@zitadel/components 0.1.0-alpha.4 → 0.1.0-alpha.8

package/dist/{index-DQryonsO.d.mts → index-DVDCrfkv.d.mts}

@@ -250,7 +250,7 @@ declare global {
   }
 } //# sourceMappingURL=zl-card.d.ts.map
 //#endregion
-//#region ../api/dist/index-DyBulyp9.d.mts
+//#region ../api/dist/index-BGnjxx-b.d.mts
 //#region src/generated/model/authorizeDevice200.d.ts
 /**
  * Generated by orval v8.10.0 🍺
@@ -796,7 +796,7 @@ type CreateFlow201Branding = {
   font_url?: string; /** Hero/background image URL (used by split layout). */
   hero_url?: string;
 }; //#endregion
-//#region src/generated/model/createFlow201StepActions.d.ts
+//#region src/generated/model/createFlow201StepActionsItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -805,24 +805,23 @@ type CreateFlow201Branding = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Unordered dictionary of available user actions. Keyed by action name.
-The LiquidJS template controls positioning and presentation.
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
 
  */
-type CreateFlow201StepActions = {
-  [key: string]: {
-    /** Marks this as the default/primary action. The runtime template uses
-    this hint to choose visual emphasis. At most one action per step
-    should be primary; this is not enforced here.
-    */
-    primary?: boolean;
-    /** Optional localization key override for the action's label. When
-    omitted, the engine derives a key from the step and action names.
-    Display text is resolved client-side from a locale dictionary, never
-    by the engine.
-    */
-    text_key?: string;
-  };
+type CreateFlow201StepActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+  text_key?: string;
 }; //#endregion
 //#region src/generated/model/createFlow201StepChallengeMethod.d.ts
 /**
@@ -900,7 +899,7 @@ declare const CreateFlow201StepComplete: {
   readonly redirect: "redirect";
   readonly show: "show";
 }; //#endregion
-//#region src/generated/model/createFlow201StepFieldsType.d.ts
+//#region src/generated/model/createFlow201StepFieldsItemType.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -909,14 +908,15 @@ declare const CreateFlow201StepComplete: {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * The input kind the client should render. Encodes the formats that
-have a matching HTML input type (email, url, date). For other
-formats (e.g. uuid) the type is `text` and `validation.format`
-carries the rule.
+ * The input kind the client should render. Encodes the formats and
+JSON types that map to a familiar HTML input: `email`, `url`,
+`date` come from `format`; `checkbox` from JSON `type: boolean`;
+`select` from a closed `enum`. For other formats (e.g. uuid) the
+type is `text` and `validation.format` carries the rule.
 
  */
-type CreateFlow201StepFieldsType = (typeof CreateFlow201StepFieldsType)[keyof typeof CreateFlow201StepFieldsType];
-declare const CreateFlow201StepFieldsType: {
+type CreateFlow201StepFieldsItemType = (typeof CreateFlow201StepFieldsItemType)[keyof typeof CreateFlow201StepFieldsItemType];
+declare const CreateFlow201StepFieldsItemType: {
   readonly text: "text";
   readonly email: "email";
   readonly password: "password";
@@ -925,8 +925,10 @@ declare const CreateFlow201StepFieldsType: {
   readonly url: "url";
   readonly date: "date";
   readonly hidden: "hidden";
+  readonly checkbox: "checkbox";
+  readonly select: "select";
 }; //#endregion
-//#region src/generated/model/createFlow201StepFieldsValidationFormat.d.ts
+//#region src/generated/model/createFlow201StepFieldsItemValidationFormat.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -942,14 +944,14 @@ sufficient for client-side validation. When `type` is `text`
 (e.g. `format: uuid`), this key is the only signal.
 
  */
-type CreateFlow201StepFieldsValidationFormat = (typeof CreateFlow201StepFieldsValidationFormat)[keyof typeof CreateFlow201StepFieldsValidationFormat];
-declare const CreateFlow201StepFieldsValidationFormat: {
+type CreateFlow201StepFieldsItemValidationFormat = (typeof CreateFlow201StepFieldsItemValidationFormat)[keyof typeof CreateFlow201StepFieldsItemValidationFormat];
+declare const CreateFlow201StepFieldsItemValidationFormat: {
   readonly email: "email";
   readonly "date-time": "date-time";
   readonly uuid: "uuid";
   readonly uri: "uri";
 }; //#endregion
-//#region src/generated/model/createFlow201StepFieldsValidation.d.ts
+//#region src/generated/model/createFlow201StepFieldsItemValidation.d.ts
 /**
  * Schema-derived rules the frontend SHOULD apply at input time. The
 server runs the same rules on submit and is the only authority on
@@ -961,14 +963,14 @@ Each key mirrors a JSON Schema keyword on the underlying user
 property; absent keys mean no rule.
 
  */
-type CreateFlow201StepFieldsValidation = {
+type CreateFlow201StepFieldsItemValidation = {
   /** Semantic format the value must match. Values mirror the user
   meta-schema. When `type` already encodes the format (email,
   url, date), this key is informative and the input type is
   sufficient for client-side validation. When `type` is `text`
   (e.g. `format: uuid`), this key is the only signal.
    */
-  format?: CreateFlow201StepFieldsValidationFormat;
+  format?: CreateFlow201StepFieldsItemValidationFormat;
   /**
    * Minimum length in characters (inclusive). Mirrors `minLength`.
    * @minimum 0
@@ -979,39 +981,46 @@ type CreateFlow201StepFieldsValidation = {
    * @minimum 0
    */
   max_length?: number;
+  /** Closed list of allowed values. Mirrors the JSON Schema `enum`
+  keyword on the underlying user property. When `type` is
+  `select` the client renders these as options; for other types
+  the rule still applies as a membership check.
+   */
+  enum?: string[];
 }; //#endregion
-//#region src/generated/model/createFlow201StepFields.d.ts
+//#region src/generated/model/createFlow201StepFieldsItem.d.ts
 /**
- * Unordered dictionary of input fields to collect. Keyed by field name.
-The LiquidJS template controls which fields appear and in what order.
-Field metadata (type, validation) is resolved by the engine from the
-flow's user schema.
+ * A data input capability. Describes what the user must provide.
+Does not contain display text — only a `text_key` resolved client-side.
 
