@zitadel/components 0.1.0-alpha.0 → 0.1.0-alpha.2

package/dist/{index-Dd8hfOWt.d.mts → index-DmtnqUIY.d.mts}

@@ -168,10 +168,16 @@ declare class ZlButton extends LitElement {
   accessor disabled: boolean;
   accessor block: boolean;
   accessor label: string | undefined;
+  /**
+   * Forces a visual interaction state on the inner button, projected to its
+   * `data-state` attribute. Used by the design playground to capture
+   * hover/pressed/focus states; reactive so toggling the host attribute
+   * re-renders.
+   */
+  accessor forcedState: string | null;
   private readonly internals;
   constructor();
   focus(options?: FocusOptions): void;
-  private surfaceClasses;
   render(): _$lit.TemplateResult<1>;
   private handleClick;
 }
@@ -217,6 +223,13 @@ declare class ZlCard extends LitElement {
   static styles: _$lit.CSSResult[];
   accessor compact: boolean;
   render(): _$lit.TemplateResult<1>;
+  /**
+   * `lightDomSlotFilled` is a render-time snapshot, so re-run render whenever a
+   * named slot's assignment changes (e.g. a header added after first paint).
+   * The initial render still reads children synchronously, avoiding the
+   * empty-then-filled flash a slotchange-only approach would introduce.
+   */
+  private onSlotChange;
   /** Slotted nodes are always light-DOM children of the host in our templates. */
   private lightDomSlotFilled;
 }
@@ -227,7 +240,7 @@ declare global {
   }
 } //# sourceMappingURL=zl-card.d.ts.map
 //#endregion
-//#region ../api/dist/index-DlEenfQJ.d.mts
+//#region ../api/dist/index-DyBulyp9.d.mts
 //#region src/generated/model/authorizeDevice200.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -1242,168 +1255,7 @@ type CreateFlowBody = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/createFlowDefinition201.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type CreateFlowDefinition201 = {
-  /**
-     * Stable identifier for this flow, used as the target of cross-flow
-  `switch` and `pivot` transitions. Renaming is not supported — the
-  `name` is part of the public contract another definition may
-  reference. Acts as the human display label as well; no separate slug.
-        * @pattern ^[a-z][a-z0-9-]*$
-     */
-  name: string;
-  /** User schema this flow operates on. Step `fields` reference properties
-  defined in this schema. The engine resolves field types, validation,
-  and implicit outcomes from schema annotations at runtime.
-   */
-  user_schema: string;
-  /** Maps each purpose this definition handles to its entry-point step.
-  Keys are purpose names; values must match a `name` in `steps`. A
-  definition can serve multiple purposes (e.g. a combined login/register
-  flow) by listing one entry per purpose.
-   */
-  purposes: Partial<Record<"login" | "register" | "recovery" | "profiling" | "reauth" | "link_account", string>>;
-  /** Scopes which teams or apps this flow definition applies to. Empty or
-  omitted fields mean "no restriction"; when both are empty the definition
-  matches every request in the project. The engine picks the most specific
-  matching definition: app > team > project-wide.
-   */
-  audience?: {
-    /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
-    app_ids?: string[];
-  };
-  /**
-     * Ordered list of steps in this flow. The order is for human readability —
-  actual step sequencing is determined by transitions.
-        * @minItems 1
-     */
-  steps: {
-    /** Unique step identifier within this flow. Used as transition targets
-    and returned in the API response as `step.name`.
-    */
-    name: string;
-    /** Schema property names to collect from the user. Each entry references
-    a property in the flow's user schema. The engine resolves field type,
-    validation rules, and implicit outcomes from schema annotations
-    (e.g. a property with `x-unique` set implies a `user_not_found`
-    transition outcome).
-    */
-    fields?: string[];
-    /** Actions the user can take. Keyed by action name.
-    The action name is what the frontend sends back in the submit request.
-    If omitted, the engine provides a default `submit` action.
-    */
-    actions?: {
-      [key: string]: {
-        /** Marks this as the default/primary action. The runtime template uses
-        this hint to choose visual emphasis. At most one action per step
-        should be primary; this is not enforced here.
-        */
-        primary?: boolean;
-        /** Optional localization key override for the action's label. When
-        omitted, the engine derives a key from the step and action names.
-        Display text is resolved client-side from a locale dictionary, never
-        by the engine.
-        */
-        text_key?: string;
-      };
-    };
-    /** Security gates that must be satisfied before submission. Keyed by gate
-    name. Each gate selects a kind (e.g. "captcha") and provider-specific
-    configuration. The engine may also inject gates dynamically based on
-    policy.
-    */
-    gates?: {
-      [key: string]: {
-        /** The gate category. Only `captcha` is currently defined. Authenticator
-        ceremonies (e.g. passkey) are modelled as credential auth_attempts via
-        `x-credential` on a field, not as gates.
-        */
-        kind: "captcha";
-        /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
-        `hcaptcha`. The engine looks up an implementation in its provider
-        registry.
-        */
-        provider: string;
-        /** Provider-specific configuration consumed by the implementation when
-        issuing the per-render challenge. Opaque to the engine.
-        */
-        config?: {
-          [key: string]: unknown;
-        };
-      };
-    }; /** Available SSO identity providers for this step. */
-    sso_providers?: {
-      /** Provider instance identifier. */id: string; /** Display name for the provider. */
-      name: string; /** Template hint for rendering (logo, colors). */
-      template: string;
-    }[];
-    /** Server-side mutation to execute when this step completes successfully.
-    Runs after field validation passes, before the transition fires.
-       - create_user: creates the user record (registration flows)
-    */
-    on_success?: "create_user";
-    /** Marks this as a terminal step. Tells the frontend what to do:
-    - redirect: navigate to redirect_uri (OIDC/SAML callback done)
-    - show: render as a success/info screen
-    */
-    complete?: "redirect" | "show";
-    /** Maps action/outcome names to their transition descriptor.
-       Keys match action names from the `actions` dict. Additional keys
-    come from implicit outcomes based on schema annotations
-    (e.g. `user_not_found` from `x-unique` fields) and engine
-    events (e.g. `sso`, `callback`).
-    */
-    transitions?: {
-      [key: string]: {
-        /** Step name within this flow (when `action` is null), or the name
-        of another flow (when `action` is `switch` or `pivot`).
-        */
-        target: string;
-        /** How to interpret `target`:
-        - null (omitted): transition to a step in the current flow.
-        - switch: replace the current flow with the target flow.
-        No return — the current flow is discarded.
-        Example: login ↔ register.
-        - pivot: push the target flow onto the stack. The current flow
-        is paused and resumes when the target flow completes (auto-pop).
-        Example: login → recovery → back to login.
-        */
-        action?: "switch" | "pivot" | null;
-      };
-    };
-  }[];
-} & {
-  /** Unique identifier for the flow definition. */id: string; /** Identifier of the project this flow definition belongs to. */
-  project_id: string;
-  /** URI of the flow definition schema this definition was authored against.
-  If the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.
-   */
-  schema_uri: string; /** Status of the flow definition. */
-  status: string;
-  created_at: string;
-  updated_at: string;
-}; //#endregion
-//#region src/generated/model/createFlowDefinition400Details.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-/**
- * Additional error-specific context.
- */
-//#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionAudience.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionAudience.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1418,11 +1270,11 @@ matches every request in the project. The engine picks the most specific
 matching definition: app > team > project-wide.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionAudience = {
+type CreateFlowDefinition201FlowDefinitionAudience = {
   /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
   app_ids?: string[];
 }; //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemActions.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemActions.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1436,7 +1288,7 @@ The action name is what the frontend sends back in the submit request.
 If omitted, the engine provides a default `submit` action.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemActions = {
+type CreateFlowDefinition201FlowDefinitionStepsItemActions = {
   [key: string]: {
     /** Marks this as the default/primary action. The runtime template uses
     this hint to choose visual emphasis. At most one action per step
@@ -1451,7 +1303,7 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItemActions = {
     text_key?: string;
   };
 }; //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemComplete.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemComplete.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1465,12 +1317,12 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItemActions = {
 - show: render as a success/info screen
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete];
-declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete: {
+type CreateFlowDefinition201FlowDefinitionStepsItemComplete = (typeof CreateFlowDefinition201FlowDefinitionStepsItemComplete)[keyof typeof CreateFlowDefinition201FlowDefinitionStepsItemComplete];
+declare const CreateFlowDefinition201FlowDefinitionStepsItemComplete: {
   readonly redirect: "redirect";
   readonly show: "show";
 }; //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemGatesConfig.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1483,10 +1335,10 @@ declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete: {
 issuing the per-render challenge. Opaque to the engine.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig = {
+type CreateFlowDefinition201FlowDefinitionStepsItemGatesConfig = {
   [key: string]: unknown;
 }; //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGatesKind.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemGatesKind.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1500,11 +1352,11 @@ ceremonies (e.g. passkey) are modelled as credential auth_attempts via
 `x-credential` on a field, not as gates.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind];
-declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind: {
+type CreateFlowDefinition201FlowDefinitionStepsItemGatesKind = (typeof CreateFlowDefinition201FlowDefinitionStepsItemGatesKind)[keyof typeof CreateFlowDefinition201FlowDefinitionStepsItemGatesKind];
+declare const CreateFlowDefinition201FlowDefinitionStepsItemGatesKind: {
   readonly captcha: "captcha";
 }; //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGates.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemGates.d.ts
 /**
  * Security gates that must be satisfied before submission. Keyed by gate
 name. Each gate selects a kind (e.g. "captcha") and provider-specific
@@ -1512,13 +1364,13 @@ configuration. The engine may also inject gates dynamically based on
 policy.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemGates = {
+type CreateFlowDefinition201FlowDefinitionStepsItemGates = {
   [key: string]: {
     /** The gate category. Only `captcha` is currently defined. Authenticator
     ceremonies (e.g. passkey) are modelled as credential auth_attempts via
     `x-credential` on a field, not as gates.
