@zitadel/components 0.1.0-alpha.11 → 0.1.0-alpha.13

package/dist/{index-DVDCrfkv.d.mts → index-D4LkdeFl.d.mts}

@@ -37,7 +37,7 @@ declare class ZlIcon extends LitElement {
   render(): _$lit.TemplateResult<1>;
 }
 /** Public, kebab-case glyph IDs. Add a new one by extending both this union and {@link ICON_NODES}. */
-type IconName = "plus" | "arrow-right" | "arrow-left" | "spinner" | "check" | "cross" | "warning" | "alert-circle" | "info" | "passkey" | "user" | "eye" | "eye-off";
+type IconName = "plus" | "arrow-right" | "arrow-left" | "spinner" | "check" | "chevron-down" | "cross" | "warning" | "alert-circle" | "info" | "passkey" | "user" | "eye" | "eye-off";
 type IconSize = "16" | "24";
 type IconTone = "default" | "error" | "success" | "disabled";
 declare const zlIconManifest: AtomManifest;
@@ -250,7 +250,99 @@ declare global {
   }
 } //# sourceMappingURL=zl-card.d.ts.map
 //#endregion
-//#region ../api/dist/index-BGnjxx-b.d.mts
+//#region src/atoms/zl-checkbox.d.ts
+/** Detail shape emitted by the `zl-change` event. */
+type ZlCheckboxChangeDetail = {
+  name: string;
+  checked: boolean;
+  value: string;
+};
+/**
+ * Atom: `<zl-checkbox>` — labelled checkbox bound to a boolean choice.
+ *
+ * Spec lineage (file `8UjCXw8yemgljmbkWGrSfE`, "Zitadel - Design System - External"):
+ *   - bare master variant set:        node `4387:460` (Checkbox)
+ *   - labelled master variant set:    node `6634:1868` (Checkbox / With Label)
+ *
+ * Figma models the checked state as the `style` variant (Outline = unchecked,
+ * Filled = checked) and Hovered / Focused / Pressed as a 32px circular halo
+ * behind the 16px box. Those map to real CSS pseudo-classes; only the optional
+ * `data-state` preview hook forces a state for the design matrix.
+ *
+ *   Box       16px, 2px radius, 8px gap to label, Inter 14/20 label.
+ *   Unchecked 1px border icon.default-white (#f4f4f6).
+ *   Checked   filled icon.default-white with a dark check glyph.
+ *   Hover     halo surface.default-primary-gray; edge/fill icon.default-gray.
+ *   Focus/Pressed  halo + edge/fill surface.default-white.
+ *   Disabled  edge/fill text.disabled (#686883), muted label, no halo.
+ *
+ * Form participation: `<zl-checkbox>` is a form-associated custom element, so
+ * it submits its `value` only when checked, exactly like a native checkbox.
+ */
+declare class ZlCheckbox extends LitElement {
+  static formAssociated: boolean;
+  static shadowRootOptions: ShadowRootInit;
+  static styles: _$lit.CSSResult[];
+  /**
+   * Field name — used as the key in form submission and in `zl-change` detail.
+   * The browser owns a native `name` property on form-associated elements, so
+   * we manage it manually to avoid a conflicting auto-generated accessor (see
+   * `<zl-field>`).
+   */
+  get name(): string;
+  set name(value: string);
+  accessor label: string;
+  accessor value: string;
+  accessor checked: boolean;
+  accessor disabled: boolean;
+  accessor required: boolean;
+  accessor ariaLabelText: string | undefined;
+  accessor testId: string | undefined;
+  /**
+   * Forces a visual interaction state on the box, projected to the root's
+   * `data-state` attribute. Preview-only — used by the design matrix to
+   * capture hover/focus/pressed without real pointer interaction.
+   */
+  accessor forcedState: string | null;
+  private accessor inputEl;
+  private readonly inputId;
+  private readonly internals;
+  private defaultChecked;
+  constructor();
+  connectedCallback(): void;
+  willUpdate(changed: PropertyValues<this>): void;
+  formResetCallback(): void;
+  formStateRestoreCallback(state: string | null): void;
+  focus(options?: FocusOptions): void;
+  render(): _$lit.TemplateResult<1>;
+  private handleChange;
+  private syncFormState;
+  private nativeInputTestId;
+}
+declare const zlCheckboxManifest: AtomManifest;
+declare global {
+  interface HTMLElementTagNameMap {
+    "zl-checkbox": ZlCheckbox;
+  }
+} //# sourceMappingURL=zl-checkbox.d.ts.map
+//#endregion
+//#region ../api/dist/index-DLJ0vloQ.d.mts
+//#endregion
+//#region src/generated/model/activateFlowDefinitionParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type ActivateFlowDefinitionParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+}; //#endregion
 //#region src/generated/model/authorizeDevice200.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -796,7 +888,7 @@ type CreateFlow201Branding = {
   font_url?: string; /** Hero/background image URL (used by split layout). */
   hero_url?: string;
 }; //#endregion
-//#region src/generated/model/createFlow201StepActionsItem.d.ts
+//#region src/generated/model/createFlow201StepActionsItemKind.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -804,13 +896,48 @@ type CreateFlow201Branding = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+/**
+ * Classifies how the engine handles this action:
+- `submit`: collect the step's fields and run validate/dispatch/on_success.
+- `passkey`: issue a WebAuthn assertion challenge; the matching transition
+  fires once the returned assertion verifies.
+- `passkey_register`: issue a WebAuthn registration challenge; the matching
+  transition fires once the returned attestation verifies.
+- `navigate`: route through the transition without running the input
+  pipeline. Used for pure-routing actions declared in the flow definition.
+- `back`: return the user to the previous step. Surfaced by the engine
+  when going back is available.
+
+ */
+type CreateFlow201StepActionsItemKind = (typeof CreateFlow201StepActionsItemKind)[keyof typeof CreateFlow201StepActionsItemKind];
+declare const CreateFlow201StepActionsItemKind: {
+  readonly submit: "submit";
+  readonly passkey: "passkey";
+  readonly passkey_register: "passkey_register";
+  readonly navigate: "navigate";
+  readonly back: "back";
+}; //#endregion
+//#region src/generated/model/createFlow201StepActionsItem.d.ts
 /**
  * Configuration for a user-invokable action on a step. The `name` is sent
-back in the submit request as `action`.
+back in the submit request as `action`; the engine resolves the action's
+declared `kind` to decide how to handle the submission.
 
