200FlowDefinitionStepsItemComplete;
   /** Maps action/outcome names to their transition descriptor.
 
-  Keys match action names from the `actions` dict. Additional keys
+  Keys match action names from the `actions` array. Additional keys
   come from implicit outcomes based on schema annotations
   (e.g. `user_not_found` from `x-unique` fields) and engine
   events (e.g. `sso`, `callback`).