     */
-    kind: CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind;
+    kind: CreateFlowDefinition201FlowDefinitionStepsItemGatesKind;
     /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
     `hcaptcha`. The engine looks up an implementation in its provider
     registry.
@@ -1527,10 +1379,10 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItemGates = {
     /** Provider-specific configuration consumed by the implementation when
     issuing the per-render challenge. Opaque to the engine.
     */
-    config?: CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig;
+    config?: CreateFlowDefinition201FlowDefinitionStepsItemGatesConfig;
   };
 }; //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemOnSuccess.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1545,11 +1397,11 @@ Runs after field validation passes, before the transition fires.
 - create_user: creates the user record (registration flows)
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess];
-declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess: {
+type CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess = (typeof CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess)[keyof typeof CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess];
+declare const CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess: {
   readonly create_user: "create_user";
 }; //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemSsoProvidersItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1560,12 +1412,12 @@ declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess: {
 /**
  * An available SSO identity provider.
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem = {
+type CreateFlowDefinition201FlowDefinitionStepsItemSsoProvidersItem = {
   /** Provider instance identifier. */id: string; /** Display name for the provider. */
   name: string; /** Template hint for rendering (logo, colors). */
   template: string;
 }; //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemTransitions.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemTransitions.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1582,7 +1434,7 @@ come from implicit outcomes based on schema annotations
 events (e.g. `sso`, `callback`).
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions = {
+type CreateFlowDefinition201FlowDefinitionStepsItemTransitions = {
   [key: string]: {
     /** Step name within this flow (when `action` is null), or the name
     of another flow (when `action` is `switch` or `pivot`).
@@ -1600,7 +1452,7 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions = {
     action?: "switch" | "pivot" | null;
   };
 }; //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItem.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItem.d.ts
 /**
  * A step in a flow definition. This is the admin-authored configuration,
 not the runtime payload sent to the frontend.
@@ -1613,7 +1465,7 @@ A step with only `complete` set is a terminal step. All other steps are
 rendered to the frontend as capability payloads.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItem = {
+type CreateFlowDefinition201FlowDefinitionStepsItem = {
   /** Unique step identifier within this flow. Used as transition targets
   and returned in the API response as `step.name`.
    */
@@ -1629,33 +1481,33 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItem = {
   The action name is what the frontend sends back in the submit request.
   If omitted, the engine provides a default `submit` action.
    */
-  actions?: CreateFlowDefinitionBodyFlowDefinitionStepsItemActions;
+  actions?: CreateFlowDefinition201FlowDefinitionStepsItemActions;
   /** Security gates that must be satisfied before submission. Keyed by gate
   name. Each gate selects a kind (e.g. "captcha") and provider-specific
   configuration. The engine may also inject gates dynamically based on
   policy.
    */
-  gates?: CreateFlowDefinitionBodyFlowDefinitionStepsItemGates; /** Available SSO identity providers for this step. */
-  sso_providers?: CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem[];
+  gates?: CreateFlowDefinition201FlowDefinitionStepsItemGates; /** Available SSO identity providers for this step. */
+  sso_providers?: CreateFlowDefinition201FlowDefinitionStepsItemSsoProvidersItem[];
   /** Server-side mutation to execute when this step completes successfully.
   Runs after field validation passes, before the transition fires.
      - create_user: creates the user record (registration flows)
    */
-  on_success?: CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess;
+  on_success?: CreateFlowDefinition201FlowDefinitionStepsItemOnSuccess;
   /** Marks this as a terminal step. Tells the frontend what to do:
   - redirect: navigate to redirect_uri (OIDC/SAML callback done)
   - show: render as a success/info screen
    */
-  complete?: CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete;
+  complete?: CreateFlowDefinition201FlowDefinitionStepsItemComplete;
   /** Maps action/outcome names to their transition descriptor.
      Keys match action names from the `actions` dict. Additional keys
   come from implicit outcomes based on schema annotations
   (e.g. `user_not_found` from `x-unique` fields) and engine
   events (e.g. `sso`, `callback`).
    */
-  transitions?: CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions;
+  transitions?: CreateFlowDefinition201FlowDefinitionStepsItemTransitions;
 }; //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinition.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinition.d.ts
 /**
  * A flow definition is the server-side configuration that describes a complete
 authentication or identity flow. It is NOT sent to the frontend — the flow
@@ -1667,7 +1519,7 @@ configuration hierarchy. The engine selects the matching definition based on
 the purpose + audience when a flow is created via POST /flow.
 
  */
-type CreateFlowDefinitionBodyFlowDefinition = {
+type CreateFlowDefinition201FlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
   `switch` and `pivot` transitions. Renaming is not supported — the
@@ -1692,22 +1544,19 @@ type CreateFlowDefinitionBodyFlowDefinition = {
   matches every request in the project. The engine picks the most specific
   matching definition: app > team > project-wide.
    */
-  audience?: CreateFlowDefinitionBodyFlowDefinitionAudience;
+  audience?: CreateFlowDefinition201FlowDefinitionAudience;
   /**
      * Ordered list of steps in this flow. The order is for human readability —
   actual step sequencing is determined by transitions.
         * @minItems 1
      */
-  steps: CreateFlowDefinitionBodyFlowDefinitionStepsItem[];
+  steps: CreateFlowDefinition201FlowDefinitionStepsItem[];
 }; //#endregion
-//#region src/generated/model/createFlowDefinitionBody.d.ts
-type CreateFlowDefinitionBody = {
-  /** @pattern ^[a-zA-Z0-9_-]+$ */project_id: string;
-  /** URI of the server-published flow definition schema this definition was
-  authored against. The server uses this to validate the definition.
-  If not provided, the engine will use the latest schema version for validation.
-   */
-  schema_uri?: string;
+//#region src/generated/model/createFlowDefinition201.d.ts
+type CreateFlowDefinition201 = {
+  /** Unique identifier for the flow definition. */id: string; /** Identifier of the project this flow definition belongs to. */
+  project_id: string; /** Status of the flow definition. */
+  status: string;
   /** A flow definition is the server-side configuration that describes a complete
   authentication or identity flow. It is NOT sent to the frontend — the flow
   engine evaluates it and produces FlowResponse payloads (steps with capability
@@ -1716,9 +1565,11 @@ type CreateFlowDefinitionBody = {
   configuration hierarchy. The engine selects the matching definition based on
   the purpose + audience when a flow is created via POST /flow.
    */
-  flow_definition: CreateFlowDefinitionBodyFlowDefinition;
+  flow_definition: CreateFlowDefinition201FlowDefinition;
+  created_at: string;
+  updated_at: string;
 }; //#endregion
-//#region src/generated/model/createFlowDefinitionDefaultDetails.d.ts
+//#region src/generated/model/createFlowDefinition400Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1730,7 +1581,7 @@ type CreateFlowDefinitionBody = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/createHandoff200.d.ts
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionAudience.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1739,26 +1590,17 @@ type CreateFlowDefinitionBody = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * The handoff token and metadata for session exchange.
-
-This is a short-lived credential (TTL ≤ 60 seconds) that the client must exchange
-at POST /sessions/exchange to receive the final session and session_token.
-The handoff token is single-use and audience-bound to the project.
+ * Scopes which teams or apps this flow definition applies to. Empty or
+omitted fields mean "no restriction"; when both are empty the definition
+matches every request in the project. The engine picks the most specific
+matching definition: app > team > project-wide.
 
  */
-type CreateHandoff200 = {
-  /** The short-lived handoff token for session exchange.
-     Exchange at: POST /sessions/exchange
-     Requirements:
-  - Single-use (atomic GETDEL on exchange)
-  - TTL ≤ 60 seconds
-  - Audience-bound to project (exchange requires sk_proj_… for matching project)
-  - Idempotency-safe (Category B, 5-minute window)
-   */
-  handoff_token: string; /** When this handoff token expires */
-  expires_at: string;
+type CreateFlowDefinitionBodyFlowDefinitionAudience = {
+  /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
+  app_ids?: string[];
 }; //#endregion
-//#region src/generated/model/createHandoffDefault.d.ts
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemActions.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1766,29 +1608,28 @@ type CreateHandoff200 = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-//#endregion
-//#region src/generated/model/createProject201.d.ts
 /**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
+ * Actions the user can take. Keyed by action name.
+The action name is what the frontend sends back in the submit request.
+If omitted, the engine provides a default `submit` action.
+
  */
-type CreateProject201 = {
-  /** The unique identifier of the project. */id: string;
-  /** Secret which can be used for authentication when modifying the project.