  */
 type CreateFlow201StepActionsItem = {
   /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Classifies how the engine handles this action:
+  - `submit`: collect the step's fields and run validate/dispatch/on_success.
+  - `passkey`: issue a WebAuthn assertion challenge; the matching transition
+    fires once the returned assertion verifies.
+  - `passkey_register`: issue a WebAuthn registration challenge; the matching
+    transition fires once the returned attestation verifies.
+  - `navigate`: route through the transition without running the input
+    pipeline. Used for pure-routing actions declared in the flow definition.
+  - `back`: return the user to the previous step. Surfaced by the engine
+    when going back is available.
+   */
+  kind: CreateFlow201StepActionsItemKind;
   /** Marks this as the default/primary action. The runtime template uses
   this hint to choose visual emphasis. At most one action per step
   should be primary; this is not enforced here.
@@ -837,6 +964,7 @@ type CreateFlow201StepActionsItem = {
 type CreateFlow201StepChallengeMethod = (typeof CreateFlow201StepChallengeMethod)[keyof typeof CreateFlow201StepChallengeMethod];
 declare const CreateFlow201StepChallengeMethod: {
   readonly passkey: "passkey";
+  readonly passkey_register: "passkey_register";
 }; //#endregion
 //#region src/generated/model/createFlow201StepChallengeOptions.d.ts
 /**
@@ -1245,6 +1373,11 @@ type CreateFlowBody = {
         * @pattern ^[a-z][a-z0-9-]*$
      */
   flow_definition_name?: string;
+  /** Set to true to simulate the flow without actually creating any
+  user or session. Useful for testing and validation of flow definitions.
+  This requires setting the `flow_definition_name` property as well.
+   */
+  dry_run?: boolean;
   /**
      * Semver version of the flow definition JSON Schema to use.
   When omitted, the latest version is used.
@@ -1295,7 +1428,31 @@ type CreateFlowDefinition201FlowDefinitionAudience = {
   /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
   app_ids?: string[];
 }; //#endregion
-//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemActionsItem.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStatus.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The lifecycle state of this flow definition.
+
+active: The flow definition is ready to be used. The flow engine can select it for new flows.
+draft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.
+
+Allowed transitions:
+- draft -> active: To activate the flow definition.
+- active -> draft: To remove the flow definition from active use immediately.
+
+ */
+type CreateFlowDefinition201FlowDefinitionStatus = (typeof CreateFlowDefinition201FlowDefinitionStatus)[keyof typeof CreateFlowDefinition201FlowDefinitionStatus];
+declare const CreateFlowDefinition201FlowDefinitionStatus: {
+  readonly active: "active";
+  readonly draft: "draft";
+}; //#endregion
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemActionsItemKind.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1303,13 +1460,48 @@ type CreateFlowDefinition201FlowDefinitionAudience = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+/**
+ * Classifies how the engine handles this action:
+- `submit`: collect the step's fields and run validate/dispatch/on_success.
+- `passkey`: issue a WebAuthn assertion challenge; the matching transition
+  fires once the returned assertion verifies.
+- `passkey_register`: issue a WebAuthn registration challenge; the matching
+  transition fires once the returned attestation verifies.
+- `navigate`: route through the transition without running the input
+  pipeline. Used for pure-routing actions declared in the flow definition.
+- `back`: return the user to the previous step. Surfaced by the engine
+  when going back is available.
+
+ */
+type CreateFlowDefinition201FlowDefinitionStepsItemActionsItemKind = (typeof CreateFlowDefinition201FlowDefinitionStepsItemActionsItemKind)[keyof typeof CreateFlowDefinition201FlowDefinitionStepsItemActionsItemKind];
+declare const CreateFlowDefinition201FlowDefinitionStepsItemActionsItemKind: {
+  readonly submit: "submit";
+  readonly passkey: "passkey";
+  readonly passkey_register: "passkey_register";
+  readonly navigate: "navigate";
+  readonly back: "back";
+}; //#endregion
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemActionsItem.d.ts
 /**
  * Configuration for a user-invokable action on a step. The `name` is sent
-back in the submit request as `action`.
+back in the submit request as `action`; the engine resolves the action's
+declared `kind` to decide how to handle the submission.
 
  */
 type CreateFlowDefinition201FlowDefinitionStepsItemActionsItem = {
   /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Classifies how the engine handles this action:
+  - `submit`: collect the step's fields and run validate/dispatch/on_success.
+  - `passkey`: issue a WebAuthn assertion challenge; the matching transition
+    fires once the returned assertion verifies.
+  - `passkey_register`: issue a WebAuthn registration challenge; the matching
+    transition fires once the returned attestation verifies.
+  - `navigate`: route through the transition without running the input
+    pipeline. Used for pure-routing actions declared in the flow definition.
+  - `back`: return the user to the previous step. Surfaced by the engine
+    when going back is available.
+   */
+  kind: CreateFlowDefinition201FlowDefinitionStepsItemActionsItemKind;
   /** Marks this as the default/primary action. The runtime template uses
   this hint to choose visual emphasis. At most one action per step
   should be primary; this is not enforced here.
@@ -1547,6 +1739,14 @@ type CreateFlowDefinition201FlowDefinition = {
         * @pattern ^[a-z][a-z0-9-]*$
      */
   name: string;
+  /** The lifecycle state of this flow definition.
+     active: The flow definition is ready to be used. The flow engine can select it for new flows.
+  draft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.
+     Allowed transitions:
+  - draft -> active: To activate the flow definition.
+  - active -> draft: To remove the flow definition from active use immediately.
+   */
+  status: CreateFlowDefinition201FlowDefinitionStatus;
   /** User schema this flow operates on. Step `fields` reference properties
   defined in this schema. The engine resolves field types, validation,
   and implicit outcomes from schema annotations at runtime.
@@ -1574,8 +1774,7 @@ type CreateFlowDefinition201FlowDefinition = {
 //#region src/generated/model/createFlowDefinition201.d.ts
 type CreateFlowDefinition201 = {
   /** Unique identifier for the flow definition. */id: string; /** Identifier of the project this flow definition belongs to. */
-  project_id: string; /** Status of the flow definition. */
-  status: string;
+  project_id: string;
   /** A flow definition is the server-side configuration that describes a complete
   authentication or identity flow. It is NOT sent to the frontend — the flow
   engine evaluates it and produces FlowResponse payloads (steps with capability
@@ -1619,7 +1818,7 @@ type CreateFlowDefinitionBodyFlowDefinitionAudience = {
   /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
   app_ids?: string[];
 }; //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemActionsItem.d.ts
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStatus.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1627,13 +1826,72 @@ type CreateFlowDefinitionBodyFlowDefinitionAudience = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+/**
+ * The lifecycle state of this flow definition.
+
+active: The flow definition is ready to be used. The flow engine can select it for new flows.
+draft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.
+
+Allowed transitions:
+- draft -> active: To activate the flow definition.
+- active -> draft: To remove the flow definition from active use immediately.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStatus = (typeof CreateFlowDefinitionBodyFlowDefinitionStatus)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStatus];
+declare const CreateFlowDefinitionBodyFlowDefinitionStatus: {
+  readonly active: "active";
+  readonly draft: "draft";
+}; //#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Classifies how the engine handles this action:
+- `submit`: collect the step's fields and run validate/dispatch/on_success.
+- `passkey`: issue a WebAuthn assertion challenge; the matching transition
+  fires once the returned assertion verifies.
+- `passkey_register`: issue a WebAuthn registration challenge; the matching
+  transition fires once the returned attestation verifies.
+- `navigate`: route through the transition without running the input
+  pipeline. Used for pure-routing actions declared in the flow definition.
+- `back`: return the user to the previous step. Surfaced by the engine
+  when going back is available.
+
+ */
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind = (typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind)[keyof typeof CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind];
+declare const CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind: {
+  readonly submit: "submit";
+  readonly passkey: "passkey";
+  readonly passkey_register: "passkey_register";
+  readonly navigate: "navigate";
+  readonly back: "back";
+}; //#endregion
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemActionsItem.d.ts
 /**
  * Configuration for a user-invokable action on a step. The `name` is sent
-back in the submit request as `action`.
+back in the submit request as `action`; the engine resolves the action's
+declared `kind` to decide how to handle the submission.
 