  */
-type CreateFlow201StepFields = {
-  [key: string]: {
-    /** The input kind the client should render. Encodes the formats that
-    have a matching HTML input type (email, url, date). For other
-    formats (e.g. uuid) the type is `text` and `validation.format`
-    carries the rule.
-    */
-    type: CreateFlow201StepFieldsType; /** Localization key for the field label. */
-    text_key: string;
-    /** The field MUST be present and non-empty on submit. Mirrors the
-    schema's top-level `required` array.
-    */
-    required?: boolean; /** Pre-filled value (e.g., an identifier carried over from a pivot). */
-    value?: unknown;
-    /** Schema-derived rules the frontend SHOULD apply at input time. The
-    server runs the same rules on submit and is the only authority on
-    whether the step advances — these rules are a UX hint to reduce
-    round trips, not a contract guarantee.
-       Omitted entirely when the field has no rules beyond its `type`.
-    Each key mirrors a JSON Schema keyword on the underlying user
-    property; absent keys mean no rule.
-    */
-    validation?: CreateFlow201StepFieldsValidation;
-  };
+type CreateFlow201StepFieldsItem = {
+  /** Field name, matching a property in the flow's user schema. Carries
+  the submitted value back to the engine.
+   */
+  name: string;
+  /** The input kind the client should render. Encodes the formats and
+  JSON types that map to a familiar HTML input: `email`, `url`,
+  `date` come from `format`; `checkbox` from JSON `type: boolean`;
+  `select` from a closed `enum`. For other formats (e.g. uuid) the
+  type is `text` and `validation.format` carries the rule.
+   */
+  type: CreateFlow201StepFieldsItemType; /** Localization key for the field label. */
+  text_key: string;
+  /** The field MUST be present and non-empty on submit. Mirrors the
+  schema's top-level `required` array.
+   */
+  required?: boolean; /** Pre-filled value (e.g., an identifier carried over from a pivot). */
+  value?: unknown;
+  /** Schema-derived rules the frontend SHOULD apply at input time. The
+  server runs the same rules on submit and is the only authority on
+  whether the step advances — these rules are a UX hint to reduce
+  round trips, not a contract guarantee.
+     Omitted entirely when the field has no rules beyond its `type`.
+  Each key mirrors a JSON Schema keyword on the underlying user
+  property; absent keys mean no rule.
+   */
+  validation?: CreateFlow201StepFieldsItemValidation;
 }; //#endregion
 //#region src/generated/model/createFlow201StepGatesConfig.d.ts
 /**
@@ -1107,9 +1116,10 @@ type CreateFlow201StepTexts = {
 }; //#endregion
 //#region src/generated/model/createFlow201Step.d.ts
 /**
- * A step contains unordered capability dictionaries: what to collect (fields),
+ * A step contains ordered capability arrays: what to collect (fields),
 what the user can do (actions), and what security gates must be satisfied (gates).
-Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+and builds name-keyed indexes locally for lookup.
 
  */
 type CreateFlow201Step = {
@@ -1125,16 +1135,16 @@ type CreateFlow201Step = {
    */
   complete?: CreateFlow201StepComplete; /** URL to navigate to (e.g., SSO provider redirect). */
   redirect_url?: string;
-  /** Unordered dictionary of input fields to collect. Keyed by field name.
-  The LiquidJS template controls which fields appear and in what order.
-  Field metadata (type, validation) is resolved by the engine from the
-  flow's user schema.
+  /** Ordered list of input fields to collect. Field metadata (type, validation)
+  is resolved by the engine from the flow's user schema. The LiquidJS
+  template iterates this array; for keyed lookup it builds a name-indexed
+  map locally.
    */
-  fields: CreateFlow201StepFields;
-  /** Unordered dictionary of available user actions. Keyed by action name.
-  The LiquidJS template controls positioning and presentation.
+  fields: CreateFlow201StepFieldsItem[];
+  /** Ordered list of available user actions. The LiquidJS template iterates
+  this array and builds a name-indexed map locally for keyed lookup.
    */
-  actions: CreateFlow201StepActions;
+  actions: CreateFlow201StepActionsItem[];
   /** Security gates that must be satisfied before the step can be submitted.
   The engine injects gates dynamically based on policy, even if they
   are not declared in the flow definition.
@@ -1159,9 +1169,10 @@ type CreateFlow201 = {
   id: string; /** Underlying session ID. Stable across all stacked flows. */
   session_id: string; /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */
   session_token?: string;
-  /** A step contains unordered capability dictionaries: what to collect (fields),
+  /** A step contains ordered capability arrays: what to collect (fields),
   what the user can do (actions), and what security gates must be satisfied (gates).
-  Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+  The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+  and builds name-keyed indexes locally for lookup.
    */
   step: CreateFlow201Step;
   /** Resolved branding configuration. Inherited from the app → team → project
@@ -1284,7 +1295,7 @@ type CreateFlowDefinition201FlowDefinitionAudience = {
   /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
   app_ids?: string[];
 }; //#endregion
-//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemActions.d.ts
+//#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemActionsItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1293,25 +1304,23 @@ type CreateFlowDefinition201FlowDefinitionAudience = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Actions the user can take. Keyed by action name.
-The action name is what the frontend sends back in the submit request.
-If omitted, the engine provides a default `submit` action.
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
 
  */
-type CreateFlowDefinition201FlowDefinitionStepsItemActions = {
-  [key: string]: {
-    /** Marks this as the default/primary action. The runtime template uses
-    this hint to choose visual emphasis. At most one action per step
-    should be primary; this is not enforced here.
-    */
-    primary?: boolean;
-    /** Optional localization key override for the action's label. When
-    omitted, the engine derives a key from the step and action names.
-    Display text is resolved client-side from a locale dictionary, never
-    by the engine.
-    */
-    text_key?: string;
-  };
+type CreateFlowDefinition201FlowDefinitionStepsItemActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+  text_key?: string;
 }; //#endregion
 //#region src/generated/model/createFlowDefinition201FlowDefinitionStepsItemComplete.d.ts
 /**
@@ -1438,7 +1447,7 @@ type CreateFlowDefinition201FlowDefinitionStepsItemSsoProvidersItem = {
 /**
  * Maps action/outcome names to their transition descriptor.
 
-Keys match action names from the `actions` dict. Additional keys
+Keys match action names from the `actions` array. Additional keys
 come from implicit outcomes based on schema annotations
 (e.g. `user_not_found` from `x-unique` fields) and engine
 events (e.g. `sso`, `callback`).
@@ -1487,11 +1496,11 @@ type CreateFlowDefinition201FlowDefinitionStepsItem = {
   transition outcome).
    */
   fields?: string[];
-  /** Actions the user can take. Keyed by action name.
-  The action name is what the frontend sends back in the submit request.
-  If omitted, the engine provides a default `submit` action.
+  /** Ordered list of actions the user can take. The action name is what the
+  frontend sends back in the submit request. If omitted, the engine
+  provides a default `submit` action.
    */
-  actions?: CreateFlowDefinition201FlowDefinitionStepsItemActions;
+  actions?: CreateFlowDefinition201FlowDefinitionStepsItemActionsItem[];
   /** Security gates that must be satisfied before submission. Keyed by gate
   name. Each gate selects a kind (e.g. "captcha") and provider-specific
   configuration. The engine may also inject gates dynamically based on
@@ -1510,7 +1519,7 @@ type CreateFlowDefinition201FlowDefinitionStepsItem = {
    */
   complete?: CreateFlowDefinition201FlowDefinitionStepsItemComplete;
   /** Maps action/outcome names to their transition descriptor.
-     Keys match action names from the `actions` dict. Additional keys
+     Keys match action names from the `actions` array. Additional keys
   come from implicit outcomes based on schema annotations
   (e.g. `user_not_found` from `x-unique` fields) and engine
   events (e.g. `sso`, `callback`).
@@ -1610,7 +1619,7 @@ type CreateFlowDefinitionBodyFlowDefinitionAudience = {
   /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
   app_ids?: string[];
 }; //#endregion
-//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemActions.d.ts
+//#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemActionsItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -1619,25 +1628,23 @@ type CreateFlowDefinitionBodyFlowDefinitionAudience = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Actions the user can take. Keyed by action name.
-The action name is what the frontend sends back in the submit request.
-If omitted, the engine provides a default `submit` action.
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
 