-   */
-  projectSecret: string;
-  /** Secret which can be used for previewing and testing the project.
-   */
-  previewSecret: string;
-  /** Origins which are allowed for previewing and testing the project.
-   */
-  previewOrigins: string[]; /** The time when the project was created. */
-  createdAt: string;
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemActions = {
+  [key: string]: {
+    /** Marks this as the default/primary action. The runtime template uses
+    this hint to choose visual emphasis. At most one action per step
+    should be primary; this is not enforced here.
+    */
+    primary?: boolean;
+    /** Optional localization key override for the action's label. When
+    omitted, the engine derives a key from the step and action names.
+    Display text is resolved client-side from a locale dictionary, never
+    by the engine.
+    */
+    text_key?: string;
+  };
 }; //#endregion
-//#region src/generated/model/createProject429Details.d.ts
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemComplete.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1797,23 +1638,17 @@ type CreateProject201 = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
- */
-//#endregion
-//#region src/generated/model/createProjectBody.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
+ * Marks this as a terminal step. Tells the frontend what to do:
+- redirect: navigate to redirect_uri (OIDC/SAML callback done)
+- show: render as a success/info screen
+
  */
-type CreateProjectBody = {
-  /** Origins which are allowed for previewing and testing the project.
-   */
-  previewOrigins?: string[];
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete];
+declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete: {
+  readonly redirect: "redirect";
+  readonly show: "show";
 }; //#endregion
-//#region src/generated/model/createProjectDefaultDetails.d.ts
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1822,21 +1657,14 @@ type CreateProjectBody = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
- */
-//#endregion
-//#region src/generated/model/createSchema201.d.ts
-/**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
+ * Provider-specific configuration consumed by the implementation when
+issuing the per-render challenge. Opaque to the engine.
+
  */
-type CreateSchema201 = {
-  /** The ID of the created schema */id: string;
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig = {
+  [key: string]: unknown;
 }; //#endregion
-//#region src/generated/model/createSchema400Details.d.ts
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGatesKind.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1845,18 +1673,368 @@ type CreateSchema201 = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
+ * The gate category. Only `captcha` is currently defined. Authenticator
+ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+`x-credential` on a field, not as gates.
+
  */
-//#endregion
-//#region src/generated/model/createSchemaBody.d.ts
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind];
+declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind: {
+  readonly captcha: "captcha";
+}; //#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemGates.d.ts
 /**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
- */
-type CreateSchemaBody = {
+ * Security gates that must be satisfied before submission. Keyed by gate
+name. Each gate selects a kind (e.g. "captcha") and provider-specific
+configuration. The engine may also inject gates dynamically based on
+policy.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemGates = {
+  [key: string]: {
+    /** The gate category. Only `captcha` is currently defined. Authenticator
+    ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+    `x-credential` on a field, not as gates.
+    */
+    kind: CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind;
+    /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
+    `hcaptcha`. The engine looks up an implementation in its provider
+    registry.
+    */
+    provider: string;
+    /** Provider-specific configuration consumed by the implementation when
+    issuing the per-render challenge. Opaque to the engine.
+    */
+    config?: CreateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig;
+  };
+}; //#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Server-side mutation to execute when this step completes successfully.
+Runs after field validation passes, before the transition fires.
+
+- create_user: creates the user record (registration flows)
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess];
+declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess: {
+  readonly create_user: "create_user";
+}; //#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * An available SSO identity provider.
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem = {
+  /** Provider instance identifier. */id: string; /** Display name for the provider. */
+  name: string; /** Template hint for rendering (logo, colors). */
+  template: string;
+}; //#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemTransitions.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Maps action/outcome names to their transition descriptor.
+
+Keys match action names from the `actions` dict. Additional keys
+come from implicit outcomes based on schema annotations
+(e.g. `user_not_found` from `x-unique` fields) and engine
+events (e.g. `sso`, `callback`).
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions = {
+  [key: string]: {
+    /** Step name within this flow (when `action` is null), or the name
+    of another flow (when `action` is `switch` or `pivot`).
+    */
+    target: string;
+    /** How to interpret `target`:
+    - null (omitted): transition to a step in the current flow.
+    - switch: replace the current flow with the target flow.
+    No return — the current flow is discarded.
+    Example: login ↔ register.
+    - pivot: push the target flow onto the stack. The current flow
+    is paused and resumes when the target flow completes (auto-pop).
+    Example: login → recovery → back to login.
+    */
+    action?: "switch" | "pivot" | null;
+  };
+}; //#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItem.d.ts
+/**
+ * A step in a flow definition. This is the admin-authored configuration,
+not the runtime payload sent to the frontend.
+
+Steps are schema-driven: `fields` references properties from the flow's
+user schema, and the engine resolves field metadata (type, validation,
+implicit outcomes) from schema annotations at runtime.
+
+A step with only `complete` set is a terminal step. All other steps are
+rendered to the frontend as capability payloads.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItem = {
+  /** Unique step identifier within this flow. Used as transition targets
+  and returned in the API response as `step.name`.
+   */
+  name: string;
+  /** Schema property names to collect from the user. Each entry references
+  a property in the flow's user schema. The engine resolves field type,
+  validation rules, and implicit outcomes from schema annotations
+  (e.g. a property with `x-unique` set implies a `user_not_found`
+  transition outcome).
+   */
+  fields?: string[];
+  /** Actions the user can take. Keyed by action name.
+  The action name is what the frontend sends back in the submit request.
+  If omitted, the engine provides a default `submit` action.
+   */
+  actions?: CreateFlowDefinitionBodyFlowDefinitionStepsItemActions;
+  /** Security gates that must be satisfied before submission. Keyed by gate
+  name. Each gate selects a kind (e.g. "captcha") and provider-specific
+  configuration. The engine may also inject gates dynamically based on
+  policy.
+   */
+  gates?: CreateFlowDefinitionBodyFlowDefinitionStepsItemGates; /** Available SSO identity providers for this step. */
+  sso_providers?: CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem[];
+  /** Server-side mutation to execute when this step completes successfully.
+  Runs after field validation passes, before the transition fires.
+     - create_user: creates the user record (registration flows)
+   */
+  on_success?: CreateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess;
+  /** Marks this as a terminal step. Tells the frontend what to do:
+  - redirect: navigate to redirect_uri (OIDC/SAML callback done)
+  - show: render as a success/info screen
+   */
+  complete?: CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete;
+  /** Maps action/outcome names to their transition descriptor.
+     Keys match action names from the `actions` dict. Additional keys
+  come from implicit outcomes based on schema annotations
+  (e.g. `user_not_found` from `x-unique` fields) and engine
+  events (e.g. `sso`, `callback`).
+   */
+  transitions?: CreateFlowDefinitionBodyFlowDefinitionStepsItemTransitions;
+}; //#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinition.d.ts
+/**
+ * A flow definition is the server-side configuration that describes a complete
+authentication or identity flow. It is NOT sent to the frontend — the flow
+engine evaluates it and produces FlowResponse payloads (steps with capability
+dictionaries) for the client.
+
+Flow definitions are created by administrators and stored in the project/team
+configuration hierarchy. The engine selects the matching definition based on
+the purpose + audience when a flow is created via POST /flow.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinition = {
+  /**
+     * Stable identifier for this flow, used as the target of cross-flow
+  `switch` and `pivot` transitions. Renaming is not supported — the
+  `name` is part of the public contract another definition may
+  reference. Acts as the human display label as well; no separate slug.
+        * @pattern ^[a-z][a-z0-9-]*$
+     */
+  name: string;
+  /** User schema this flow operates on. Step `fields` reference properties
+  defined in this schema. The engine resolves field types, validation,
+  and implicit outcomes from schema annotations at runtime.
+   */
+  user_schema: string;
+  /** Maps each purpose this definition handles to its entry-point step.
+  Keys are purpose names; values must match a `name` in `steps`. A
+  definition can serve multiple purposes (e.g. a combined login/register
+  flow) by listing one entry per purpose.
+   */
+  purposes: Partial<Record<"login" | "register" | "recovery" | "profiling" | "reauth" | "link_account", string>>;
+  /** Scopes which teams or apps this flow definition applies to. Empty or
+  omitted fields mean "no restriction"; when both are empty the definition
+  matches every request in the project. The engine picks the most specific
+  matching definition: app > team > project-wide.
+   */
+  audience?: CreateFlowDefinitionBodyFlowDefinitionAudience;
+  /**
+     * Ordered list of steps in this flow. The order is for human readability —
+  actual step sequencing is determined by transitions.
+        * @minItems 1
+     */
+  steps: CreateFlowDefinitionBodyFlowDefinitionStepsItem[];
+}; //#endregion
+//#region src/generated/model/createFlowDefinitionBody.d.ts
+type CreateFlowDefinitionBody = {
+  /** @pattern ^[a-zA-Z0-9_-]+$ */project_id: string;
+  /** URI of the server-published flow definition schema this definition was
+  authored against. The server uses this to validate the definition.
+  If not provided, the engine will use the latest schema version for validation.
+   */
+  schema_uri?: string;
+  /** A flow definition is the server-side configuration that describes a complete
+  authentication or identity flow. It is NOT sent to the frontend — the flow
+  engine evaluates it and produces FlowResponse payloads (steps with capability
+  dictionaries) for the client.
