@faable/auth-sdk 1.3.12 → 1.3.13

package/dist/FaableAuthApi.d.ts

@@ -29,6 +29,8 @@ export declare class FaableAuthApi extends FaableApi {
         notification_settings: {
             welcome_email_enabled: boolean;
         };
+        email_change_verification_mode?: "new_only" | "old_and_new" | undefined;
+        email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
         createdAt: string;
         updatedAt?: string | undefined;
     }>;
@@ -45,6 +47,7 @@ export declare class FaableAuthApi extends FaableApi {
             nickname?: string | null | undefined;
             email?: string | null | undefined;
             email_verified: boolean;
+            email_change_locked_at?: string | null | undefined;
             phone?: string | null | undefined;
             phone_verified: boolean;
             country_iso?: string | null | undefined;
@@ -89,6 +92,7 @@ export declare class FaableAuthApi extends FaableApi {
             nickname?: string | null | undefined;
             email?: string | null | undefined;
             email_verified: boolean;
+            email_change_locked_at?: string | null | undefined;
             phone?: string | null | undefined;
             phone_verified: boolean;
             country_iso?: string | null | undefined;
@@ -136,6 +140,7 @@ export declare class FaableAuthApi extends FaableApi {
             nickname?: string | null | undefined;
             email?: string | null | undefined;
             email_verified: boolean;
+            email_change_locked_at?: string | null | undefined;
             phone?: string | null | undefined;
             phone_verified: boolean;
             country_iso?: string | null | undefined;
@@ -181,6 +186,7 @@ export declare class FaableAuthApi extends FaableApi {
         nickname?: string | null | undefined;
         email?: string | null | undefined;
         email_verified: boolean;
+        email_change_locked_at?: string | null | undefined;
         phone?: string | null | undefined;
         phone_verified: boolean;
         country_iso?: string | null | undefined;
@@ -225,6 +231,7 @@ export declare class FaableAuthApi extends FaableApi {
         nickname?: string | null | undefined;
         email?: string | null | undefined;
         email_verified: boolean;
+        email_change_locked_at?: string | null | undefined;
         phone?: string | null | undefined;
         phone_verified: boolean;
         country_iso?: string | null | undefined;
@@ -269,6 +276,7 @@ export declare class FaableAuthApi extends FaableApi {
         nickname?: string | null | undefined;
         email?: string | null | undefined;
         email_verified: boolean;
+        email_change_locked_at?: string | null | undefined;
         phone?: string | null | undefined;
         phone_verified: boolean;
         country_iso?: string | null | undefined;

package/dist/api/types.d.ts

@@ -243,6 +243,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/user/{user_id}/change-email": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start the user's email change flow
+         * @description Initiates the email-change flow for the given user. Validates the new email, ensures it is not already in use in the tenant, revokes any pending change for the same user, creates a Ticket (`type='change_email'`), and sends a verification email to the new address. Re-authentication is not required — an active session/Bearer is enough. The change does NOT take effect until the user clicks the link in the email and confirms via `/change-email-confirm`.
+         */
+        post: operations["user/changeEmail"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/change-email-verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Verify a change-email ticket and apply the change
+         * @description Entry point for the link sent to the new email. Consumes the ticket, applies the email swap (in `new_only` mode) or issues a secondary verification ticket to the old email (in `old_and_new` mode, first step). Redirects to the `redirect_uri` supplied at flow start with `?status=applied|pending_old` appended; falls back to `/flow/email-change-done` on the auth host when no `redirect_uri` was given.