  */
 type CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItem = {
   /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Classifies how the engine handles this action:
+  - `submit`: collect the step's fields and run validate/dispatch/on_success.
+  - `passkey`: issue a WebAuthn assertion challenge; the matching transition
+    fires once the returned assertion verifies.
+  - `passkey_register`: issue a WebAuthn registration challenge; the matching
+    transition fires once the returned attestation verifies.
+  - `navigate`: route through the transition without running the input
+    pipeline. Used for pure-routing actions declared in the flow definition.
+  - `back`: return the user to the previous step. Surfaced by the engine
+    when going back is available.
+   */
+  kind: CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind;
   /** Marks this as the default/primary action. The runtime template uses
   this hint to choose visual emphasis. At most one action per step
   should be primary; this is not enforced here.
@@ -1871,6 +2129,14 @@ type CreateFlowDefinitionBodyFlowDefinition = {
         * @pattern ^[a-z][a-z0-9-]*$
      */
   name: string;
+  /** The lifecycle state of this flow definition.
+     active: The flow definition is ready to be used. The flow engine can select it for new flows.
+  draft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.
+     Allowed transitions:
+  - draft -> active: To activate the flow definition.
+  - active -> draft: To remove the flow definition from active use immediately.
+   */
+  status: CreateFlowDefinitionBodyFlowDefinitionStatus;
   /** User schema this flow operates on. Step `fields` reference properties
   defined in this schema. The engine resolves field types, validation,
   and implicit outcomes from schema annotations at runtime.
@@ -1896,6 +2162,12 @@ type CreateFlowDefinitionBodyFlowDefinition = {
   steps: CreateFlowDefinitionBodyFlowDefinitionStepsItem[];
 }; //#endregion
 //#region src/generated/model/createFlowDefinitionBody.d.ts
+/**
+ * Creates a flow definition.
+The flow definition is created in an `active` state by default.
+The status can also be set via the `status` attribute in the flow definition payload.
+
+ */
 type CreateFlowDefinitionBody = {
   /** @pattern ^[a-zA-Z0-9_-]+$ */project_id: string;
   /** URI of the server-published flow definition schema this definition was
@@ -2523,7 +2795,34 @@ type CreateUserParams = {
    */
   team_id?: string;
 }; //#endregion
-//#region src/generated/model/deleteFlowDefinitionDefaultDetails.d.ts
+//#region src/generated/model/deactivateFlowDefinition400Details.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Additional error-specific context.
+ */
+//#endregion
+//#region src/generated/model/deactivateFlowDefinitionParams.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+type DeactivateFlowDefinitionParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+}; //#endregion
+//#region src/generated/model/deleteFlowDefinition409Details.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3133,7 +3432,7 @@ type GetFlowDefinition200FlowDefinitionAudience = {
   /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
   app_ids?: string[];
 }; //#endregion
-//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemActionsItem.d.ts
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStatus.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3141,13 +3440,72 @@ type GetFlowDefinition200FlowDefinitionAudience = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+/**
+ * The lifecycle state of this flow definition.
+
+active: The flow definition is ready to be used. The flow engine can select it for new flows.
+draft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.
+
+Allowed transitions:
+- draft -> active: To activate the flow definition.
+- active -> draft: To remove the flow definition from active use immediately.
+
+ */
+type GetFlowDefinition200FlowDefinitionStatus = (typeof GetFlowDefinition200FlowDefinitionStatus)[keyof typeof GetFlowDefinition200FlowDefinitionStatus];
+declare const GetFlowDefinition200FlowDefinitionStatus: {
+  readonly active: "active";
+  readonly draft: "draft";
+}; //#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemActionsItemKind.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Classifies how the engine handles this action:
+- `submit`: collect the step's fields and run validate/dispatch/on_success.
+- `passkey`: issue a WebAuthn assertion challenge; the matching transition
+  fires once the returned assertion verifies.
+- `passkey_register`: issue a WebAuthn registration challenge; the matching
+  transition fires once the returned attestation verifies.
+- `navigate`: route through the transition without running the input
+  pipeline. Used for pure-routing actions declared in the flow definition.
+- `back`: return the user to the previous step. Surfaced by the engine
+  when going back is available.
+
+ */
+type GetFlowDefinition200FlowDefinitionStepsItemActionsItemKind = (typeof GetFlowDefinition200FlowDefinitionStepsItemActionsItemKind)[keyof typeof GetFlowDefinition200FlowDefinitionStepsItemActionsItemKind];
+declare const GetFlowDefinition200FlowDefinitionStepsItemActionsItemKind: {
+  readonly submit: "submit";
+  readonly passkey: "passkey";
+  readonly passkey_register: "passkey_register";
+  readonly navigate: "navigate";
+  readonly back: "back";
+}; //#endregion
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemActionsItem.d.ts
 /**
  * Configuration for a user-invokable action on a step. The `name` is sent
-back in the submit request as `action`.
+back in the submit request as `action`; the engine resolves the action's
+declared `kind` to decide how to handle the submission.
 
  */
 type GetFlowDefinition200FlowDefinitionStepsItemActionsItem = {
   /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Classifies how the engine handles this action:
+  - `submit`: collect the step's fields and run validate/dispatch/on_success.
+  - `passkey`: issue a WebAuthn assertion challenge; the matching transition
+    fires once the returned assertion verifies.
+  - `passkey_register`: issue a WebAuthn registration challenge; the matching
+    transition fires once the returned attestation verifies.
+  - `navigate`: route through the transition without running the input
+    pipeline. Used for pure-routing actions declared in the flow definition.
+  - `back`: return the user to the previous step. Surfaced by the engine
+    when going back is available.
+   */
+  kind: GetFlowDefinition200FlowDefinitionStepsItemActionsItemKind;
   /** Marks this as the default/primary action. The runtime template uses
   this hint to choose visual emphasis. At most one action per step
   should be primary; this is not enforced here.
@@ -3385,6 +3743,14 @@ type GetFlowDefinition200FlowDefinition = {
         * @pattern ^[a-z][a-z0-9-]*$
      */
   name: string;
+  /** The lifecycle state of this flow definition.
+     active: The flow definition is ready to be used. The flow engine can select it for new flows.
+  draft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.
+     Allowed transitions:
+  - draft -> active: To activate the flow definition.
+  - active -> draft: To remove the flow definition from active use immediately.
+   */
+  status: GetFlowDefinition200FlowDefinitionStatus;
   /** User schema this flow operates on. Step `fields` reference properties
   defined in this schema. The engine resolves field types, validation,
   and implicit outcomes from schema annotations at runtime.
@@ -3412,8 +3778,7 @@ type GetFlowDefinition200FlowDefinition = {
 //#region src/generated/model/getFlowDefinition200.d.ts
 type GetFlowDefinition200 = {
   /** Unique identifier for the flow definition. */id: string; /** Identifier of the project this flow definition belongs to. */
-  project_id: string; /** Status of the flow definition. */
-  status: string;
+  project_id: string;
   /** A flow definition is the server-side configuration that describes a complete
   authentication or identity flow. It is NOT sent to the frontend — the flow
   engine evaluates it and produces FlowResponse payloads (steps with capability
@@ -3494,7 +3859,7 @@ type GetFlowStep200Branding = {
   font_url?: string; /** Hero/background image URL (used by split layout). */
   hero_url?: string;
 }; //#endregion
-//#region src/generated/model/getFlowStep200StepActionsItem.d.ts
+//#region src/generated/model/getFlowStep200StepActionsItemKind.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3502,13 +3867,48 @@ type GetFlowStep200Branding = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+/**
+ * Classifies how the engine handles this action:
+- `submit`: collect the step's fields and run validate/dispatch/on_success.
+- `passkey`: issue a WebAuthn assertion challenge; the matching transition
+  fires once the returned assertion verifies.
+- `passkey_register`: issue a WebAuthn registration challenge; the matching
+  transition fires once the returned attestation verifies.
+- `navigate`: route through the transition without running the input
+  pipeline. Used for pure-routing actions declared in the flow definition.
+- `back`: return the user to the previous step. Surfaced by the engine
+  when going back is available.
+
+ */
+type GetFlowStep200StepActionsItemKind = (typeof GetFlowStep200StepActionsItemKind)[keyof typeof GetFlowStep200StepActionsItemKind];
+declare const GetFlowStep200StepActionsItemKind: {
+  readonly submit: "submit";
+  readonly passkey: "passkey";
+  readonly passkey_register: "passkey_register";
+  readonly navigate: "navigate";
+  readonly back: "back";
+}; //#endregion
+//#region src/generated/model/getFlowStep200StepActionsItem.d.ts
 /**
  * Configuration for a user-invokable action on a step. The `name` is sent
-back in the submit request as `action`.
+back in the submit request as `action`; the engine resolves the action's
+declared `kind` to decide how to handle the submission.
 