  */
-type CreateFlowDefinitionBodyFlowDefinitionStepsItemActions = {
-  [key: string]: {
-    /** Marks this as the default/primary action. The runtime template uses
-    this hint to choose visual emphasis. At most one action per step
-    should be primary; this is not enforced here.
-    */
-    primary?: boolean;
-    /** Optional localization key override for the action's label. When
-    omitted, the engine derives a key from the step and action names.
-    Display text is resolved client-side from a locale dictionary, never
-    by the engine.
-    */
-    text_key?: string;
-  };
+type CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+  text_key?: string;
 }; //#endregion
 //#region src/generated/model/createFlowDefinitionBodyFlowDefinitionStepsItemComplete.d.ts
 /**
@@ -1764,7 +1771,7 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersItem = {
 /**
  * Maps action/outcome names to their transition descriptor.
 
-Keys match action names from the `actions` dict. Additional keys
+Keys match action names from the `actions` array. Additional keys
 come from implicit outcomes based on schema annotations
 (e.g. `user_not_found` from `x-unique` fields) and engine
 events (e.g. `sso`, `callback`).
@@ -1813,11 +1820,11 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItem = {
   transition outcome).
    */
   fields?: string[];
-  /** Actions the user can take. Keyed by action name.
-  The action name is what the frontend sends back in the submit request.
-  If omitted, the engine provides a default `submit` action.
+  /** Ordered list of actions the user can take. The action name is what the
+  frontend sends back in the submit request. If omitted, the engine
+  provides a default `submit` action.
    */
-  actions?: CreateFlowDefinitionBodyFlowDefinitionStepsItemActions;
+  actions?: CreateFlowDefinitionBodyFlowDefinitionStepsItemActionsItem[];
   /** Security gates that must be satisfied before submission. Keyed by gate
   name. Each gate selects a kind (e.g. "captcha") and provider-specific
   configuration. The engine may also inject gates dynamically based on
@@ -1836,7 +1843,7 @@ type CreateFlowDefinitionBodyFlowDefinitionStepsItem = {
    */
   complete?: CreateFlowDefinitionBodyFlowDefinitionStepsItemComplete;
   /** Maps action/outcome names to their transition descriptor.
-     Keys match action names from the `actions` dict. Additional keys
+     Keys match action names from the `actions` array. Additional keys
   come from implicit outcomes based on schema annotations
   (e.g. `user_not_found` from `x-unique` fields) and engine
   events (e.g. `sso`, `callback`).
@@ -3126,7 +3133,7 @@ type GetFlowDefinition200FlowDefinitionAudience = {
   /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
   app_ids?: string[];
 }; //#endregion
-//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemActions.d.ts
+//#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemActionsItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3135,25 +3142,23 @@ type GetFlowDefinition200FlowDefinitionAudience = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Actions the user can take. Keyed by action name.
-The action name is what the frontend sends back in the submit request.
-If omitted, the engine provides a default `submit` action.
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
 
  */
-type GetFlowDefinition200FlowDefinitionStepsItemActions = {
-  [key: string]: {
-    /** Marks this as the default/primary action. The runtime template uses
-    this hint to choose visual emphasis. At most one action per step
-    should be primary; this is not enforced here.
-    */
-    primary?: boolean;
-    /** Optional localization key override for the action's label. When
-    omitted, the engine derives a key from the step and action names.
-    Display text is resolved client-side from a locale dictionary, never
-    by the engine.
-    */
-    text_key?: string;
-  };
+type GetFlowDefinition200FlowDefinitionStepsItemActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+  text_key?: string;
 }; //#endregion
 //#region src/generated/model/getFlowDefinition200FlowDefinitionStepsItemComplete.d.ts
 /**
@@ -3280,7 +3285,7 @@ type GetFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem = {
 /**
  * Maps action/outcome names to their transition descriptor.
 
-Keys match action names from the `actions` dict. Additional keys
+Keys match action names from the `actions` array. Additional keys
 come from implicit outcomes based on schema annotations
 (e.g. `user_not_found` from `x-unique` fields) and engine
 events (e.g. `sso`, `callback`).
@@ -3329,11 +3334,11 @@ type GetFlowDefinition200FlowDefinitionStepsItem = {
   transition outcome).
    */
   fields?: string[];
-  /** Actions the user can take. Keyed by action name.
-  The action name is what the frontend sends back in the submit request.
-  If omitted, the engine provides a default `submit` action.
+  /** Ordered list of actions the user can take. The action name is what the
+  frontend sends back in the submit request. If omitted, the engine
+  provides a default `submit` action.
    */
-  actions?: GetFlowDefinition200FlowDefinitionStepsItemActions;
+  actions?: GetFlowDefinition200FlowDefinitionStepsItemActionsItem[];
   /** Security gates that must be satisfied before submission. Keyed by gate
   name. Each gate selects a kind (e.g. "captcha") and provider-specific
   configuration. The engine may also inject gates dynamically based on
@@ -3352,7 +3357,7 @@ type GetFlowDefinition200FlowDefinitionStepsItem = {
    */
   complete?: GetFlowDefinition200FlowDefinitionStepsItemComplete;
   /** Maps action/outcome names to their transition descriptor.
-     Keys match action names from the `actions` dict. Additional keys
+     Keys match action names from the `actions` array. Additional keys
   come from implicit outcomes based on schema annotations
   (e.g. `user_not_found` from `x-unique` fields) and engine
   events (e.g. `sso`, `callback`).
@@ -3489,7 +3494,7 @@ type GetFlowStep200Branding = {
   font_url?: string; /** Hero/background image URL (used by split layout). */
   hero_url?: string;
 }; //#endregion
-//#region src/generated/model/getFlowStep200StepActions.d.ts
+//#region src/generated/model/getFlowStep200StepActionsItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3498,24 +3503,23 @@ type GetFlowStep200Branding = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Unordered dictionary of available user actions. Keyed by action name.
-The LiquidJS template controls positioning and presentation.
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
 