+         */
+        get: operations["user_change_email_verify"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/identity": {
         parameters: {
             query?: never;
@@ -328,7 +368,11 @@ export interface paths {
          */
         get: operations["role/get"];
         put?: never;
-        post?: never;
+        /**
+         * Update Roles in Account
+         * @description Update Roles in Account
+         */
+        post: operations["role/update"];
         /**
          * Delete Role in Account
          * @description Delete Role in Account
@@ -448,7 +492,11 @@ export interface paths {
          */
         get: operations["team/get"];
         put?: never;
-        post?: never;
+        /**
+         * Update Teams in Account
+         * @description Update Teams in Account
+         */
+        post: operations["team/update"];
         /**
          * Delete Team in Account
          * @description Delete Team in Account
@@ -551,6 +599,70 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/team/{team_id}/invite": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List pending invites for a Team
+         * @description Returns all pending (not consumed, not expired) team invites for the given team. Accepts a FaableQL `query` parameter on the `email` field.
+         */
+        get: operations["team/listInvites"];
+        put?: never;
+        /**
+         * Invite a user to a Team by email
+         * @description Invites a user by email. `mode='auto'` (default) adds the user directly when the email already corresponds to a user in this tenant and falls back to a ticketed invite + email otherwise. `mode='invite'` always issues a ticket + email even when the user exists. Re-inviting the same email to the same team invalidates the previous pending invite.
+         */
+        post: operations["team/invite"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/team/{team_id}/invite/{ticket_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Revoke a pending team invite
+         * @description Marks a pending team invite as consumed so it can no longer be accepted. Returns 400 if the invite is already consumed and 404 if it does not exist or belongs to a different team.
+         */
+        delete: operations["team/revokeInvite"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/invite-verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Verify a team-invite ticket and add the user to the team
+         * @description Entry point for the link sent to the invitee. Consumes the ticket, creates the user if needed (with `email_verified=true` — the click proves ownership), and adds them to the team with the invited roles. Then redirects to the `redirect_uri` supplied at invite time with `?status=accepted` appended; falls back to `/flow/team-invite-done` on the auth host when no `redirect_uri` was given. Idempotent if the user is already a member.
+         */
+        get: operations["team_invite_verify"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api": {
         parameters: {
             query?: never;
@@ -1327,6 +1439,15 @@ export interface components {
                  */
                 welcome_email_enabled: boolean;
             };
+            /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+            email_change_verification_mode?: "new_only" | "old_and_new";
+            /**
+             * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+             *
+             *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+             *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+             */
+            email_oauth_sync_policy?: "preserve_manual" | "always_sync";
             /** @description AuthAccount creation date */
             createdAt: string;
             /** @description AuthAccount updated date */
@@ -1341,6 +1462,15 @@ export interface components {
              */
             welcome_email_enabled: boolean;
         };
+        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+        EmailChangeVerificationMode: "new_only" | "old_and_new";
+        /**
+         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+         *
+         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+         */
+        EmailOAuthSyncPolicy: "preserve_manual" | "always_sync";
         /** @description Connection */
         Connection: {
             /** @description Connection ID */
@@ -1516,6 +1646,8 @@ export interface components {
              * @default false
              */
             email_verified: boolean;
+            /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+            email_change_locked_at?: string | null;
             /** @description contact phone number */
             phone?: string | null;
             /** @description phone is verified */
@@ -1783,6 +1915,13 @@ export interface components {
         RoleMetadataCreate: {
             [key: string]: unknown;
         };
+        /** @description Partial update for a Role. Only the supplied fields are modified. */
+        RoleUpdate: {
+            /** @description New human-readable identifier for the role. */
+            name?: string;
+            /** @description New free-form description of what users in this role do. */
+            description?: string;
+        };
         /** @description RoleMember */
         RoleMember: {
             /** @description RoleMember ID */
@@ -1879,6 +2018,21 @@ export interface components {
         TeamMetadataCreate: {
             [key: string]: unknown;
         };
+        /** @description Partial update for a Team. Only the supplied fields are modified. `slug` is auto-derived from `name` and is not user-editable. */
+        TeamUpdate: {
+            /** @description New human-readable name for the team. */
+            name?: string;
+            /** @description New free-form description for the team. */
+            description?: string;
+            /** @description Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely. */
+            metadata?: {
+                [key: string]: unknown;
+            };
+        };
+        /** @description Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely. */
+        TeamUpdateMetadata: {
+            [key: string]: unknown;
+        };
         /** @description TeamMember */
         TeamMember: {
             /** @description TeamMember ID */
@@ -1919,6 +2073,14 @@ export interface components {
              *     ]
              */
             users: string[];
+            /**
+             * @description Role ids to grant to the added members within the scope of this team.