  */
 type GetFlowStep200StepActionsItem = {
   /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Classifies how the engine handles this action:
+  - `submit`: collect the step's fields and run validate/dispatch/on_success.
+  - `passkey`: issue a WebAuthn assertion challenge; the matching transition
+    fires once the returned assertion verifies.
+  - `passkey_register`: issue a WebAuthn registration challenge; the matching
+    transition fires once the returned attestation verifies.
+  - `navigate`: route through the transition without running the input
+    pipeline. Used for pure-routing actions declared in the flow definition.
+  - `back`: return the user to the previous step. Surfaced by the engine
+    when going back is available.
+   */
+  kind: GetFlowStep200StepActionsItemKind;
   /** Marks this as the default/primary action. The runtime template uses
   this hint to choose visual emphasis. At most one action per step
   should be primary; this is not enforced here.
@@ -3535,6 +3935,7 @@ type GetFlowStep200StepActionsItem = {
 type GetFlowStep200StepChallengeMethod = (typeof GetFlowStep200StepChallengeMethod)[keyof typeof GetFlowStep200StepChallengeMethod];
 declare const GetFlowStep200StepChallengeMethod: {
   readonly passkey: "passkey";
+  readonly passkey_register: "passkey_register";
 }; //#endregion
 //#region src/generated/model/getFlowStep200StepChallengeOptions.d.ts
 /**
@@ -5084,7 +5485,7 @@ type IssueChallengeBody = {
  * OpenAPI spec version: 0.0.1
  */
 //#endregion
-//#region src/generated/model/listFlowDefinitions200FlowDefinitionsItem.d.ts
+//#region src/generated/model/listFlowDefinitions200FlowDefinitionsItemStatus.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5092,6 +5493,23 @@ type IssueChallengeBody = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+/**
+ * The lifecycle state of this flow definition.
+
+active: The flow definition is ready to be used. The flow engine can select it for new flows.
+draft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.
+
+Allowed transitions:
+- draft -> active: To activate the flow definition.
+- active -> draft: To remove the flow definition from active use immediately.
+
+ */
+type ListFlowDefinitions200FlowDefinitionsItemStatus = (typeof ListFlowDefinitions200FlowDefinitionsItemStatus)[keyof typeof ListFlowDefinitions200FlowDefinitionsItemStatus];
+declare const ListFlowDefinitions200FlowDefinitionsItemStatus: {
+  readonly active: "active";
+  readonly draft: "draft";
+}; //#endregion
+//#region src/generated/model/listFlowDefinitions200FlowDefinitionsItem.d.ts
 /**
  * Response object for a flow definition after creation.
 
@@ -5107,8 +5525,15 @@ type ListFlowDefinitions200FlowDefinitionsItem = {
   /** URI of the flow definition schema this definition was authored against.
   If the schema_uri was not provided in the request, the flow definition is validated against the latest version of the schema, and the response includes the schema_uri of the latest version.
    */
-  schema_uri?: string; /** Status of the flow definition. */
-  status: string; /** Timestamp when the flow definition was created. */
+  schema_uri?: string;
+  /** The lifecycle state of this flow definition.
+     active: The flow definition is ready to be used. The flow engine can select it for new flows.
+  draft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.
+     Allowed transitions:
+  - draft -> active: To activate the flow definition.
+  - active -> draft: To remove the flow definition from active use immediately.
+   */
+  status: ListFlowDefinitions200FlowDefinitionsItemStatus; /** Timestamp when the flow definition was created. */
   created_at: string; /** Timestamp when the flow definition was last updated. */
   updated_at: string;
 }; //#endregion
@@ -5649,7 +6074,7 @@ type SubmitFlowStep200Branding = {
   font_url?: string; /** Hero/background image URL (used by split layout). */
   hero_url?: string;
 }; //#endregion
-//#region src/generated/model/submitFlowStep200StepActionsItem.d.ts
+//#region src/generated/model/submitFlowStep200StepActionsItemKind.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5657,13 +6082,48 @@ type SubmitFlowStep200Branding = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+/**
+ * Classifies how the engine handles this action:
+- `submit`: collect the step's fields and run validate/dispatch/on_success.
+- `passkey`: issue a WebAuthn assertion challenge; the matching transition
+  fires once the returned assertion verifies.
+- `passkey_register`: issue a WebAuthn registration challenge; the matching
+  transition fires once the returned attestation verifies.
+- `navigate`: route through the transition without running the input
+  pipeline. Used for pure-routing actions declared in the flow definition.
+- `back`: return the user to the previous step. Surfaced by the engine
+  when going back is available.
+
+ */
+type SubmitFlowStep200StepActionsItemKind = (typeof SubmitFlowStep200StepActionsItemKind)[keyof typeof SubmitFlowStep200StepActionsItemKind];
+declare const SubmitFlowStep200StepActionsItemKind: {
+  readonly submit: "submit";
+  readonly passkey: "passkey";
+  readonly passkey_register: "passkey_register";
+  readonly navigate: "navigate";
+  readonly back: "back";
+}; //#endregion
+//#region src/generated/model/submitFlowStep200StepActionsItem.d.ts
 /**
  * Configuration for a user-invokable action on a step. The `name` is sent
-back in the submit request as `action`.
+back in the submit request as `action`; the engine resolves the action's
+declared `kind` to decide how to handle the submission.
 
  */
 type SubmitFlowStep200StepActionsItem = {
   /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Classifies how the engine handles this action:
+  - `submit`: collect the step's fields and run validate/dispatch/on_success.
+  - `passkey`: issue a WebAuthn assertion challenge; the matching transition
+    fires once the returned assertion verifies.
+  - `passkey_register`: issue a WebAuthn registration challenge; the matching
+    transition fires once the returned attestation verifies.
+  - `navigate`: route through the transition without running the input
+    pipeline. Used for pure-routing actions declared in the flow definition.
+  - `back`: return the user to the previous step. Surfaced by the engine
+    when going back is available.
+   */
+  kind: SubmitFlowStep200StepActionsItemKind;
   /** Marks this as the default/primary action. The runtime template uses
   this hint to choose visual emphasis. At most one action per step
   should be primary; this is not enforced here.
@@ -5690,6 +6150,7 @@ type SubmitFlowStep200StepActionsItem = {
 type SubmitFlowStep200StepChallengeMethod = (typeof SubmitFlowStep200StepChallengeMethod)[keyof typeof SubmitFlowStep200StepChallengeMethod];
 declare const SubmitFlowStep200StepChallengeMethod: {
   readonly passkey: "passkey";
+  readonly passkey_register: "passkey_register";
 }; //#endregion
 //#region src/generated/model/submitFlowStep200StepChallengeOptions.d.ts
 /**
@@ -6180,7 +6641,7 @@ type UpdateFlowDefinition200FlowDefinitionAudience = {
   /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
   app_ids?: string[];
 }; //#endregion
-//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemActionsItem.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStatus.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6188,13 +6649,72 @@ type UpdateFlowDefinition200FlowDefinitionAudience = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+/**
+ * The lifecycle state of this flow definition.
+
+active: The flow definition is ready to be used. The flow engine can select it for new flows.
+draft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.
+
+Allowed transitions:
+- draft -> active: To activate the flow definition.
+- active -> draft: To remove the flow definition from active use immediately.
+
+ */
+type UpdateFlowDefinition200FlowDefinitionStatus = (typeof UpdateFlowDefinition200FlowDefinitionStatus)[keyof typeof UpdateFlowDefinition200FlowDefinitionStatus];
+declare const UpdateFlowDefinition200FlowDefinitionStatus: {
+  readonly active: "active";
+  readonly draft: "draft";
+}; //#endregion
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemActionsItemKind.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * Classifies how the engine handles this action:
+- `submit`: collect the step's fields and run validate/dispatch/on_success.
+- `passkey`: issue a WebAuthn assertion challenge; the matching transition
+  fires once the returned assertion verifies.
+- `passkey_register`: issue a WebAuthn registration challenge; the matching
+  transition fires once the returned attestation verifies.
+- `navigate`: route through the transition without running the input
+  pipeline. Used for pure-routing actions declared in the flow definition.
+- `back`: return the user to the previous step. Surfaced by the engine
+  when going back is available.
+
+ */
+type UpdateFlowDefinition200FlowDefinitionStepsItemActionsItemKind = (typeof UpdateFlowDefinition200FlowDefinitionStepsItemActionsItemKind)[keyof typeof UpdateFlowDefinition200FlowDefinitionStepsItemActionsItemKind];
+declare const UpdateFlowDefinition200FlowDefinitionStepsItemActionsItemKind: {
+  readonly submit: "submit";
+  readonly passkey: "passkey";
+  readonly passkey_register: "passkey_register";
+  readonly navigate: "navigate";
+  readonly back: "back";
+}; //#endregion
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemActionsItem.d.ts
 /**
  * Configuration for a user-invokable action on a step. The `name` is sent
-back in the submit request as `action`.
+back in the submit request as `action`; the engine resolves the action's
+declared `kind` to decide how to handle the submission.
 