  */
-type GetFlowStep200StepActions = {
-  [key: string]: {
-    /** Marks this as the default/primary action. The runtime template uses
-    this hint to choose visual emphasis. At most one action per step
-    should be primary; this is not enforced here.
-    */
-    primary?: boolean;
-    /** Optional localization key override for the action's label. When
-    omitted, the engine derives a key from the step and action names.
-    Display text is resolved client-side from a locale dictionary, never
-    by the engine.
-    */
-    text_key?: string;
-  };
+type GetFlowStep200StepActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+  text_key?: string;
 }; //#endregion
 //#region src/generated/model/getFlowStep200StepChallengeMethod.d.ts
 /**
@@ -3593,7 +3597,7 @@ declare const GetFlowStep200StepComplete: {
   readonly redirect: "redirect";
   readonly show: "show";
 }; //#endregion
-//#region src/generated/model/getFlowStep200StepFieldsType.d.ts
+//#region src/generated/model/getFlowStep200StepFieldsItemType.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3602,14 +3606,15 @@ declare const GetFlowStep200StepComplete: {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * The input kind the client should render. Encodes the formats that
-have a matching HTML input type (email, url, date). For other
-formats (e.g. uuid) the type is `text` and `validation.format`
-carries the rule.
+ * The input kind the client should render. Encodes the formats and
+JSON types that map to a familiar HTML input: `email`, `url`,
+`date` come from `format`; `checkbox` from JSON `type: boolean`;
+`select` from a closed `enum`. For other formats (e.g. uuid) the
+type is `text` and `validation.format` carries the rule.
 
  */
-type GetFlowStep200StepFieldsType = (typeof GetFlowStep200StepFieldsType)[keyof typeof GetFlowStep200StepFieldsType];
-declare const GetFlowStep200StepFieldsType: {
+type GetFlowStep200StepFieldsItemType = (typeof GetFlowStep200StepFieldsItemType)[keyof typeof GetFlowStep200StepFieldsItemType];
+declare const GetFlowStep200StepFieldsItemType: {
   readonly text: "text";
   readonly email: "email";
   readonly password: "password";
@@ -3618,8 +3623,10 @@ declare const GetFlowStep200StepFieldsType: {
   readonly url: "url";
   readonly date: "date";
   readonly hidden: "hidden";
+  readonly checkbox: "checkbox";
+  readonly select: "select";
 }; //#endregion
-//#region src/generated/model/getFlowStep200StepFieldsValidationFormat.d.ts
+//#region src/generated/model/getFlowStep200StepFieldsItemValidationFormat.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -3635,14 +3642,14 @@ sufficient for client-side validation. When `type` is `text`
 (e.g. `format: uuid`), this key is the only signal.
 
  */
-type GetFlowStep200StepFieldsValidationFormat = (typeof GetFlowStep200StepFieldsValidationFormat)[keyof typeof GetFlowStep200StepFieldsValidationFormat];
-declare const GetFlowStep200StepFieldsValidationFormat: {
+type GetFlowStep200StepFieldsItemValidationFormat = (typeof GetFlowStep200StepFieldsItemValidationFormat)[keyof typeof GetFlowStep200StepFieldsItemValidationFormat];
+declare const GetFlowStep200StepFieldsItemValidationFormat: {
   readonly email: "email";
   readonly "date-time": "date-time";
   readonly uuid: "uuid";
   readonly uri: "uri";
 }; //#endregion
-//#region src/generated/model/getFlowStep200StepFieldsValidation.d.ts
+//#region src/generated/model/getFlowStep200StepFieldsItemValidation.d.ts
 /**
  * Schema-derived rules the frontend SHOULD apply at input time. The
 server runs the same rules on submit and is the only authority on
@@ -3654,14 +3661,14 @@ Each key mirrors a JSON Schema keyword on the underlying user
 property; absent keys mean no rule.
 
  */
-type GetFlowStep200StepFieldsValidation = {
+type GetFlowStep200StepFieldsItemValidation = {
   /** Semantic format the value must match. Values mirror the user
   meta-schema. When `type` already encodes the format (email,
   url, date), this key is informative and the input type is
   sufficient for client-side validation. When `type` is `text`
   (e.g. `format: uuid`), this key is the only signal.
    */
-  format?: GetFlowStep200StepFieldsValidationFormat;
+  format?: GetFlowStep200StepFieldsItemValidationFormat;
   /**
    * Minimum length in characters (inclusive). Mirrors `minLength`.
    * @minimum 0
@@ -3672,39 +3679,46 @@ type GetFlowStep200StepFieldsValidation = {
    * @minimum 0
    */
   max_length?: number;
+  /** Closed list of allowed values. Mirrors the JSON Schema `enum`
+  keyword on the underlying user property. When `type` is
+  `select` the client renders these as options; for other types
+  the rule still applies as a membership check.
+   */
+  enum?: string[];
 }; //#endregion
-//#region src/generated/model/getFlowStep200StepFields.d.ts
+//#region src/generated/model/getFlowStep200StepFieldsItem.d.ts
 /**
- * Unordered dictionary of input fields to collect. Keyed by field name.
-The LiquidJS template controls which fields appear and in what order.
-Field metadata (type, validation) is resolved by the engine from the
-flow's user schema.
+ * A data input capability. Describes what the user must provide.
+Does not contain display text — only a `text_key` resolved client-side.
 
  */
-type GetFlowStep200StepFields = {
-  [key: string]: {
-    /** The input kind the client should render. Encodes the formats that
-    have a matching HTML input type (email, url, date). For other
-    formats (e.g. uuid) the type is `text` and `validation.format`
-    carries the rule.
-    */
-    type: GetFlowStep200StepFieldsType; /** Localization key for the field label. */
-    text_key: string;
-    /** The field MUST be present and non-empty on submit. Mirrors the
-    schema's top-level `required` array.
-    */
-    required?: boolean; /** Pre-filled value (e.g., an identifier carried over from a pivot). */
-    value?: unknown;
-    /** Schema-derived rules the frontend SHOULD apply at input time. The
-    server runs the same rules on submit and is the only authority on
-    whether the step advances — these rules are a UX hint to reduce
-    round trips, not a contract guarantee.
-       Omitted entirely when the field has no rules beyond its `type`.
-    Each key mirrors a JSON Schema keyword on the underlying user
-    property; absent keys mean no rule.
-    */
-    validation?: GetFlowStep200StepFieldsValidation;
-  };
+type GetFlowStep200StepFieldsItem = {
+  /** Field name, matching a property in the flow's user schema. Carries
+  the submitted value back to the engine.
+   */
+  name: string;
+  /** The input kind the client should render. Encodes the formats and
+  JSON types that map to a familiar HTML input: `email`, `url`,
+  `date` come from `format`; `checkbox` from JSON `type: boolean`;
+  `select` from a closed `enum`. For other formats (e.g. uuid) the
+  type is `text` and `validation.format` carries the rule.
+   */
+  type: GetFlowStep200StepFieldsItemType; /** Localization key for the field label. */
+  text_key: string;
+  /** The field MUST be present and non-empty on submit. Mirrors the
+  schema's top-level `required` array.
+   */
+  required?: boolean; /** Pre-filled value (e.g., an identifier carried over from a pivot). */
+  value?: unknown;
+  /** Schema-derived rules the frontend SHOULD apply at input time. The
+  server runs the same rules on submit and is the only authority on
+  whether the step advances — these rules are a UX hint to reduce
+  round trips, not a contract guarantee.
+     Omitted entirely when the field has no rules beyond its `type`.
+  Each key mirrors a JSON Schema keyword on the underlying user
+  property; absent keys mean no rule.
+   */
+  validation?: GetFlowStep200StepFieldsItemValidation;
 }; //#endregion
 //#region src/generated/model/getFlowStep200StepGatesConfig.d.ts
 /**
@@ -3800,9 +3814,10 @@ type GetFlowStep200StepTexts = {
 }; //#endregion
 //#region src/generated/model/getFlowStep200Step.d.ts
 /**
- * A step contains unordered capability dictionaries: what to collect (fields),
+ * A step contains ordered capability arrays: what to collect (fields),
 what the user can do (actions), and what security gates must be satisfied (gates).
-Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+and builds name-keyed indexes locally for lookup.
 