+     Flow definitions are created by administrators and stored in the project/team
+  configuration hierarchy. The engine selects the matching definition based on
+  the purpose + audience when a flow is created via POST /flow.
+   */
+  flow_definition: CreateFlowDefinitionBodyFlowDefinition;
+}; //#endregion
+//#region src/generated/model/createFlowDefinitionDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/createHandoff200.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The handoff token and metadata for session exchange.
+
+This is a short-lived credential (TTL ≤ 60 seconds) that the client must exchange
+at POST /sessions/exchange to receive the final session and session_token.
+The handoff token is single-use and audience-bound to the project.
+
+ */
+type CreateHandoff200 = {
+  /** The short-lived handoff token for session exchange.
+     Exchange at: POST /sessions/exchange
+     Requirements:
+  - Single-use (atomic GETDEL on exchange)
+  - TTL ≤ 60 seconds
+  - Audience-bound to project (exchange requires sk_proj_… for matching project)
+  - Idempotency-safe (Category B, 5-minute window)
+   */
+  handoff_token: string; /** When this handoff token expires */
+  expires_at: string;
+}; //#endregion
+//#region src/generated/model/createHandoffDefault.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+//#endregion
+//#region src/generated/model/createProject201.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type CreateProject201 = {
+  /** The unique identifier of the project. */id: string;
+  /** Secret which can be used for authentication when modifying the project.
+   */
+  projectSecret: string;
+  /** Secret which can be used for previewing and testing the project.
+   */
+  previewSecret: string;
+  /** Origins which are allowed for previewing and testing the project.
+   */
+  previewOrigins: string[]; /** The time when the project was created. */
+  createdAt: string;
+}; //#endregion
+//#region src/generated/model/createProject429Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/createProjectBody.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type CreateProjectBody = {
+  /** Origins which are allowed for previewing and testing the project.
+   */
+  previewOrigins?: string[];
+}; //#endregion
+//#region src/generated/model/createProjectDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/createSchema201.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type CreateSchema201 = {
+  /** The ID of the created schema */id: string;
+}; //#endregion
+//#region src/generated/model/createSchema400Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/createSchemaBody.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type CreateSchemaBody = {
   /** Discriminator value for a user schema create request. */kind: "user-schema"; /** The user Schema version used for this schema. */
   metaSchema: string; /** A list of authentication methods supported by the user definition. */
   "x-auth-methods": {
@@ -2328,7 +2506,34 @@ type CreateUserParams = {
    */
   team_id?: string;
 }; //#endregion
-//#region src/generated/model/deleteFlowDefinition404Details.d.ts
+//#region src/generated/model/deleteFlowDefinitionDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/deleteFlowDefinitionParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type DeleteFlowDefinitionParams = {
+  /**
+   * The project id to filter by.
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+}; //#endregion
+//#region src/generated/model/endSession400Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -2892,15 +3097,271 @@ type GetAuthAttempt200 = {
  * OpenAPI spec version: 0.0.1
  */
 //#endregion
-//#region src/generated/model/getFlowDefinition200.d.ts
+//#region src/generated/model/getFlowDefinition200FlowDefinitionAudience.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Scopes which teams or apps this flow definition applies to. Empty or
+omitted fields mean "no restriction"; when both are empty the definition
+matches every request in the project. The engine picks the most specific
+matching definition: app > team > project-wide.
+
+ */
+type GetFlowDefinition200FlowDefinitionAudience = {
+  /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
+  app_ids?: string[];
+}; //#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemActions.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Actions the user can take. Keyed by action name.
+The action name is what the frontend sends back in the submit request.
+If omitted, the engine provides a default `submit` action.
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemActions = {
+  [key: string]: {
+    /** Marks this as the default/primary action. The runtime template uses
+    this hint to choose visual emphasis. At most one action per step
+    should be primary; this is not enforced here.
+    */
+    primary?: boolean;
+    /** Optional localization key override for the action's label. When
+    omitted, the engine derives a key from the step and action names.
+    Display text is resolved client-side from a locale dictionary, never
+    by the engine.
+    */
+    text_key?: string;
+  };
+}; //#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemComplete.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Marks this as a terminal step. Tells the frontend what to do:
+- redirect: navigate to redirect_uri (OIDC/SAML callback done)
+- show: render as a success/info screen
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemComplete = (typeof GetFlowDefinition200FlowDefinitionStepsItemComplete)[keyof typeof GetFlowDefinition200FlowDefinitionStepsItemComplete];
+declare const GetFlowDefinition200FlowDefinitionStepsItemComplete: {
+  readonly redirect: "redirect";
+  readonly show: "show";
+}; //#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemGatesConfig.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Provider-specific configuration consumed by the implementation when
+issuing the per-render challenge. Opaque to the engine.
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemGatesConfig = {
+  [key: string]: unknown;
+}; //#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemGatesKind.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The gate category. Only `captcha` is currently defined. Authenticator
+ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+`x-credential` on a field, not as gates.
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemGatesKind = (typeof GetFlowDefinition200FlowDefinitionStepsItemGatesKind)[keyof typeof GetFlowDefinition200FlowDefinitionStepsItemGatesKind];
+declare const GetFlowDefinition200FlowDefinitionStepsItemGatesKind: {
+  readonly captcha: "captcha";
+}; //#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemGates.d.ts
+/**
+ * Security gates that must be satisfied before submission. Keyed by gate
+name. Each gate selects a kind (e.g. "captcha") and provider-specific
+configuration. The engine may also inject gates dynamically based on
+policy.
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemGates = {
+  [key: string]: {
+    /** The gate category. Only `captcha` is currently defined. Authenticator
+    ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+    `x-credential` on a field, not as gates.
+    */
+    kind: GetFlowDefinition200FlowDefinitionStepsItemGatesKind;
+    /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
+    `hcaptcha`. The engine looks up an implementation in its provider
+    registry.
+    */
+    provider: string;
+    /** Provider-specific configuration consumed by the implementation when
+    issuing the per-render challenge. Opaque to the engine.
+    */
+    config?: GetFlowDefinition200FlowDefinitionStepsItemGatesConfig;
+  };
+}; //#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemOnSuccess.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Server-side mutation to execute when this step completes successfully.
+Runs after field validation passes, before the transition fires.
+
+- create_user: creates the user record (registration flows)
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemOnSuccess = (typeof GetFlowDefinition200FlowDefinitionStepsItemOnSuccess)[keyof typeof GetFlowDefinition200FlowDefinitionStepsItemOnSuccess];
+declare const GetFlowDefinition200FlowDefinitionStepsItemOnSuccess: {
+  readonly create_user: "create_user";
+}; //#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * An available SSO identity provider.
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem = {
+  /** Provider instance identifier. */id: string; /** Display name for the provider. */
+  name: string; /** Template hint for rendering (logo, colors). */
+  template: string;
+}; //#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemTransitions.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Maps action/outcome names to their transition descriptor.
+
+Keys match action names from the `actions` dict. Additional keys
+come from implicit outcomes based on schema annotations
+(e.g. `user_not_found` from `x-unique` fields) and engine
+events (e.g. `sso`, `callback`).
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemTransitions = {
+  [key: string]: {
+    /** Step name within this flow (when `action` is null), or the name
+    of another flow (when `action` is `switch` or `pivot`).
+    */
+    target: string;
+    /** How to interpret `target`:
+    - null (omitted): transition to a step in the current flow.
+    - switch: replace the current flow with the target flow.
+    No return — the current flow is discarded.
+    Example: login ↔ register.
+    - pivot: push the target flow onto the stack. The current flow
+    is paused and resumes when the target flow completes (auto-pop).
+    Example: login → recovery → back to login.
+    */
+    action?: "switch" | "pivot" | null;
+  };
+}; //#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItem.d.ts
+/**
+ * A step in a flow definition. This is the admin-authored configuration,
+not the runtime payload sent to the frontend.
+
+Steps are schema-driven: `fields` references properties from the flow's
+user schema, and the engine resolves field metadata (type, validation,
+implicit outcomes) from schema annotations at runtime.
+
+A step with only `complete` set is a terminal step. All other steps are
+rendered to the frontend as capability payloads.
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItem = {
+  /** Unique step identifier within this flow. Used as transition targets
+  and returned in the API response as `step.name`.
+   */
+  name: string;
+  /** Schema property names to collect from the user. Each entry references
+  a property in the flow's user schema. The engine resolves field type,
+  validation rules, and implicit outcomes from schema annotations
+  (e.g. a property with `x-unique` set implies a `user_not_found`
+  transition outcome).
+   */
+  fields?: string[];
+  /** Actions the user can take. Keyed by action name.
+  The action name is what the frontend sends back in the submit request.
+  If omitted, the engine provides a default `submit` action.
+   */
+  actions?: GetFlowDefinition200FlowDefinitionStepsItemActions;
+  /** Security gates that must be satisfied before submission. Keyed by gate
+  name. Each gate selects a kind (e.g. "captcha") and provider-specific
+  configuration. The engine may also inject gates dynamically based on
+  policy.
+   */
+  gates?: GetFlowDefinition200FlowDefinitionStepsItemGates; /** Available SSO identity providers for this step. */
+  sso_providers?: GetFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem[];
+  /** Server-side mutation to execute when this step completes successfully.