  */
 type UpdateFlowDefinition200FlowDefinitionStepsItemActionsItem = {
   /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Classifies how the engine handles this action:
+  - `submit`: collect the step's fields and run validate/dispatch/on_success.
+  - `passkey`: issue a WebAuthn assertion challenge; the matching transition
+    fires once the returned assertion verifies.
+  - `passkey_register`: issue a WebAuthn registration challenge; the matching
+    transition fires once the returned attestation verifies.
+  - `navigate`: route through the transition without running the input
+    pipeline. Used for pure-routing actions declared in the flow definition.
+  - `back`: return the user to the previous step. Surfaced by the engine
+    when going back is available.
+   */
+  kind: UpdateFlowDefinition200FlowDefinitionStepsItemActionsItemKind;
   /** Marks this as the default/primary action. The runtime template uses
   this hint to choose visual emphasis. At most one action per step
   should be primary; this is not enforced here.
@@ -6432,6 +6952,14 @@ type UpdateFlowDefinition200FlowDefinition = {
         * @pattern ^[a-z][a-z0-9-]*$
      */
   name: string;
+  /** The lifecycle state of this flow definition.
+     active: The flow definition is ready to be used. The flow engine can select it for new flows.
+  draft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.
+     Allowed transitions:
+  - draft -> active: To activate the flow definition.
+  - active -> draft: To remove the flow definition from active use immediately.
+   */
+  status: UpdateFlowDefinition200FlowDefinitionStatus;
   /** User schema this flow operates on. Step `fields` reference properties
   defined in this schema. The engine resolves field types, validation,
   and implicit outcomes from schema annotations at runtime.
@@ -6459,8 +6987,7 @@ type UpdateFlowDefinition200FlowDefinition = {
 //#region src/generated/model/updateFlowDefinition200.d.ts
 type UpdateFlowDefinition200 = {
   /** Unique identifier for the flow definition. */id: string; /** Identifier of the project this flow definition belongs to. */
-  project_id: string; /** Status of the flow definition. */
-  status: string;
+  project_id: string;
   /** A flow definition is the server-side configuration that describes a complete
   authentication or identity flow. It is NOT sent to the frontend — the flow
   engine evaluates it and produces FlowResponse payloads (steps with capability
@@ -6485,7 +7012,7 @@ type UpdateFlowDefinition200 = {
  * Additional error-specific context.
  */
 //#endregion
-//#region src/generated/model/updateFlowDefinitionBodyAudience.d.ts
+//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionAudience.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6500,11 +7027,35 @@ matches every request in the project. The engine picks the most specific
 matching definition: app > team > project-wide.
 
  */
-type UpdateFlowDefinitionBodyAudience = {
+type UpdateFlowDefinitionBodyFlowDefinitionAudience = {
   /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
   app_ids?: string[];
 }; //#endregion
-//#region src/generated/model/updateFlowDefinitionBodyStepsItemActionsItem.d.ts
+//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStatus.d.ts
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+/**
+ * The lifecycle state of this flow definition.
+
+active: The flow definition is ready to be used. The flow engine can select it for new flows.
+draft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.
+
+Allowed transitions:
+- draft -> active: To activate the flow definition.
+- active -> draft: To remove the flow definition from active use immediately.
+
+ */
+type UpdateFlowDefinitionBodyFlowDefinitionStatus = (typeof UpdateFlowDefinitionBodyFlowDefinitionStatus)[keyof typeof UpdateFlowDefinitionBodyFlowDefinitionStatus];
+declare const UpdateFlowDefinitionBodyFlowDefinitionStatus: {
+  readonly active: "active";
+  readonly draft: "draft";
+}; //#endregion
+//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6512,13 +7063,48 @@ type UpdateFlowDefinitionBodyAudience = {
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
+/**
+ * Classifies how the engine handles this action:
+- `submit`: collect the step's fields and run validate/dispatch/on_success.
+- `passkey`: issue a WebAuthn assertion challenge; the matching transition
+  fires once the returned assertion verifies.
+- `passkey_register`: issue a WebAuthn registration challenge; the matching
+  transition fires once the returned attestation verifies.
+- `navigate`: route through the transition without running the input
+  pipeline. Used for pure-routing actions declared in the flow definition.
+- `back`: return the user to the previous step. Surfaced by the engine
+  when going back is available.
+
+ */
+type UpdateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind = (typeof UpdateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind)[keyof typeof UpdateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind];
+declare const UpdateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind: {
+  readonly submit: "submit";
+  readonly passkey: "passkey";
+  readonly passkey_register: "passkey_register";
+  readonly navigate: "navigate";
+  readonly back: "back";
+}; //#endregion
+//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStepsItemActionsItem.d.ts
 /**
  * Configuration for a user-invokable action on a step. The `name` is sent
-back in the submit request as `action`.
+back in the submit request as `action`; the engine resolves the action's
+declared `kind` to decide how to handle the submission.
 
  */
-type UpdateFlowDefinitionBodyStepsItemActionsItem = {
+type UpdateFlowDefinitionBodyFlowDefinitionStepsItemActionsItem = {
   /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Classifies how the engine handles this action:
+  - `submit`: collect the step's fields and run validate/dispatch/on_success.
+  - `passkey`: issue a WebAuthn assertion challenge; the matching transition
+    fires once the returned assertion verifies.
+  - `passkey_register`: issue a WebAuthn registration challenge; the matching
+    transition fires once the returned attestation verifies.
+  - `navigate`: route through the transition without running the input
+    pipeline. Used for pure-routing actions declared in the flow definition.
+  - `back`: return the user to the previous step. Surfaced by the engine
+    when going back is available.
+   */
+  kind: UpdateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemKind;
   /** Marks this as the default/primary action. The runtime template uses
   this hint to choose visual emphasis. At most one action per step
   should be primary; this is not enforced here.
@@ -6531,7 +7117,7 @@ type UpdateFlowDefinitionBodyStepsItemActionsItem = {
    */
   text_key?: string;
 }; //#endregion
-//#region src/generated/model/updateFlowDefinitionBodyStepsItemComplete.d.ts
+//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStepsItemComplete.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6545,12 +7131,12 @@ type UpdateFlowDefinitionBodyStepsItemActionsItem = {
 - show: render as a success/info screen
 
  */
-type UpdateFlowDefinitionBodyStepsItemComplete = (typeof UpdateFlowDefinitionBodyStepsItemComplete)[keyof typeof UpdateFlowDefinitionBodyStepsItemComplete];
-declare const UpdateFlowDefinitionBodyStepsItemComplete: {
+type UpdateFlowDefinitionBodyFlowDefinitionStepsItemComplete = (typeof UpdateFlowDefinitionBodyFlowDefinitionStepsItemComplete)[keyof typeof UpdateFlowDefinitionBodyFlowDefinitionStepsItemComplete];
+declare const UpdateFlowDefinitionBodyFlowDefinitionStepsItemComplete: {
   readonly redirect: "redirect";
   readonly show: "show";
 }; //#endregion
-//#region src/generated/model/updateFlowDefinitionBodyStepsItemGatesConfig.d.ts
+//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6563,10 +7149,10 @@ declare const UpdateFlowDefinitionBodyStepsItemComplete: {
 issuing the per-render challenge. Opaque to the engine.
 