  */
 type GetFlowStep200Step = {
@@ -3818,16 +3833,16 @@ type GetFlowStep200Step = {
    */
   complete?: GetFlowStep200StepComplete; /** URL to navigate to (e.g., SSO provider redirect). */
   redirect_url?: string;
-  /** Unordered dictionary of input fields to collect. Keyed by field name.
-  The LiquidJS template controls which fields appear and in what order.
-  Field metadata (type, validation) is resolved by the engine from the
-  flow's user schema.
+  /** Ordered list of input fields to collect. Field metadata (type, validation)
+  is resolved by the engine from the flow's user schema. The LiquidJS
+  template iterates this array; for keyed lookup it builds a name-indexed
+  map locally.
    */
-  fields: GetFlowStep200StepFields;
-  /** Unordered dictionary of available user actions. Keyed by action name.
-  The LiquidJS template controls positioning and presentation.
+  fields: GetFlowStep200StepFieldsItem[];
+  /** Ordered list of available user actions. The LiquidJS template iterates
+  this array and builds a name-indexed map locally for keyed lookup.
    */
-  actions: GetFlowStep200StepActions;
+  actions: GetFlowStep200StepActionsItem[];
   /** Security gates that must be satisfied before the step can be submitted.
   The engine injects gates dynamically based on policy, even if they
   are not declared in the flow definition.
@@ -3852,9 +3867,10 @@ type GetFlowStep200 = {
   id: string; /** Underlying session ID. Stable across all stacked flows. */
   session_id: string; /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */
   session_token?: string;
-  /** A step contains unordered capability dictionaries: what to collect (fields),
+  /** A step contains ordered capability arrays: what to collect (fields),
   what the user can do (actions), and what security gates must be satisfied (gates).
-  Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+  The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+  and builds name-keyed indexes locally for lookup.
    */
   step: GetFlowStep200Step;
   /** Resolved branding configuration. Inherited from the app → team → project
@@ -5633,7 +5649,7 @@ type SubmitFlowStep200Branding = {
   font_url?: string; /** Hero/background image URL (used by split layout). */
   hero_url?: string;
 }; //#endregion
-//#region src/generated/model/submitFlowStep200StepActions.d.ts
+//#region src/generated/model/submitFlowStep200StepActionsItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5642,24 +5658,23 @@ type SubmitFlowStep200Branding = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Unordered dictionary of available user actions. Keyed by action name.
-The LiquidJS template controls positioning and presentation.
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
 
  */
-type SubmitFlowStep200StepActions = {
-  [key: string]: {
-    /** Marks this as the default/primary action. The runtime template uses
-    this hint to choose visual emphasis. At most one action per step
-    should be primary; this is not enforced here.
-    */
-    primary?: boolean;
-    /** Optional localization key override for the action's label. When
-    omitted, the engine derives a key from the step and action names.
-    Display text is resolved client-side from a locale dictionary, never
-    by the engine.
-    */
-    text_key?: string;
-  };
+type SubmitFlowStep200StepActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+  text_key?: string;
 }; //#endregion
 //#region src/generated/model/submitFlowStep200StepChallengeMethod.d.ts
 /**
@@ -5737,7 +5752,7 @@ declare const SubmitFlowStep200StepComplete: {
   readonly redirect: "redirect";
   readonly show: "show";
 }; //#endregion
-//#region src/generated/model/submitFlowStep200StepFieldsType.d.ts
+//#region src/generated/model/submitFlowStep200StepFieldsItemType.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5746,14 +5761,15 @@ declare const SubmitFlowStep200StepComplete: {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * The input kind the client should render. Encodes the formats that
-have a matching HTML input type (email, url, date). For other
-formats (e.g. uuid) the type is `text` and `validation.format`
-carries the rule.
+ * The input kind the client should render. Encodes the formats and
+JSON types that map to a familiar HTML input: `email`, `url`,
+`date` come from `format`; `checkbox` from JSON `type: boolean`;
+`select` from a closed `enum`. For other formats (e.g. uuid) the
+type is `text` and `validation.format` carries the rule.
 
  */
-type SubmitFlowStep200StepFieldsType = (typeof SubmitFlowStep200StepFieldsType)[keyof typeof SubmitFlowStep200StepFieldsType];
-declare const SubmitFlowStep200StepFieldsType: {
+type SubmitFlowStep200StepFieldsItemType = (typeof SubmitFlowStep200StepFieldsItemType)[keyof typeof SubmitFlowStep200StepFieldsItemType];
+declare const SubmitFlowStep200StepFieldsItemType: {
   readonly text: "text";
   readonly email: "email";
   readonly password: "password";
@@ -5762,8 +5778,10 @@ declare const SubmitFlowStep200StepFieldsType: {
   readonly url: "url";
   readonly date: "date";
   readonly hidden: "hidden";
+  readonly checkbox: "checkbox";
+  readonly select: "select";
 }; //#endregion
-//#region src/generated/model/submitFlowStep200StepFieldsValidationFormat.d.ts
+//#region src/generated/model/submitFlowStep200StepFieldsItemValidationFormat.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -5779,14 +5797,14 @@ sufficient for client-side validation. When `type` is `text`
 (e.g. `format: uuid`), this key is the only signal.
 
  */
-type SubmitFlowStep200StepFieldsValidationFormat = (typeof SubmitFlowStep200StepFieldsValidationFormat)[keyof typeof SubmitFlowStep200StepFieldsValidationFormat];
-declare const SubmitFlowStep200StepFieldsValidationFormat: {
+type SubmitFlowStep200StepFieldsItemValidationFormat = (typeof SubmitFlowStep200StepFieldsItemValidationFormat)[keyof typeof SubmitFlowStep200StepFieldsItemValidationFormat];
+declare const SubmitFlowStep200StepFieldsItemValidationFormat: {
   readonly email: "email";
   readonly "date-time": "date-time";
   readonly uuid: "uuid";
   readonly uri: "uri";
 }; //#endregion
-//#region src/generated/model/submitFlowStep200StepFieldsValidation.d.ts
+//#region src/generated/model/submitFlowStep200StepFieldsItemValidation.d.ts
 /**
  * Schema-derived rules the frontend SHOULD apply at input time. The
 server runs the same rules on submit and is the only authority on
@@ -5798,14 +5816,14 @@ Each key mirrors a JSON Schema keyword on the underlying user
 property; absent keys mean no rule.
 