+  Runs after field validation passes, before the transition fires.
+     - create_user: creates the user record (registration flows)
+   */
+  on_success?: GetFlowDefinition200FlowDefinitionStepsItemOnSuccess;
+  /** Marks this as a terminal step. Tells the frontend what to do:
+  - redirect: navigate to redirect_uri (OIDC/SAML callback done)
+  - show: render as a success/info screen
+   */
+  complete?: GetFlowDefinition200FlowDefinitionStepsItemComplete;
+  /** Maps action/outcome names to their transition descriptor.
+     Keys match action names from the `actions` dict. Additional keys
+  come from implicit outcomes based on schema annotations
+  (e.g. `user_not_found` from `x-unique` fields) and engine
+  events (e.g. `sso`, `callback`).
+   */
+  transitions?: GetFlowDefinition200FlowDefinitionStepsItemTransitions;
+}; //#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinition.d.ts
 /**
- * Generated by orval v8.10.0 🍺
- * Do not edit manually.
- * Zitadel NextGen
- * This is the next generation of the Zitadel identity platform.
- * OpenAPI spec version: 0.0.1
+ * A flow definition is the server-side configuration that describes a complete
+authentication or identity flow. It is NOT sent to the frontend — the flow
+engine evaluates it and produces FlowResponse payloads (steps with capability
+dictionaries) for the client.
+
+Flow definitions are created by administrators and stored in the project/team
+configuration hierarchy. The engine selects the matching definition based on
+the purpose + audience when a flow is created via POST /flow.
+
  */
-type GetFlowDefinition200 = {
+type GetFlowDefinition200FlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
   `switch` and `pivot` transitions. Renaming is not supported — the
@@ -2925,123 +3386,32 @@ type GetFlowDefinition200 = {
   matches every request in the project. The engine picks the most specific
   matching definition: app > team > project-wide.
    */
-  audience?: {
-    /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
-    app_ids?: string[];
-  };
+  audience?: GetFlowDefinition200FlowDefinitionAudience;
   /**
      * Ordered list of steps in this flow. The order is for human readability —
   actual step sequencing is determined by transitions.
         * @minItems 1
      */
-  steps: {
-    /** Unique step identifier within this flow. Used as transition targets
-    and returned in the API response as `step.name`.
-    */
-    name: string;
-    /** Schema property names to collect from the user. Each entry references
-    a property in the flow's user schema. The engine resolves field type,
-    validation rules, and implicit outcomes from schema annotations
-    (e.g. a property with `x-unique` set implies a `user_not_found`
-    transition outcome).
-    */
-    fields?: string[];
-    /** Actions the user can take. Keyed by action name.
-    The action name is what the frontend sends back in the submit request.
-    If omitted, the engine provides a default `submit` action.
-    */
-    actions?: {
-      [key: string]: {
-        /** Marks this as the default/primary action. The runtime template uses
-        this hint to choose visual emphasis. At most one action per step
-        should be primary; this is not enforced here.
-        */
-        primary?: boolean;
-        /** Optional localization key override for the action's label. When
-        omitted, the engine derives a key from the step and action names.
-        Display text is resolved client-side from a locale dictionary, never
-        by the engine.
-        */
-        text_key?: string;
-      };
-    };
-    /** Security gates that must be satisfied before submission. Keyed by gate
-    name. Each gate selects a kind (e.g. "captcha") and provider-specific
-    configuration. The engine may also inject gates dynamically based on
-    policy.
-    */
-    gates?: {
-      [key: string]: {
-        /** The gate category. Only `captcha` is currently defined. Authenticator
-        ceremonies (e.g. passkey) are modelled as credential auth_attempts via
-        `x-credential` on a field, not as gates.
-        */
-        kind: "captcha";
-        /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
-        `hcaptcha`. The engine looks up an implementation in its provider
-        registry.
-        */
-        provider: string;
-        /** Provider-specific configuration consumed by the implementation when
-        issuing the per-render challenge. Opaque to the engine.
-        */
-        config?: {
-          [key: string]: unknown;
-        };
-      };
-    }; /** Available SSO identity providers for this step. */
-    sso_providers?: {
-      /** Provider instance identifier. */id: string; /** Display name for the provider. */
-      name: string; /** Template hint for rendering (logo, colors). */
-      template: string;
-    }[];
-    /** Server-side mutation to execute when this step completes successfully.
-    Runs after field validation passes, before the transition fires.
-       - create_user: creates the user record (registration flows)
-    */
-    on_success?: "create_user";
-    /** Marks this as a terminal step. Tells the frontend what to do:
-    - redirect: navigate to redirect_uri (OIDC/SAML callback done)
-    - show: render as a success/info screen
-    */
-    complete?: "redirect" | "show";
-    /** Maps action/outcome names to their transition descriptor.
-       Keys match action names from the `actions` dict. Additional keys
-    come from implicit outcomes based on schema annotations
-    (e.g. `user_not_found` from `x-unique` fields) and engine
-    events (e.g. `sso`, `callback`).
-    */
-    transitions?: {
-      [key: string]: {
-        /** Step name within this flow (when `action` is null), or the name
-        of another flow (when `action` is `switch` or `pivot`).
-        */
-        target: string;
-        /** How to interpret `target`:
-        - null (omitted): transition to a step in the current flow.
-        - switch: replace the current flow with the target flow.
-        No return — the current flow is discarded.
-        Example: login ↔ register.
-        - pivot: push the target flow onto the stack. The current flow
-        is paused and resumes when the target flow completes (auto-pop).
-        Example: login → recovery → back to login.
-        */
-        action?: "switch" | "pivot" | null;
-      };
-    };
-  }[];
-} & {
+  steps: GetFlowDefinition200FlowDefinitionStepsItem[];
+}; //#endregion
+//#region src/generated/model/getFlowDefinition200.d.ts
+type GetFlowDefinition200 = {
   /** Unique identifier for the flow definition. */id: string; /** Identifier of the project this flow definition belongs to. */
-  project_id: string;
-  /** URI of the flow definition schema this definition was authored against.
-  If the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.
-   */
-  schema_uri: string; /** Status of the flow definition. */
+  project_id: string; /** Status of the flow definition. */
   status: string;
+  /** A flow definition is the server-side configuration that describes a complete
+  authentication or identity flow. It is NOT sent to the frontend — the flow
+  engine evaluates it and produces FlowResponse payloads (steps with capability
+  dictionaries) for the client.
+     Flow definitions are created by administrators and stored in the project/team
+  configuration hierarchy. The engine selects the matching definition based on
+  the purpose + audience when a flow is created via POST /flow.
+   */
+  flow_definition: GetFlowDefinition200FlowDefinition;
   created_at: string;
   updated_at: string;
 }; //#endregion
-//#region src/generated/model/getFlowDefinition404Details.d.ts
+//#region src/generated/model/getFlowDefinitionDefaultDetails.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3053,6 +3423,21 @@ type GetFlowDefinition200 = {
  * Additional error-specific context.
  */
 //#endregion
+//#region src/generated/model/getFlowDefinitionParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type GetFlowDefinitionParams = {
+  /**
+   * The project id to filter by.
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+}; //#endregion
 //#region src/generated/model/getFlowStep200BrandingLayout.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -3766,6 +4151,29 @@ type GetMySession200 = {
  * Additional error-specific context.
  */
 //#endregion
+//#region src/generated/model/getMyUser200.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type GetMyUser200 = {
+  [key: string]: unknown;
+}; //#endregion
+//#region src/generated/model/getMyUser401Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
 //#region src/generated/model/getOpenIDConfiguration200ClaimTypesSupportedItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -4673,7 +5081,7 @@ type ListFlowDefinitions200FlowDefinitionsItem = {
   /** URI of the flow definition schema this definition was authored against.
   If the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.
    */
-  schema_uri: string; /** Status of the flow definition. */
+  schema_uri?: string; /** Status of the flow definition. */
   status: string; /** Timestamp when the flow definition was created. */
   created_at: string; /** Timestamp when the flow definition was last updated. */
   updated_at: string;
@@ -4728,7 +5136,7 @@ type ListFlowDefinitionsParams = {
     */
   page_token?: string;
   /**
-   * The unique identifier of the project
+   * The project id to filter by.
    * @pattern ^[a-zA-Z0-9_-]+$
    */
   project_id: string;
@@ -5072,6 +5480,63 @@ type RevokeTokenBody = {
  * Additional error-specific context.
  */
 //#endregion
+//#region src/generated/model/setUserPasswordBody.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Request to update the user's password.
+ */
+type SetUserPasswordBody = {
+  /** The new password for the user. */password: string;
+  /** Whether the user is required to change their password on the next login.
+  If not provided, it will default to false.
+   */
+  isChangeRequired?: boolean;
+}; //#endregion
+//#region src/generated/model/setUserPasswordDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/setUserPasswordParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type SetUserPasswordParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+}; //#endregion
+//#region src/generated/model/submitFlowEvent400Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
 //#region src/generated/model/submitFlowEventBodyPayload.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -5551,13 +6016,163 @@ type SubmitFlowStep200 = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Layout preset selector. The default.liquid master template uses this
-to branch into layout variants. Customers who eject the template
-can ignore this field entirely.