  */
-type UpdateFlowDefinitionBodyStepsItemGatesConfig = {
+type UpdateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig = {
   [key: string]: unknown;
 }; //#endregion
-//#region src/generated/model/updateFlowDefinitionBodyStepsItemGatesKind.d.ts
+//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6580,11 +7166,11 @@ ceremonies (e.g. passkey) are modelled as credential auth_attempts via
 `x-credential` on a field, not as gates.
 
  */
-type UpdateFlowDefinitionBodyStepsItemGatesKind = (typeof UpdateFlowDefinitionBodyStepsItemGatesKind)[keyof typeof UpdateFlowDefinitionBodyStepsItemGatesKind];
-declare const UpdateFlowDefinitionBodyStepsItemGatesKind: {
+type UpdateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind = (typeof UpdateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind)[keyof typeof UpdateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind];
+declare const UpdateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind: {
   readonly captcha: "captcha";
 }; //#endregion
-//#region src/generated/model/updateFlowDefinitionBodyStepsItemGates.d.ts
+//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStepsItemGates.d.ts
 /**
  * Security gates that must be satisfied before submission. Keyed by gate
 name. Each gate selects a kind (e.g. "captcha") and provider-specific
@@ -6592,13 +7178,13 @@ configuration. The engine may also inject gates dynamically based on
 policy.
 
  */
-type UpdateFlowDefinitionBodyStepsItemGates = {
+type UpdateFlowDefinitionBodyFlowDefinitionStepsItemGates = {
   [key: string]: {
     /** The gate category. Only `captcha` is currently defined. Authenticator
     ceremonies (e.g. passkey) are modelled as credential auth_attempts via
     `x-credential` on a field, not as gates.
     */
-    kind: UpdateFlowDefinitionBodyStepsItemGatesKind;
+    kind: UpdateFlowDefinitionBodyFlowDefinitionStepsItemGatesKind;
     /** Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,
     `hcaptcha`. The engine looks up an implementation in its provider
     registry.
@@ -6607,10 +7193,10 @@ type UpdateFlowDefinitionBodyStepsItemGates = {
     /** Provider-specific configuration consumed by the implementation when
     issuing the per-render challenge. Opaque to the engine.
     */
-    config?: UpdateFlowDefinitionBodyStepsItemGatesConfig;
+    config?: UpdateFlowDefinitionBodyFlowDefinitionStepsItemGatesConfig;
   };
 }; //#endregion
-//#region src/generated/model/updateFlowDefinitionBodyStepsItemOnSuccess.d.ts
+//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6625,11 +7211,11 @@ Runs after field validation passes, before the transition fires.
 - create_user: creates the user record (registration flows)
 
  */
-type UpdateFlowDefinitionBodyStepsItemOnSuccess = (typeof UpdateFlowDefinitionBodyStepsItemOnSuccess)[keyof typeof UpdateFlowDefinitionBodyStepsItemOnSuccess];
-declare const UpdateFlowDefinitionBodyStepsItemOnSuccess: {
+type UpdateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess = (typeof UpdateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess)[keyof typeof UpdateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess];
+declare const UpdateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess: {
   readonly create_user: "create_user";
 }; //#endregion
-//#region src/generated/model/updateFlowDefinitionBodyStepsItemSsoProvidersItem.d.ts
+//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6640,12 +7226,12 @@ declare const UpdateFlowDefinitionBodyStepsItemOnSuccess: {
 /**
  * An available SSO identity provider.
  */
-type UpdateFlowDefinitionBodyStepsItemSsoProvidersItem = {
+type UpdateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem = {
   /** Provider instance identifier. */id: string; /** Display name for the provider. */
   name: string; /** Template hint for rendering (logo, colors). */
   template: string;
 }; //#endregion
-//#region src/generated/model/updateFlowDefinitionBodyStepsItemTransitions.d.ts
+//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStepsItemTransitions.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6662,7 +7248,7 @@ come from implicit outcomes based on schema annotations
 events (e.g. `sso`, `callback`).
 
  */
-type UpdateFlowDefinitionBodyStepsItemTransitions = {
+type UpdateFlowDefinitionBodyFlowDefinitionStepsItemTransitions = {
   [key: string]: {
     /** Step name within this flow (when `action` is null), or the name
     of another flow (when `action` is `switch` or `pivot`).
@@ -6680,7 +7266,7 @@ type UpdateFlowDefinitionBodyStepsItemTransitions = {
     action?: "switch" | "pivot" | null;
   };
 }; //#endregion
-//#region src/generated/model/updateFlowDefinitionBodyStepsItem.d.ts
+//#region src/generated/model/updateFlowDefinitionBodyFlowDefinitionStepsItem.d.ts
 /**
  * A step in a flow definition. This is the admin-authored configuration,
 not the runtime payload sent to the frontend.
@@ -6693,7 +7279,7 @@ A step with only `complete` set is a terminal step. All other steps are
 rendered to the frontend as capability payloads.
 
  */
-type UpdateFlowDefinitionBodyStepsItem = {
+type UpdateFlowDefinitionBodyFlowDefinitionStepsItem = {
   /** Unique step identifier within this flow. Used as transition targets
   and returned in the API response as `step.name`.
    */
@@ -6709,64 +7295,105 @@ type UpdateFlowDefinitionBodyStepsItem = {
   frontend sends back in the submit request. If omitted, the engine
   provides a default `submit` action.
    */
-  actions?: UpdateFlowDefinitionBodyStepsItemActionsItem[];
+  actions?: UpdateFlowDefinitionBodyFlowDefinitionStepsItemActionsItem[];
   /** Security gates that must be satisfied before submission. Keyed by gate
   name. Each gate selects a kind (e.g. "captcha") and provider-specific
   configuration. The engine may also inject gates dynamically based on
   policy.
    */
-  gates?: UpdateFlowDefinitionBodyStepsItemGates; /** Available SSO identity providers for this step. */
-  sso_providers?: UpdateFlowDefinitionBodyStepsItemSsoProvidersItem[];
+  gates?: UpdateFlowDefinitionBodyFlowDefinitionStepsItemGates; /** Available SSO identity providers for this step. */
+  sso_providers?: UpdateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem[];
   /** Server-side mutation to execute when this step completes successfully.
   Runs after field validation passes, before the transition fires.
      - create_user: creates the user record (registration flows)
    */
-  on_success?: UpdateFlowDefinitionBodyStepsItemOnSuccess;
+  on_success?: UpdateFlowDefinitionBodyFlowDefinitionStepsItemOnSuccess;
   /** Marks this as a terminal step. Tells the frontend what to do:
   - redirect: navigate to redirect_uri (OIDC/SAML callback done)
   - show: render as a success/info screen
    */
-  complete?: UpdateFlowDefinitionBodyStepsItemComplete;
+  complete?: UpdateFlowDefinitionBodyFlowDefinitionStepsItemComplete;
   /** Maps action/outcome names to their transition descriptor.
      Keys match action names from the `actions` array. Additional keys
   come from implicit outcomes based on schema annotations
   (e.g. `user_not_found` from `x-unique` fields) and engine
   events (e.g. `sso`, `callback`).
    */
-  transitions?: UpdateFlowDefinitionBodyStepsItemTransitions;
+  transitions?: UpdateFlowDefinitionBodyFlowDefinitionStepsItemTransitions;
 }; //#endregion
-//#region src/generated/model/updateFlowDefinitionBody.d.ts
+//#region src/generated/model/updateFlowDefinitionBodyFlowDefinition.d.ts
 /**
- * Partial update for a flow definition. Only provided fields are replaced;
-omitted fields retain their current server-side values.
-
-Collection fields (`steps`, `purposes`) are treated atomically: if
-provided, the entire array/object is replaced. If omitted, the current
-value is preserved unchanged.
+ * A flow definition is the server-side configuration that describes a complete
+authentication or identity flow. It is NOT sent to the frontend — the flow
+engine evaluates it and produces FlowResponse payloads (steps with capability
+dictionaries) for the client.
 