  */
-type SubmitFlowStep200StepFieldsValidation = {
+type SubmitFlowStep200StepFieldsItemValidation = {
   /** Semantic format the value must match. Values mirror the user
   meta-schema. When `type` already encodes the format (email,
   url, date), this key is informative and the input type is
   sufficient for client-side validation. When `type` is `text`
   (e.g. `format: uuid`), this key is the only signal.
    */
-  format?: SubmitFlowStep200StepFieldsValidationFormat;
+  format?: SubmitFlowStep200StepFieldsItemValidationFormat;
   /**
    * Minimum length in characters (inclusive). Mirrors `minLength`.
    * @minimum 0
@@ -5816,39 +5834,46 @@ type SubmitFlowStep200StepFieldsValidation = {
    * @minimum 0
    */
   max_length?: number;
+  /** Closed list of allowed values. Mirrors the JSON Schema `enum`
+  keyword on the underlying user property. When `type` is
+  `select` the client renders these as options; for other types
+  the rule still applies as a membership check.
+   */
+  enum?: string[];
 }; //#endregion
-//#region src/generated/model/submitFlowStep200StepFields.d.ts
+//#region src/generated/model/submitFlowStep200StepFieldsItem.d.ts
 /**
- * Unordered dictionary of input fields to collect. Keyed by field name.
-The LiquidJS template controls which fields appear and in what order.
-Field metadata (type, validation) is resolved by the engine from the
-flow's user schema.
+ * A data input capability. Describes what the user must provide.
+Does not contain display text — only a `text_key` resolved client-side.
 
  */
-type SubmitFlowStep200StepFields = {
-  [key: string]: {
-    /** The input kind the client should render. Encodes the formats that
-    have a matching HTML input type (email, url, date). For other
-    formats (e.g. uuid) the type is `text` and `validation.format`
-    carries the rule.
-    */
-    type: SubmitFlowStep200StepFieldsType; /** Localization key for the field label. */
-    text_key: string;
-    /** The field MUST be present and non-empty on submit. Mirrors the
-    schema's top-level `required` array.
-    */
-    required?: boolean; /** Pre-filled value (e.g., an identifier carried over from a pivot). */
-    value?: unknown;
-    /** Schema-derived rules the frontend SHOULD apply at input time. The
-    server runs the same rules on submit and is the only authority on
-    whether the step advances — these rules are a UX hint to reduce
-    round trips, not a contract guarantee.
-       Omitted entirely when the field has no rules beyond its `type`.
-    Each key mirrors a JSON Schema keyword on the underlying user
-    property; absent keys mean no rule.
-    */
-    validation?: SubmitFlowStep200StepFieldsValidation;
-  };
+type SubmitFlowStep200StepFieldsItem = {
+  /** Field name, matching a property in the flow's user schema. Carries
+  the submitted value back to the engine.
+   */
+  name: string;
+  /** The input kind the client should render. Encodes the formats and
+  JSON types that map to a familiar HTML input: `email`, `url`,
+  `date` come from `format`; `checkbox` from JSON `type: boolean`;
+  `select` from a closed `enum`. For other formats (e.g. uuid) the
+  type is `text` and `validation.format` carries the rule.
+   */
+  type: SubmitFlowStep200StepFieldsItemType; /** Localization key for the field label. */
+  text_key: string;
+  /** The field MUST be present and non-empty on submit. Mirrors the
+  schema's top-level `required` array.
+   */
+  required?: boolean; /** Pre-filled value (e.g., an identifier carried over from a pivot). */
+  value?: unknown;
+  /** Schema-derived rules the frontend SHOULD apply at input time. The
+  server runs the same rules on submit and is the only authority on
+  whether the step advances — these rules are a UX hint to reduce
+  round trips, not a contract guarantee.
+     Omitted entirely when the field has no rules beyond its `type`.
+  Each key mirrors a JSON Schema keyword on the underlying user
+  property; absent keys mean no rule.
+   */
+  validation?: SubmitFlowStep200StepFieldsItemValidation;
 }; //#endregion
 //#region src/generated/model/submitFlowStep200StepGatesConfig.d.ts
 /**
@@ -5944,9 +5969,10 @@ type SubmitFlowStep200StepTexts = {
 }; //#endregion
 //#region src/generated/model/submitFlowStep200Step.d.ts
 /**
- * A step contains unordered capability dictionaries: what to collect (fields),
+ * A step contains ordered capability arrays: what to collect (fields),
 what the user can do (actions), and what security gates must be satisfied (gates).
-Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+and builds name-keyed indexes locally for lookup.
 
  */
 type SubmitFlowStep200Step = {
@@ -5962,16 +5988,16 @@ type SubmitFlowStep200Step = {
    */
   complete?: SubmitFlowStep200StepComplete; /** URL to navigate to (e.g., SSO provider redirect). */
   redirect_url?: string;
-  /** Unordered dictionary of input fields to collect. Keyed by field name.
-  The LiquidJS template controls which fields appear and in what order.
-  Field metadata (type, validation) is resolved by the engine from the
-  flow's user schema.
+  /** Ordered list of input fields to collect. Field metadata (type, validation)
+  is resolved by the engine from the flow's user schema. The LiquidJS
+  template iterates this array; for keyed lookup it builds a name-indexed
+  map locally.
    */
-  fields: SubmitFlowStep200StepFields;
-  /** Unordered dictionary of available user actions. Keyed by action name.
-  The LiquidJS template controls positioning and presentation.
+  fields: SubmitFlowStep200StepFieldsItem[];
+  /** Ordered list of available user actions. The LiquidJS template iterates
+  this array and builds a name-indexed map locally for keyed lookup.
    */
-  actions: SubmitFlowStep200StepActions;
+  actions: SubmitFlowStep200StepActionsItem[];
   /** Security gates that must be satisfied before the step can be submitted.
   The engine injects gates dynamically based on policy, even if they
   are not declared in the flow definition.
@@ -5996,9 +6022,10 @@ type SubmitFlowStep200 = {
   id: string; /** Underlying session ID. Stable across all stacked flows. */
   session_id: string; /** Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today. */
   session_token?: string;
-  /** A step contains unordered capability dictionaries: what to collect (fields),
+  /** A step contains ordered capability arrays: what to collect (fields),
   what the user can do (actions), and what security gates must be satisfied (gates).
-  Layout and element ordering are controlled by the LiquidJS template in `branding.liquid_template`.
+  The LiquidJS template in `branding.liquid_template` iterates these arrays in order
+  and builds name-keyed indexes locally for lookup.
    */
   step: SubmitFlowStep200Step;
   /** Resolved branding configuration. Inherited from the app → team → project
@@ -6153,7 +6180,7 @@ type UpdateFlowDefinition200FlowDefinitionAudience = {
   /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
   app_ids?: string[];
 }; //#endregion
-//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemActions.d.ts
+//#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemActionsItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6162,25 +6189,23 @@ type UpdateFlowDefinition200FlowDefinitionAudience = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Actions the user can take. Keyed by action name.
-The action name is what the frontend sends back in the submit request.
-If omitted, the engine provides a default `submit` action.
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
 