+ * Layout preset selector. The default.liquid master template uses this
+to branch into layout variants. Customers who eject the template
+can ignore this field entirely.
+
+ */
+//#endregion
+//#region src/generated/model/submitFlowStepBodyChallengeResponseProof.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Method-specific proof payload.
+For passkeys, this is the WebAuthn JSON serialization of PublicKeyCredential.
+
+ */
+type SubmitFlowStepBodyChallengeResponseProof = {
+  [key: string]: unknown;
+}; //#endregion
+//#region src/generated/model/submitFlowStepBodyChallengeResponse.d.ts
+/**
+ * Response to a pending challenge on the step. Required when the step has a
+`challenge` property (e.g., after submitting a passkey action).
+The `<zl-passkey>` component populates this after the WebAuthn ceremony.
+
+ */
+type SubmitFlowStepBodyChallengeResponse = {
+  /** The challenge identifier from `step.challenge.challenge_id`.
+  Matches the server-side challenge for verification.
+   */
+  challenge_id?: string; /** Which auth method this response is for (e.g., 'passkey'). */
+  method?: string;
+  /** Method-specific proof payload.
+  For passkeys, this is the WebAuthn JSON serialization of PublicKeyCredential.
+   */
+  proof?: SubmitFlowStepBodyChallengeResponseProof;
+}; //#endregion
+//#region src/generated/model/submitFlowStepBodyFields.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * User input values. Keys match field names from the step's `fields` dictionary.
+
+ */
+type SubmitFlowStepBodyFields = {
+  [key: string]: unknown;
+}; //#endregion
+//#region src/generated/model/submitFlowStepBodyGateProofs.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Solutions for security gates. Keys match gate names from the step's `gates` dictionary.
+The orchestrator collects these from `<zl-captcha>` component events.
+
+ */
+type SubmitFlowStepBodyGateProofs = {
+  [key: string]: string;
+}; //#endregion
+//#region src/generated/model/submitFlowStepBody.d.ts
+type SubmitFlowStepBody = {
+  /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */session_token?: string;
+  /** Which action to take. Must be a key from the step's `actions` dictionary:
+  - A regular action (e.g., "submit", "register", "back")
+  - The reserved value "sso" — triggers SSO redirect (requires `sso_provider_id`)
+   */
+  action: string;
+  /** User input values. Keys match field names from the step's `fields` dictionary.
+   */
+  fields?: SubmitFlowStepBodyFields;
+  /** Solutions for security gates. Keys match gate names from the step's `gates` dictionary.
+  The orchestrator collects these from `<zl-captcha>` component events.
+   */
+  gate_proofs?: SubmitFlowStepBodyGateProofs;
+  /** Response to a pending challenge on the step. Required when the step has a
+  `challenge` property (e.g., after submitting a passkey action).
+  The `<zl-passkey>` component populates this after the WebAuthn ceremony.
+   */
+  challenge_response?: SubmitFlowStepBodyChallengeResponse;
+  /** ID of the selected SSO provider (from `sso_providers[].id`).
+  Required when `action` is "sso".
+   */
+  sso_provider_id?: string;
+}; //#endregion
+//#region src/generated/model/submitFlowStepDefaultDetails.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionAudience.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Scopes which teams or apps this flow definition applies to. Empty or
+omitted fields mean "no restriction"; when both are empty the definition
+matches every request in the project. The engine picks the most specific
+matching definition: app > team > project-wide.
+
+ */
+type UpdateFlowDefinition200FlowDefinitionAudience = {
+  /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
+  app_ids?: string[];
+}; //#endregion
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemActions.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Actions the user can take. Keyed by action name.
+The action name is what the frontend sends back in the submit request.
+If omitted, the engine provides a default `submit` action.
 
  */
-//#endregion
-//#region src/generated/model/submitFlowStepBodyChallengeResponseProof.d.ts
+type UpdateFlowDefinition200FlowDefinitionStepsItemActions = {
+  [key: string]: {
+    /** Marks this as the default/primary action. The runtime template uses
+    this hint to choose visual emphasis. At most one action per step
+    should be primary; this is not enforced here.
+    */
+    primary?: boolean;
+    /** Optional localization key override for the action's label. When
+    omitted, the engine derives a key from the step and action names.
+    Display text is resolved client-side from a locale dictionary, never
+    by the engine.
+    */
+    text_key?: string;
+  };
+}; //#endregion
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemComplete.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5566,32 +6181,33 @@ can ignore this field entirely.
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Method-specific proof payload.
-For passkeys, this is the WebAuthn JSON serialization of PublicKeyCredential.
+ * Marks this as a terminal step. Tells the frontend what to do:
+- redirect: navigate to redirect_uri (OIDC/SAML callback done)
+- show: render as a success/info screen
 
  */
-type SubmitFlowStepBodyChallengeResponseProof = {
-  [key: string]: unknown;
+type UpdateFlowDefinition200FlowDefinitionStepsItemComplete = (typeof UpdateFlowDefinition200FlowDefinitionStepsItemComplete)[keyof typeof UpdateFlowDefinition200FlowDefinitionStepsItemComplete];
+declare const UpdateFlowDefinition200FlowDefinitionStepsItemComplete: {
+  readonly redirect: "redirect";
+  readonly show: "show";
 }; //#endregion
-//#region src/generated/model/submitFlowStepBodyChallengeResponse.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemGatesConfig.d.ts
 /**
- * Response to a pending challenge on the step. Required when the step has a
-`challenge` property (e.g., after submitting a passkey action).
-The `<zl-passkey>` component populates this after the WebAuthn ceremony.
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Provider-specific configuration consumed by the implementation when
+issuing the per-render challenge. Opaque to the engine.
 
  */
-type SubmitFlowStepBodyChallengeResponse = {
-  /** The challenge identifier from `step.challenge.challenge_id`.
-  Matches the server-side challenge for verification.
-   */
-  challenge_id?: string; /** Which auth method this response is for (e.g., 'passkey'). */
-  method?: string;
-  /** Method-specific proof payload.
-  For passkeys, this is the WebAuthn JSON serialization of PublicKeyCredential.
-   */
-  proof?: SubmitFlowStepBodyChallengeResponseProof;
+type UpdateFlowDefinition200FlowDefinitionStepsItemGatesConfig = {
+  [key: string]: unknown;
 }; //#endregion
-//#region src/generated/model/submitFlowStepBodyFields.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemGatesKind.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5600,13 +6216,42 @@ type SubmitFlowStepBodyChallengeResponse = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * User input values. Keys match field names from the step's `fields` dictionary.
+ * The gate category. Only `captcha` is currently defined. Authenticator
+ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+`x-credential` on a field, not as gates.
 
  */
-type SubmitFlowStepBodyFields = {
-  [key: string]: unknown;
+type UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind = (typeof UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind)[keyof typeof UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind];
+declare const UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind: {
+  readonly captcha: "captcha";
 }; //#endregion
-//#region src/generated/model/submitFlowStepBodyGateProofs.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemGates.d.ts
+/**
+ * Security gates that must be satisfied before submission. Keyed by gate
+name. Each gate selects a kind (e.g. "captcha") and provider-specific
+configuration. The engine may also inject gates dynamically based on
+policy.
+
+ */
+type UpdateFlowDefinition200FlowDefinitionStepsItemGates = {
+  [key: string]: {
+    /** The gate category. Only `captcha` is currently defined. Authenticator
+    ceremonies (e.g. passkey) are modelled as credential auth_attempts via
+    `x-credential` on a field, not as gates.
+    */
+    kind: UpdateFlowDefinition200FlowDefinitionStepsItemGatesKind;
+    /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
+    `hcaptcha`. The engine looks up an implementation in its provider
+    registry.
+    */
+    provider: string;
+    /** Provider-specific configuration consumed by the implementation when
+    issuing the per-render challenge. Opaque to the engine.
+    */
+    config?: UpdateFlowDefinition200FlowDefinitionStepsItemGatesConfig;
+  };
+}; //#endregion
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemOnSuccess.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5615,39 +6260,17 @@ type SubmitFlowStepBodyFields = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Solutions for security gates. Keys match gate names from the step's `gates` dictionary.
-The orchestrator collects these from `<zl-captcha>` component events.
+ * Server-side mutation to execute when this step completes successfully.
+Runs after field validation passes, before the transition fires.
+
+- create_user: creates the user record (registration flows)
 
  */
-type SubmitFlowStepBodyGateProofs = {
-  [key: string]: string;
-}; //#endregion
-//#region src/generated/model/submitFlowStepBody.d.ts
-type SubmitFlowStepBody = {
-  /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */session_token?: string;
-  /** Which action to take. Must be a key from the step's `actions` dictionary:
-  - A regular action (e.g., "submit", "register", "back")
-  - The reserved value "sso" — triggers SSO redirect (requires `sso_provider_id`)
-   */
-  action: string;
-  /** User input values. Keys match field names from the step's `fields` dictionary.
-   */
-  fields?: SubmitFlowStepBodyFields;
-  /** Solutions for security gates. Keys match gate names from the step's `gates` dictionary.
-  The orchestrator collects these from `<zl-captcha>` component events.
-   */
-  gate_proofs?: SubmitFlowStepBodyGateProofs;
-  /** Response to a pending challenge on the step. Required when the step has a
-  `challenge` property (e.g., after submitting a passkey action).