-`name` is a stable identifier and cannot be changed after creation.
+Flow definitions are created by administrators and stored in the project/team
+configuration hierarchy. The engine selects the matching definition based on
+the purpose + audience when a flow is created via POST /flow.
 
  */
-type UpdateFlowDefinitionBody = {
-  /** User schema this flow operates on. Replaces the current value if provided.
+type UpdateFlowDefinitionBodyFlowDefinition = {
+  /**
+     * Stable identifier for this flow, used as the target of cross-flow
+  `switch` and `pivot` transitions. Renaming is not supported — the
+  `name` is part of the public contract another definition may
+  reference. Acts as the human display label as well; no separate slug.
+        * @pattern ^[a-z][a-z0-9-]*$
+     */
+  name: string;
+  /** The lifecycle state of this flow definition.
+     active: The flow definition is ready to be used. The flow engine can select it for new flows.
+  draft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.
+     Allowed transitions:
+  - draft -> active: To activate the flow definition.
+  - active -> draft: To remove the flow definition from active use immediately.
+   */
+  status: UpdateFlowDefinitionBodyFlowDefinitionStatus;
+  /** User schema this flow operates on. Step `fields` reference properties
+  defined in this schema. The engine resolves field types, validation,
+  and implicit outcomes from schema annotations at runtime.
    */
-  user_schema?: string;
-  /** Replaces the full purpose-to-entry-step map if provided. Keys are
-  purpose names; values must match a `name` in `steps`.
+  user_schema: string;
+  /** Maps each purpose this definition handles to its entry-point step.
+  Keys are purpose names; values must match a `name` in `steps`. A
+  definition can serve multiple purposes (e.g. a combined login/register
+  flow) by listing one entry per purpose.
    */
-  purposes?: Partial<Record<"login" | "register" | "recovery" | "profiling" | "reauth" | "link_account", string>>;
+  purposes: Partial<Record<"login" | "register" | "recovery" | "profiling" | "reauth" | "link_account", string>>;
   /** Scopes which teams or apps this flow definition applies to. Empty or
   omitted fields mean "no restriction"; when both are empty the definition
   matches every request in the project. The engine picks the most specific
   matching definition: app > team > project-wide.
    */
-  audience?: UpdateFlowDefinitionBodyAudience;
+  audience?: UpdateFlowDefinitionBodyFlowDefinitionAudience;
   /**
-     * Replaces the full steps array if provided. Partial step lists are not
-  supported — supply all steps when updating this field.
+     * Ordered list of steps in this flow. The order is for human readability —
+  actual step sequencing is determined by transitions.
         * @minItems 1
      */
-  steps?: UpdateFlowDefinitionBodyStepsItem[];
+  steps: UpdateFlowDefinitionBodyFlowDefinitionStepsItem[];
+}; //#endregion
+//#region src/generated/model/updateFlowDefinitionBody.d.ts
+/**
+ * Replaces the existing flow definition.
+
+ */
+type UpdateFlowDefinitionBody = {
+  /** URI of the server-published flow definition schema this definition was
+  authored against. The server uses this to validate the definition.
+  If not provided, the engine will use the latest schema version for validation.
+   */
+  schema_uri?: string;
+  /** A flow definition is the server-side configuration that describes a complete
+  authentication or identity flow. It is NOT sent to the frontend — the flow
+  engine evaluates it and produces FlowResponse payloads (steps with capability
+  dictionaries) for the client.
+     Flow definitions are created by administrators and stored in the project/team
+  configuration hierarchy. The engine selects the matching definition based on
+  the purpose + audience when a flow is created via POST /flow.
+   */
+  flow_definition: UpdateFlowDefinitionBodyFlowDefinition;
 }; //#endregion
 //#region src/generated/model/updateFlowDefinitionDefaultDetails.d.ts
 /**
@@ -7392,5 +8019,98 @@ declare global {
   }
 } //# sourceMappingURL=zl-pill.d.ts.map
 //#endregion
-export { GetFlowStep200 as $, CreateFlowDefinitionBody as A, RevokeTokenBody as At, CreateTeamBody as B, VerifyChallengeProofBody as Bt, CreateFlow201StepChallenge as C, ListFlowDefinitions200 as Ct, CreateFlowBody as D, ListUsers200Item as Dt, CreateFlow201StepSsoProvidersItem as E, ListSessionsParams as Et, CreateSchemaBody as F, SubmitFlowStepBody as Ft, DeleteFlowDefinitionParams as G, ZlAlert as Gt, CreateUser201 as H, zlCardManifest as Ht, CreateSchemaParams as I, UpdateFlowDefinition200 as It, ExchangeHandoffBody as J, ZlIcon as Jt, EndSessionParams as K, zlAlertManifest as Kt, CreateSession201 as L, UpdateFlowDefinitionBody as Lt, CreateProject201 as M, SetUserPasswordParams as Mt, CreateProjectBody as N, SubmitFlowEventBody as Nt, CreateFlowBodyPurpose as O, ListUsersParams as Ot, CreateSchema201 as P, SubmitFlowStep200 as Pt, GetFlowDefinitionParams as Q, CreateSessionBody as R, UpdateFlowDefinitionParams as Rt, CreateFlow201StepActionsItem as S, IssueChallengeBody as St, CreateFlow201StepGates as T, ListSessions200 as Tt, CreateUserBody as U, ZlButton as Ut, CreateTeamParams as V, ZlCard as Vt, CreateUserParams as W, zlButtonManifest as Wt, GetAuthAttempt200 as X, ExchangeHandoffParams as Y, zlIconManifest as Yt, GetFlowDefinition200 as Z, CreateAuthAttemptBody as _, GetUserByIDParams as _t, ZlPasskeyResultDetail as a, GetOpenIDConfiguration200 as at, CreateFlow201BrandingLayout as b, IntrospectBody as bt, zlPageShellManifest as c, GetSchemaById200 as ct, zlFieldManifest as d, GetSessionParams as dt, GetHealthDefault as et, AuthorizeDevice200 as f, GetTeam200 as ft, CreateAuthAttempt201 as g, GetUserByID200 as gt, AuthorizeGetParams as h, GetTokenBody as ht, ZlPasskeyErrorDetail as i, GetMyUser200 as it, CreateHandoff200 as j, SetUserPasswordBody as jt, CreateFlowDefinition201 as k, RevokeSessionParams as kt, ZlField as l, GetSchemaByIdParams as lt, AuthorizeGetDefault as m, GetToken200 as mt, zlPillManifest as n, GetLiveDefault as nt, zlPasskeyManifest as o, GetProject200 as ot, AuthorizeDeviceParams as p, GetTeamParams as pt, ExchangeHandoff200 as q, IconName as qt, ZlPasskey as r, GetMySession200 as rt, ZlPageShell as s, GetReadyDefault as st, ZlPill as t, GetKeys200 as tt, ZlFieldType as u, GetSession200 as ut, CreateFlow201 as v, GetUserInfo200 as vt, CreateFlow201StepFieldsItem as w, ListFlowDefinitionsParams as wt, CreateFlow201Step as x, IssueChallenge201 as xt, CreateFlow201Branding as y, Introspect200 as yt, CreateTeam201 as z, VerifyChallengeProof200 as zt };