  */
-type UpdateFlowDefinition200FlowDefinitionStepsItemActions = {
-  [key: string]: {
-    /** Marks this as the default/primary action. The runtime template uses
-    this hint to choose visual emphasis. At most one action per step
-    should be primary; this is not enforced here.
-    */
-    primary?: boolean;
-    /** Optional localization key override for the action's label. When
-    omitted, the engine derives a key from the step and action names.
-    Display text is resolved client-side from a locale dictionary, never
-    by the engine.
-    */
-    text_key?: string;
-  };
+type UpdateFlowDefinition200FlowDefinitionStepsItemActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+  text_key?: string;
 }; //#endregion
 //#region src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemComplete.d.ts
 /**
@@ -6307,7 +6332,7 @@ type UpdateFlowDefinition200FlowDefinitionStepsItemSsoProvidersItem = {
 /**
  * Maps action/outcome names to their transition descriptor.
 
-Keys match action names from the `actions` dict. Additional keys
+Keys match action names from the `actions` array. Additional keys
 come from implicit outcomes based on schema annotations
 (e.g. `user_not_found` from `x-unique` fields) and engine
 events (e.g. `sso`, `callback`).
@@ -6356,11 +6381,11 @@ type UpdateFlowDefinition200FlowDefinitionStepsItem = {
   transition outcome).
    */
   fields?: string[];
-  /** Actions the user can take. Keyed by action name.
-  The action name is what the frontend sends back in the submit request.
-  If omitted, the engine provides a default `submit` action.
+  /** Ordered list of actions the user can take. The action name is what the
+  frontend sends back in the submit request. If omitted, the engine
+  provides a default `submit` action.
    */
-  actions?: UpdateFlowDefinition200FlowDefinitionStepsItemActions;
+  actions?: UpdateFlowDefinition200FlowDefinitionStepsItemActionsItem[];
   /** Security gates that must be satisfied before submission. Keyed by gate
   name. Each gate selects a kind (e.g. "captcha") and provider-specific
   configuration. The engine may also inject gates dynamically based on
@@ -6379,7 +6404,7 @@ type UpdateFlowDefinition200FlowDefinitionStepsItem = {
    */
   complete?: UpdateFlowDefinition200FlowDefinitionStepsItemComplete;
   /** Maps action/outcome names to their transition descriptor.
-     Keys match action names from the `actions` dict. Additional keys
+     Keys match action names from the `actions` array. Additional keys
   come from implicit outcomes based on schema annotations
   (e.g. `user_not_found` from `x-unique` fields) and engine
   events (e.g. `sso`, `callback`).
@@ -6479,7 +6504,7 @@ type UpdateFlowDefinitionBodyAudience = {
   /** Restrict to specific teams (organizations). Empty means no team restriction. */team_ids?: string[]; /** Restrict to specific applications. Empty means no app restriction. */
   app_ids?: string[];
 }; //#endregion
-//#region src/generated/model/updateFlowDefinitionBodyStepsItemActions.d.ts
+//#region src/generated/model/updateFlowDefinitionBodyStepsItemActionsItem.d.ts
 /**
  * Generated by orval v8.10.0 🍺
  * Do not edit manually.
@@ -6488,25 +6513,23 @@ type UpdateFlowDefinitionBodyAudience = {
  * OpenAPI spec version: 0.0.1
  */
 /**
- * Actions the user can take. Keyed by action name.
-The action name is what the frontend sends back in the submit request.
-If omitted, the engine provides a default `submit` action.
+ * Configuration for a user-invokable action on a step. The `name` is sent
+back in the submit request as `action`.
 
  */
-type UpdateFlowDefinitionBodyStepsItemActions = {
-  [key: string]: {
-    /** Marks this as the default/primary action. The runtime template uses
-    this hint to choose visual emphasis. At most one action per step
-    should be primary; this is not enforced here.
-    */
-    primary?: boolean;
-    /** Optional localization key override for the action's label. When
-    omitted, the engine derives a key from the step and action names.
-    Display text is resolved client-side from a locale dictionary, never
-    by the engine.
-    */
-    text_key?: string;
-  };
+type UpdateFlowDefinitionBodyStepsItemActionsItem = {
+  /** Action identifier. Sent back in the submit request as `action`. */name: string;
+  /** Marks this as the default/primary action. The runtime template uses
+  this hint to choose visual emphasis. At most one action per step
+  should be primary; this is not enforced here.
+   */
+  primary?: boolean;
+  /** Optional localization key override for the action's label. When
+  omitted, the engine derives a key from the step and action names.
+  Display text is resolved client-side from a locale dictionary, never
+  by the engine.
+   */
+  text_key?: string;
 }; //#endregion
 //#region src/generated/model/updateFlowDefinitionBodyStepsItemComplete.d.ts
 /**
@@ -6633,7 +6656,7 @@ type UpdateFlowDefinitionBodyStepsItemSsoProvidersItem = {
 /**
  * Maps action/outcome names to their transition descriptor.
 