-  The `<zl-passkey>` component populates this after the WebAuthn ceremony.
-   */
-  challenge_response?: SubmitFlowStepBodyChallengeResponse;
-  /** ID of the selected SSO provider (from `sso_providers[].id`).
-  Required when `action` is "sso".
-   */
-  sso_provider_id?: string;
+type UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess = (typeof UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess)[keyof typeof UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess];
+declare const UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess: {
+  readonly create_user: "create_user";
 }; //#endregion
-//#region src/generated/model/submitFlowStepDefaultDetails.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5656,10 +6279,14 @@ type SubmitFlowStepBody = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Additional error-specific context.
+ * An available SSO identity provider.
  */
-//#endregion
-//#region src/generated/model/updateFlowDefinition200.d.ts
+type UpdateFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem = {
+  /** Provider instance identifier. */id: string; /** Display name for the provider. */
+  name: string; /** Template hint for rendering (logo, colors). */
+  template: string;
+}; //#endregion
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemTransitions.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5667,7 +6294,101 @@ type SubmitFlowStepBody = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-type UpdateFlowDefinition200 = {
+/**
+ * Maps action/outcome names to their transition descriptor.
+
+Keys match action names from the `actions` dict. Additional keys
+come from implicit outcomes based on schema annotations
+(e.g. `user_not_found` from `x-unique` fields) and engine
+events (e.g. `sso`, `callback`).
+
+ */
+type UpdateFlowDefinition200FlowDefinitionStepsItemTransitions = {
+  [key: string]: {
+    /** Step name within this flow (when `action` is null), or the name
+    of another flow (when `action` is `switch` or `pivot`).
+    */
+    target: string;
+    /** How to interpret `target`:
+    - null (omitted): transition to a step in the current flow.
+    - switch: replace the current flow with the target flow.
+    No return — the current flow is discarded.
+    Example: login ↔ register.
+    - pivot: push the target flow onto the stack. The current flow
+    is paused and resumes when the target flow completes (auto-pop).
+    Example: login → recovery → back to login.
+    */
+    action?: "switch" | "pivot" | null;
+  };
+}; //#endregion
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItem.d.ts
+/**
+ * A step in a flow definition. This is the admin-authored configuration,
+not the runtime payload sent to the frontend.
+
+Steps are schema-driven: `fields` references properties from the flow's
+user schema, and the engine resolves field metadata (type, validation,
+implicit outcomes) from schema annotations at runtime.
+
+A step with only `complete` set is a terminal step. All other steps are
+rendered to the frontend as capability payloads.
+
+ */
+type UpdateFlowDefinition200FlowDefinitionStepsItem = {
+  /** Unique step identifier within this flow. Used as transition targets
+  and returned in the API response as `step.name`.
+   */
+  name: string;
+  /** Schema property names to collect from the user. Each entry references
+  a property in the flow's user schema. The engine resolves field type,
+  validation rules, and implicit outcomes from schema annotations
+  (e.g. a property with `x-unique` set implies a `user_not_found`
+  transition outcome).
+   */
+  fields?: string[];
+  /** Actions the user can take. Keyed by action name.
+  The action name is what the frontend sends back in the submit request.
+  If omitted, the engine provides a default `submit` action.
+   */
+  actions?: UpdateFlowDefinition200FlowDefinitionStepsItemActions;
+  /** Security gates that must be satisfied before submission. Keyed by gate
+  name. Each gate selects a kind (e.g. "captcha") and provider-specific
+  configuration. The engine may also inject gates dynamically based on
+  policy.
+   */
+  gates?: UpdateFlowDefinition200FlowDefinitionStepsItemGates; /** Available SSO identity providers for this step. */
+  sso_providers?: UpdateFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem[];
+  /** Server-side mutation to execute when this step completes successfully.
+  Runs after field validation passes, before the transition fires.
+     - create_user: creates the user record (registration flows)
+   */
+  on_success?: UpdateFlowDefinition200FlowDefinitionStepsItemOnSuccess;
+  /** Marks this as a terminal step. Tells the frontend what to do:
+  - redirect: navigate to redirect_uri (OIDC/SAML callback done)
+  - show: render as a success/info screen
+   */
+  complete?: UpdateFlowDefinition200FlowDefinitionStepsItemComplete;
+  /** Maps action/outcome names to their transition descriptor.
+     Keys match action names from the `actions` dict. Additional keys
+  come from implicit outcomes based on schema annotations
+  (e.g. `user_not_found` from `x-unique` fields) and engine
+  events (e.g. `sso`, `callback`).
+   */
+  transitions?: UpdateFlowDefinition200FlowDefinitionStepsItemTransitions;
+}; //#endregion
+//#region src/generated/model/updateFlowDefinition200FlowDefinition.d.ts
+/**
+ * A flow definition is the server-side configuration that describes a complete
+authentication or identity flow. It is NOT sent to the frontend — the flow
+engine evaluates it and produces FlowResponse payloads (steps with capability
+dictionaries) for the client.
+
+Flow definitions are created by administrators and stored in the project/team
+configuration hierarchy. The engine selects the matching definition based on
+the purpose + audience when a flow is created via POST /flow.
+
+ */
+type UpdateFlowDefinition200FlowDefinition = {
   /**
      * Stable identifier for this flow, used as the target of cross-flow
   `switch` and `pivot` transitions. Renaming is not supported — the
@@ -5692,119 +6413,28 @@ type UpdateFlowDefinition200 = {
   matches every request in the project. The engine picks the most specific
   matching definition: app > team > project-wide.
    */
-  audience?: {
-    /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
-    app_ids?: string[];
-  };
+  audience?: UpdateFlowDefinition200FlowDefinitionAudience;
   /**
      * Ordered list of steps in this flow. The order is for human readability —
   actual step sequencing is determined by transitions.
         * @minItems 1
      */
-  steps: {
-    /** Unique step identifier within this flow. Used as transition targets
-    and returned in the API response as `step.name`.
-    */
-    name: string;
-    /** Schema property names to collect from the user. Each entry references
-    a property in the flow's user schema. The engine resolves field type,
-    validation rules, and implicit outcomes from schema annotations
-    (e.g. a property with `x-unique` set implies a `user_not_found`
-    transition outcome).
-    */
-    fields?: string[];
-    /** Actions the user can take. Keyed by action name.
-    The action name is what the frontend sends back in the submit request.
-    If omitted, the engine provides a default `submit` action.
-    */
-    actions?: {
-      [key: string]: {
-        /** Marks this as the default/primary action. The runtime template uses
-        this hint to choose visual emphasis. At most one action per step
-        should be primary; this is not enforced here.
-        */
-        primary?: boolean;
-        /** Optional localization key override for the action's label. When
-        omitted, the engine derives a key from the step and action names.
-        Display text is resolved client-side from a locale dictionary, never
-        by the engine.
-        */
-        text_key?: string;
-      };
-    };
-    /** Security gates that must be satisfied before submission. Keyed by gate
-    name. Each gate selects a kind (e.g. "captcha") and provider-specific
-    configuration. The engine may also inject gates dynamically based on
-    policy.
-    */
-    gates?: {
-      [key: string]: {
-        /** The gate category. Only `captcha` is currently defined. Authenticator
-        ceremonies (e.g. passkey) are modelled as credential auth_attempts via
-        `x-credential` on a field, not as gates.
-        */
-        kind: "captcha";
-        /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
-        `hcaptcha`. The engine looks up an implementation in its provider
-        registry.
-        */
-        provider: string;
-        /** Provider-specific configuration consumed by the implementation when
-        issuing the per-render challenge. Opaque to the engine.
-        */
-        config?: {
-          [key: string]: unknown;
-        };
-      };
-    }; /** Available SSO identity providers for this step. */
-    sso_providers?: {
-      /** Provider instance identifier. */id: string; /** Display name for the provider. */
-      name: string; /** Template hint for rendering (logo, colors). */
-      template: string;
-    }[];
-    /** Server-side mutation to execute when this step completes successfully.
-    Runs after field validation passes, before the transition fires.
-       - create_user: creates the user record (registration flows)
-    */
-    on_success?: "create_user";
-    /** Marks this as a terminal step. Tells the frontend what to do:
-    - redirect: navigate to redirect_uri (OIDC/SAML callback done)
-    - show: render as a success/info screen
-    */
-    complete?: "redirect" | "show";
-    /** Maps action/outcome names to their transition descriptor.
-       Keys match action names from the `actions` dict. Additional keys
-    come from implicit outcomes based on schema annotations
-    (e.g. `user_not_found` from `x-unique` fields) and engine
-    events (e.g. `sso`, `callback`).
-    */
-    transitions?: {
-      [key: string]: {
-        /** Step name within this flow (when `action` is null), or the name
-        of another flow (when `action` is `switch` or `pivot`).
-        */
-        target: string;
-        /** How to interpret `target`:
-        - null (omitted): transition to a step in the current flow.
-        - switch: replace the current flow with the target flow.
-        No return — the current flow is discarded.
-        Example: login ↔ register.
-        - pivot: push the target flow onto the stack. The current flow
-        is paused and resumes when the target flow completes (auto-pop).
-        Example: login → recovery → back to login.