-//# sourceMappingURL=index-DVDCrfkv.d.mts.map
+//#region src/atoms/zl-select.d.ts
+/** A single choice in a `<zl-select>` listbox. */
+interface ZlSelectOption {
+  value: string;
+  label: string;
+  disabled?: boolean;
+}
+/** Detail shape emitted by the `zl-change` event. */
+type ZlSelectChangeDetail = {
+  name: string;
+  value: string;
+};
+/**
+ * Atom: `<zl-select>` — a select-only combobox bound to a single choice.
+ *
+ * Spec lineage (file `8UjCXw8yemgljmbkWGrSfE`, "Zitadel - Design System - External"):
+ *   - trigger + open/selected matrix:  node `4397:4816` (Dropdown)
+ *   - option (Items) state matrix:      node `4397:4098` (Input text)
+ *
+ * The trigger mirrors `<zl-field>`'s box; the popup is a `role="listbox"` whose
+ * options paint the Figma hover / keyboard-active wash and the chosen row's
+ * solid fill + check glyph. Follows the WAI-ARIA select-only combobox pattern:
+ * focus stays on the trigger and `aria-activedescendant` tracks the active
+ * option, so arrow keys move a virtual cursor without moving DOM focus.
+ *
+ * Form participation: `<zl-select>` is a form-associated custom element; its
+ * `value` is the selected option's value (empty string = nothing chosen).
+ */
+declare class ZlSelect extends LitElement {
+  static formAssociated: boolean;
+  static shadowRootOptions: ShadowRootInit;
+  static styles: _$lit.CSSResult[];
+  /**
+   * Field name — used as the key in form submission and in `zl-change` detail.
+   * Managed manually to avoid clobbering the native form-associated `name`
+   * accessor the browser owns (see `<zl-field>` / `<zl-checkbox>`).
+   */
+  get name(): string;
+  set name(value: string);
+  accessor label: string;
+  accessor value: string;
+  accessor placeholder: string;
+  /**
+   * Listbox options. Accepts either a JS array (property binding, used by React
+   * and Storybook) or a JSON string (the `options` attribute, used by the
+   * orchestrator's Liquid template, which can only emit markup). Mirrors the
+   * `<zl-passkey>` options contract.
+   */
+  accessor options: ZlSelectOption[];
+  accessor required: boolean;
+  accessor disabled: boolean;
+  accessor open: boolean;
+  accessor ariaLabelText: string | undefined;
+  accessor testId: string | undefined;
+  private accessor activeIndex;
+  private accessor triggerEl;
+  private readonly baseId;
+  private readonly internals;
+  private defaultValue;
+  constructor();
+  connectedCallback(): void;
+  disconnectedCallback(): void;
+  willUpdate(changed: PropertyValues<this>): void;
+  formResetCallback(): void;
+  formStateRestoreCallback(state: string | null): void;
+  focus(options?: FocusOptions): void;
+  render(): _$lit.TemplateResult<1>;
+  private renderLabel;
+  private renderOption;
+  private optionId;
+  private handleLabelClick;
+  private handleTriggerClick;
+  private handleTriggerKeyDown;
+  private handleOptionClick;
+  private handleOptionPointerMove;
+  private handleDocumentPointerDown;
+  private openMenu;
+  private close;
+  private commitActive;
+  private moveActive;
+  private setActive;
+  private firstEnabledIndex;
+  private lastEnabledIndex;
+  private syncFormState;
+  private triggerTestId;
+}
+declare const zlSelectManifest: AtomManifest;
+declare global {
+  interface HTMLElementTagNameMap {
+    "zl-select": ZlSelect;
+  }
+} //# sourceMappingURL=zl-select.d.ts.map
+//#endregion
+export { ExchangeHandoff200 as $, zlButtonManifest as $t, CreateFlow201StepGates as A, ListFlowDefinitionsParams as At, CreateSchemaBody as B, SubmitFlowStep200 as Bt, CreateFlow201 as C, GetUserByIDParams as Ct, CreateFlow201StepActionsItem as D, IssueChallenge201 as Dt, CreateFlow201Step as E, IntrospectBody as Et, CreateFlowDefinitionBody as F, RevokeSessionParams as Ft, CreateTeamBody as G, VerifyChallengeProof200 as Gt, CreateSession201 as H, UpdateFlowDefinition200 as Ht, CreateHandoff200 as I, RevokeTokenBody as It, CreateUserBody as J, ZlCheckboxChangeDetail as Jt, CreateTeamParams as K, VerifyChallengeProofBody as Kt, CreateProject201 as L, SetUserPasswordBody as Lt, CreateFlowBody as M, ListSessionsParams as Mt, CreateFlowBodyPurpose as N, ListUsers200Item as Nt, CreateFlow201StepChallenge as O, IssueChallengeBody as Ot, CreateFlowDefinition201 as P, ListUsersParams as Pt, EndSessionParams as Q, ZlButton as Qt, CreateProjectBody as R, SetUserPasswordParams as Rt, CreateAuthAttemptBody as S, GetUserByID200 as St, CreateFlow201BrandingLayout as T, Introspect200 as Tt, CreateSessionBody as U, UpdateFlowDefinitionBody as Ut, CreateSchemaParams as V, SubmitFlowStepBody as Vt, CreateTeam201 as W, UpdateFlowDefinitionParams as Wt, DeactivateFlowDefinitionParams as X, ZlCard as Xt, CreateUserParams as Y, zlCheckboxManifest as Yt, DeleteFlowDefinitionParams as Z, zlCardManifest as Zt, AuthorizeDevice200 as _, GetSessionParams as _t, ZlPill as a, GetFlowStep200 as at, AuthorizeGetParams as b, GetToken200 as bt, ZlPasskeyErrorDetail as c, GetLiveDefault as ct, ZlPageShell as d, GetOpenIDConfiguration200 as dt, ZlAlert as en, ExchangeHandoffBody as et, zlPageShellManifest as f, GetProject200 as ft, ActivateFlowDefinitionParams as g, GetSession200 as gt, zlFieldManifest as h, GetSchemaByIdParams as ht, zlSelectManifest as i, zlIconManifest as in, GetFlowDefinitionParams as it, CreateFlow201StepSsoProvidersItem as j, ListSessions200 as jt, CreateFlow201StepFieldsItem as k, ListFlowDefinitions200 as kt, ZlPasskeyResultDetail as l, GetMySession200 as lt, ZlFieldType as m, GetSchemaById200 as mt, ZlSelectChangeDetail as n, IconName as nn, GetAuthAttempt200 as nt, zlPillManifest as o, GetHealthDefault as ot, ZlField as p, GetReadyDefault as pt, CreateUser201 as q, ZlCheckbox as qt, ZlSelectOption as r, ZlIcon as rn, GetFlowDefinition200 as rt, ZlPasskey as s, GetKeys200 as st, ZlSelect as t, zlAlertManifest as tn, ExchangeHandoffParams as tt, zlPasskeyManifest as u, GetMyUser200 as ut, AuthorizeDeviceParams as v, GetTeam200 as vt, CreateFlow201Branding as w, GetUserInfo200 as wt, CreateAuthAttempt201 as x, GetTokenBody as xt, AuthorizeGetDefault as y, GetTeamParams as yt, CreateSchema201 as z, SubmitFlowEventBody as zt };
+//# sourceMappingURL=index-D4LkdeFl.d.mts.map