-Keys match action names from the `actions` dict. Additional keys
+Keys match action names from the `actions` array. Additional keys
 come from implicit outcomes based on schema annotations
 (e.g. `user_not_found` from `x-unique` fields) and engine
 events (e.g. `sso`, `callback`).
@@ -6682,11 +6705,11 @@ type UpdateFlowDefinitionBodyStepsItem = {
   transition outcome).
    */
   fields?: string[];
-  /** Actions the user can take. Keyed by action name.
-  The action name is what the frontend sends back in the submit request.
-  If omitted, the engine provides a default `submit` action.
+  /** Ordered list of actions the user can take. The action name is what the
+  frontend sends back in the submit request. If omitted, the engine
+  provides a default `submit` action.
    */
-  actions?: UpdateFlowDefinitionBodyStepsItemActions;
+  actions?: UpdateFlowDefinitionBodyStepsItemActionsItem[];
   /** Security gates that must be satisfied before submission. Keyed by gate
   name. Each gate selects a kind (e.g. "captcha") and provider-specific
   configuration. The engine may also inject gates dynamically based on
@@ -6705,7 +6728,7 @@ type UpdateFlowDefinitionBodyStepsItem = {
    */
   complete?: UpdateFlowDefinitionBodyStepsItemComplete;
   /** Maps action/outcome names to their transition descriptor.
-     Keys match action names from the `actions` dict. Additional keys
+     Keys match action names from the `actions` array. Additional keys
   come from implicit outcomes based on schema annotations
   (e.g. `user_not_found` from `x-unique` fields) and engine
   events (e.g. `sso`, `callback`).
@@ -7064,7 +7087,7 @@ type VerifyChallengeProofBody = {
  * Alias of the orval-generated wire enum for field types so the atom's
  * accepted `type` values track the API contract exactly.
  */
-type ZlFieldType = CreateFlow201StepFieldsType;
+type ZlFieldType = CreateFlow201StepFieldsItemType;
 /**
  * Atom: `<zl-field>` — labelled input bound to a step `field`. Visual
  * spec lineage:
@@ -7369,5 +7392,5 @@ declare global {
   }
 } //# sourceMappingURL=zl-pill.d.ts.map
 //#endregion
-export { GetFlowStep200 as $, CreateFlowDefinitionBody as A, RevokeTokenBody as At, CreateTeamBody as B, VerifyChallengeProofBody as Bt, CreateFlow201StepChallenge as C, ListFlowDefinitions200 as Ct, CreateFlowBody as D, ListUsers200Item as Dt, CreateFlow201StepSsoProvidersItem as E, ListSessionsParams as Et, CreateSchemaBody as F, SubmitFlowStepBody as Ft, DeleteFlowDefinitionParams as G, ZlAlert as Gt, CreateUser201 as H, zlCardManifest as Ht, CreateSchemaParams as I, UpdateFlowDefinition200 as It, ExchangeHandoffBody as J, ZlIcon as Jt, EndSessionParams as K, zlAlertManifest as Kt, CreateSession201 as L, UpdateFlowDefinitionBody as Lt, CreateProject201 as M, SetUserPasswordParams as Mt, CreateProjectBody as N, SubmitFlowEventBody as Nt, CreateFlowBodyPurpose as O, ListUsersParams as Ot, CreateSchema201 as P, SubmitFlowStep200 as Pt, GetFlowDefinitionParams as Q, CreateSessionBody as R, UpdateFlowDefinitionParams as Rt, CreateFlow201StepActions as S, IssueChallengeBody as St, CreateFlow201StepGates as T, ListSessions200 as Tt, CreateUserBody as U, ZlButton as Ut, CreateTeamParams as V, ZlCard as Vt, CreateUserParams as W, zlButtonManifest as Wt, GetAuthAttempt200 as X, ExchangeHandoffParams as Y, zlIconManifest as Yt, GetFlowDefinition200 as Z, CreateAuthAttemptBody as _, GetUserByIDParams as _t, ZlPasskeyResultDetail as a, GetOpenIDConfiguration200 as at, CreateFlow201BrandingLayout as b, IntrospectBody as bt, zlPageShellManifest as c, GetSchemaById200 as ct, zlFieldManifest as d, GetSessionParams as dt, GetHealthDefault as et, AuthorizeDevice200 as f, GetTeam200 as ft, CreateAuthAttempt201 as g, GetUserByID200 as gt, AuthorizeGetParams as h, GetTokenBody as ht, ZlPasskeyErrorDetail as i, GetMyUser200 as it, CreateHandoff200 as j, SetUserPasswordBody as jt, CreateFlowDefinition201 as k, RevokeSessionParams as kt, ZlField as l, GetSchemaByIdParams as lt, AuthorizeGetDefault as m, GetToken200 as mt, zlPillManifest as n, GetLiveDefault as nt, zlPasskeyManifest as o, GetProject200 as ot, AuthorizeDeviceParams as p, GetTeamParams as pt, ExchangeHandoff200 as q, IconName as qt, ZlPasskey as r, GetMySession200 as rt, ZlPageShell as s, GetReadyDefault as st, ZlPill as t, GetKeys200 as tt, ZlFieldType as u, GetSession200 as ut, CreateFlow201 as v, GetUserInfo200 as vt, CreateFlow201StepFields as w, ListFlowDefinitionsParams as wt, CreateFlow201Step as x, IssueChallenge201 as xt, CreateFlow201Branding as y, Introspect200 as yt, CreateTeam201 as z, VerifyChallengeProof200 as zt };
-//# sourceMappingURL=index-DQryonsO.d.mts.map
+export { GetFlowStep200 as $, CreateFlowDefinitionBody as A, RevokeTokenBody as At, CreateTeamBody as B, VerifyChallengeProofBody as Bt, CreateFlow201StepChallenge as C, ListFlowDefinitions200 as Ct, CreateFlowBody as D, ListUsers200Item as Dt, CreateFlow201StepSsoProvidersItem as E, ListSessionsParams as Et, CreateSchemaBody as F, SubmitFlowStepBody as Ft, DeleteFlowDefinitionParams as G, ZlAlert as Gt, CreateUser201 as H, zlCardManifest as Ht, CreateSchemaParams as I, UpdateFlowDefinition200 as It, ExchangeHandoffBody as J, ZlIcon as Jt, EndSessionParams as K, zlAlertManifest as Kt, CreateSession201 as L, UpdateFlowDefinitionBody as Lt, CreateProject201 as M, SetUserPasswordParams as Mt, CreateProjectBody as N, SubmitFlowEventBody as Nt, CreateFlowBodyPurpose as O, ListUsersParams as Ot, CreateSchema201 as P, SubmitFlowStep200 as Pt, GetFlowDefinitionParams as Q, CreateSessionBody as R, UpdateFlowDefinitionParams as Rt, CreateFlow201StepActionsItem as S, IssueChallengeBody as St, CreateFlow201StepGates as T, ListSessions200 as Tt, CreateUserBody as U, ZlButton as Ut, CreateTeamParams as V, ZlCard as Vt, CreateUserParams as W, zlButtonManifest as Wt, GetAuthAttempt200 as X, ExchangeHandoffParams as Y, zlIconManifest as Yt, GetFlowDefinition200 as Z, CreateAuthAttemptBody as _, GetUserByIDParams as _t, ZlPasskeyResultDetail as a, GetOpenIDConfiguration200 as at, CreateFlow201BrandingLayout as b, IntrospectBody as bt, zlPageShellManifest as c, GetSchemaById200 as ct, zlFieldManifest as d, GetSessionParams as dt, GetHealthDefault as et, AuthorizeDevice200 as f, GetTeam200 as ft, CreateAuthAttempt201 as g, GetUserByID200 as gt, AuthorizeGetParams as h, GetTokenBody as ht, ZlPasskeyErrorDetail as i, GetMyUser200 as it, CreateHandoff200 as j, SetUserPasswordBody as jt, CreateFlowDefinition201 as k, RevokeSessionParams as kt, ZlField as l, GetSchemaByIdParams as lt, AuthorizeGetDefault as m, GetToken200 as mt, zlPillManifest as n, GetLiveDefault as nt, zlPasskeyManifest as o, GetProject200 as ot, AuthorizeDeviceParams as p, GetTeamParams as pt, ExchangeHandoff200 as q, IconName as qt, ZlPasskey as r, GetMySession200 as rt, ZlPageShell as s, GetReadyDefault as st, ZlPill as t, GetKeys200 as tt, ZlFieldType as u, GetSession200 as ut, CreateFlow201 as v, GetUserInfo200 as vt, CreateFlow201StepFieldsItem as w, ListFlowDefinitionsParams as wt, CreateFlow201Step as x, IssueChallenge201 as xt, CreateFlow201Branding as y, Introspect200 as yt, CreateTeam201 as z, VerifyChallengeProof200 as zt };
+//# sourceMappingURL=index-DVDCrfkv.d.mts.map