-        */
-        action?: "switch" | "pivot" | null;
-      };
-    };
-  }[];
-} & {
+  steps: UpdateFlowDefinition200FlowDefinitionStepsItem[];
+}; //#endregion
+//#region src/generated/model/updateFlowDefinition200.d.ts
+type UpdateFlowDefinition200 = {
   /** Unique identifier for the flow definition. */id: string; /** Identifier of the project this flow definition belongs to. */
-  project_id: string;
-  /** URI of the flow definition schema this definition was authored against.
-  If the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.
-   */
-  schema_uri: string; /** Status of the flow definition. */
+  project_id: string; /** Status of the flow definition. */
   status: string;
+  /** A flow definition is the server-side configuration that describes a complete
+  authentication or identity flow. It is NOT sent to the frontend — the flow
+  engine evaluates it and produces FlowResponse payloads (steps with capability
+  dictionaries) for the client.
+     Flow definitions are created by administrators and stored in the project/team
+  configuration hierarchy. The engine selects the matching definition based on
+  the purpose + audience when a flow is created via POST /flow.
+   */
+  flow_definition: UpdateFlowDefinition200FlowDefinition;
   created_at: string;
   updated_at: string;
 }; //#endregion
@@ -6117,6 +6747,21 @@ type UpdateFlowDefinitionBody = {
  * Additional error-specific context.
  */
 //#endregion
+//#region src/generated/model/updateFlowDefinitionParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type UpdateFlowDefinitionParams = {
+  /**
+   * The project id to filter by.
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+}; //#endregion
 //#region src/generated/model/verifyChallengeProof200ChallengesItemMethod.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -6455,6 +7100,7 @@ declare class ZlField extends LitElement {
   accessor invalid: boolean;
   private accessor hasHelp;
   private accessor hasSuffixSlot;
+  private accessor inputEl;
   private readonly inputId;
   private readonly internals;
   constructor();
@@ -6513,6 +7159,12 @@ declare global {
 declare class ZlPageShell extends LitElement {
   static styles: _$lit.CSSResult[];
   render(): _$lit.TemplateResult<1>;
+  /**
+   * Re-render when a named slot's assignment changes so a footer/header added
+   * after first paint updates the empty-region class. The initial render reads
+   * children synchronously (no empty-then-filled flash).
+   */
+  private onSlotChange;
   private lightDomSlotFilled;
 }
 declare const zlPageShellManifest: AtomManifest;
@@ -6694,7 +7346,6 @@ declare class ZlPill extends LitElement {
   accessor tone: "neutral" | "pink" | "purple" | "orange" | "success";
   accessor href: string | undefined;
   accessor ariaLabel: string | null;
-  private surfaceClasses;
   render(): _$lit.TemplateResult<1>;
 }
 declare const zlPillManifest: AtomManifest;
@@ -6704,5 +7355,5 @@ declare global {
   }
 } //# sourceMappingURL=zl-pill.d.ts.map
 //#endregion
-export { GetKeys200 as $, CreateFlowDefinitionBody as A, SubmitFlowStepBody as At, CreateTeamBody as B, zlAlertManifest as Bt, CreateFlow201StepChallenge as C, ListSessionsParams as Ct, CreateFlowBody as D, RevokeTokenBody as Dt, CreateFlow201StepSsoProvidersItem as E, RevokeSessionParams as Et, CreateSchemaBody as F, ZlCard as Ft, EndSessionParams as G, CreateUser201 as H, ZlIcon as Ht, CreateSchemaParams as I, zlCardManifest as It, ExchangeHandoffParams as J, ExchangeHandoff200 as K, CreateSession201 as L, ZlButton as Lt, CreateProject201 as M, UpdateFlowDefinitionBody as Mt, CreateProjectBody as N, VerifyChallengeProof200 as Nt, CreateFlowBodyPurpose as O, SubmitFlowEventBody as Ot, CreateSchema201 as P, VerifyChallengeProofBody as Pt, GetHealthDefault as Q, CreateSessionBody as R, zlButtonManifest as Rt, CreateFlow201StepActions as S, ListSessions200 as St, CreateFlow201StepGates as T, ListUsersParams as Tt, CreateUserBody as U, zlIconManifest as Ut, CreateTeamParams as V, IconName as Vt, CreateUserParams as W, GetFlowDefinition200 as X, GetAuthAttempt200 as Y, GetFlowStep200 as Z, CreateAuthAttemptBody as _, IntrospectBody as _t, ZlPasskeyResultDetail as a, GetSchemaById200 as at, CreateFlow201BrandingLayout as b, ListFlowDefinitions200 as bt, zlPageShellManifest as c, GetSessionParams as ct, zlFieldManifest as d, GetToken200 as dt, GetLiveDefault as et, AuthorizeDevice200 as f, GetTokenBody as ft, CreateAuthAttempt201 as g, Introspect200 as gt, AuthorizeGetParams as h, GetUserInfo200 as ht, ZlPasskeyErrorDetail as i, GetReadyDefault as it, CreateHandoff200 as j, UpdateFlowDefinition200 as jt, CreateFlowDefinition201 as k, SubmitFlowStep200 as kt, ZlField as l, GetTeam200 as lt, AuthorizeGetDefault as m, GetUserByIDParams as mt, zlPillManifest as n, GetOpenIDConfiguration200 as nt, zlPasskeyManifest as o, GetSchemaByIdParams as ot, AuthorizeDeviceParams as p, GetUserByID200 as pt, ExchangeHandoffBody as q, ZlPasskey as r, GetProject200 as rt, ZlPageShell as s, GetSession200 as st, ZlPill as t, GetMySession200 as tt, ZlFieldType as u, GetTeamParams as ut, CreateFlow201 as v, IssueChallenge201 as vt, CreateFlow201StepFields as w, ListUsers200Item as wt, CreateFlow201Step as x, ListFlowDefinitionsParams as xt, CreateFlow201Branding as y, IssueChallengeBody as yt, CreateTeam201 as z, ZlAlert as zt };
-//# sourceMappingURL=index-Dd8hfOWt.d.mts.map
+export { GetFlowStep200 as $, CreateFlowDefinitionBody as A, RevokeTokenBody as At, CreateTeamBody as B, VerifyChallengeProofBody as Bt, CreateFlow201StepChallenge as C, ListFlowDefinitions200 as Ct, CreateFlowBody as D, ListUsers200Item as Dt, CreateFlow201StepSsoProvidersItem as E, ListSessionsParams as Et, CreateSchemaBody as F, SubmitFlowStepBody as Ft, DeleteFlowDefinitionParams as G, ZlAlert as Gt, CreateUser201 as H, zlCardManifest as Ht, CreateSchemaParams as I, UpdateFlowDefinition200 as It, ExchangeHandoffBody as J, ZlIcon as Jt, EndSessionParams as K, zlAlertManifest as Kt, CreateSession201 as L, UpdateFlowDefinitionBody as Lt, CreateProject201 as M, SetUserPasswordParams as Mt, CreateProjectBody as N, SubmitFlowEventBody as Nt, CreateFlowBodyPurpose as O, ListUsersParams as Ot, CreateSchema201 as P, SubmitFlowStep200 as Pt, GetFlowDefinitionParams as Q, CreateSessionBody as R, UpdateFlowDefinitionParams as Rt, CreateFlow201StepActions as S, IssueChallengeBody as St, CreateFlow201StepGates as T, ListSessions200 as Tt, CreateUserBody as U, ZlButton as Ut, CreateTeamParams as V, ZlCard as Vt, CreateUserParams as W, zlButtonManifest as Wt, GetAuthAttempt200 as X, ExchangeHandoffParams as Y, zlIconManifest as Yt, GetFlowDefinition200 as Z, CreateAuthAttemptBody as _, GetUserByIDParams as _t, ZlPasskeyResultDetail as a, GetOpenIDConfiguration200 as at, CreateFlow201BrandingLayout as b, IntrospectBody as bt, zlPageShellManifest as c, GetSchemaById200 as ct, zlFieldManifest as d, GetSessionParams as dt, GetHealthDefault as et, AuthorizeDevice200 as f, GetTeam200 as ft, CreateAuthAttempt201 as g, GetUserByID200 as gt, AuthorizeGetParams as h, GetTokenBody as ht, ZlPasskeyErrorDetail as i, GetMyUser200 as it, CreateHandoff200 as j, SetUserPasswordBody as jt, CreateFlowDefinition201 as k, RevokeSessionParams as kt, ZlField as l, GetSchemaByIdParams as lt, AuthorizeGetDefault as m, GetToken200 as mt, zlPillManifest as n, GetLiveDefault as nt, zlPasskeyManifest as o, GetProject200 as ot, AuthorizeDeviceParams as p, GetTeamParams as pt, ExchangeHandoff200 as q, IconName as qt, ZlPasskey as r, GetMySession200 as rt, ZlPageShell as s, GetReadyDefault as st, ZlPill as t, GetKeys200 as tt, ZlFieldType as u, GetSession200 as ut, CreateFlow201 as v, GetUserInfo200 as vt, CreateFlow201StepFields as w, ListFlowDefinitionsParams as wt, CreateFlow201Step as x, IssueChallenge201 as xt, CreateFlow201Branding as y, Introspect200 as yt, CreateTeam201 as z, VerifyChallengeProof200 as zt };
+//# sourceMappingURL=index-DmtnqUIY.d.mts.map