+             * @default []
+             * @example [
+             *       "role_6555fd293acc2f0fac0e3452"
+             *     ]
+             */
+            roles: string[];
         };
         /** @description A permission exposed by an API: a single value that may end up in the `permissions` claim of an access_token, plus a human-readable description shown in the consent prompt. */
         Permission: {
@@ -2656,6 +2818,15 @@ export interface operations {
                              */
                             welcome_email_enabled: boolean;
                         };
+                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+                        email_change_verification_mode?: "new_only" | "old_and_new";
+                        /**
+                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                         *
+                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                         */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -2753,6 +2924,15 @@ export interface operations {
                              */
                             welcome_email_enabled: boolean;
                         };
+                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+                        email_change_verification_mode?: "new_only" | "old_and_new";
+                        /**
+                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                         *
+                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                         */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -2805,6 +2985,15 @@ export interface operations {
                              */
                             welcome_email_enabled: boolean;
                         };
+                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+                        email_change_verification_mode?: "new_only" | "old_and_new";
+                        /**
+                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                         *
+                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                         */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -2865,6 +3054,15 @@ export interface operations {
                              */
                             welcome_email_enabled: boolean;
                         };
+                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+                        email_change_verification_mode?: "new_only" | "old_and_new";
+                        /**
+                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                         *
+                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                         */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -2926,6 +3124,15 @@ export interface operations {
                              */
                             welcome_email_enabled: boolean;
                         };
+                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+                        email_change_verification_mode?: "new_only" | "old_and_new";
+                        /**
+                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                         *
+                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                         */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -3450,6 +3657,8 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
+                        /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+                        email_change_locked_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -3559,6 +3768,8 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
+                        /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+                        email_change_locked_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -3702,6 +3913,8 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
+                        /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+                        email_change_locked_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -3792,6 +4005,65 @@ export interface operations {
             };
         };
     };
+    "user/changeEmail": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Payload for `POST /user/:user_id/change-email`. Triggers the verification flow: a Ticket is created and an email is sent to the new address with a confirmation link. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The email address the user wants to switch to. */
+                    new_email: string;
+                    /** @description Override the account-wide policy. Can only raise the bar: passing `old_and_new` forces double verification; `new_only` is ignored if the account requires `old_and_new`. */
+                    verification_mode?: "new_only" | "old_and_new";
+                    /** @description Where to send the user after they click the link in the verification email. The status of the operation is appended as a `?status=applied|pending_old` query param so the calling app can render the right screen. When omitted, the user lands on the auth host's `/flow/email-change-done` fallback. */
+                    redirect_uri?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "verification_sent";
+                        ticket_id: string;
+                        verification_mode: "new_only" | "old_and_new";
+                    };
+                };
+            };
+        };
+    };
+    user_change_email_verify: {
+        parameters: {
+            query: {
+                ticket: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     "identity/list": {
         parameters: {
             query?: {
@@ -4091,6 +4363,61 @@ export interface operations {
             };
         };
     };
+    "role/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                role_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Partial update for a Role. Only the supplied fields are modified. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description New human-readable identifier for the role. */
+                    name?: string;
+                    /** @description New free-form description of what users in this role do. */
+                    description?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Role */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Role ID */
+                        id: string;
+                        /**
+                         * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
+                         * @example admin
+                         */
+                        name: string;
+                        /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
+                        description: string;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description RoleMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Role creation date */
+                        createdAt: string;
+                        /** @description Role updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
     "role/remove": {
         parameters: {
             query?: never;
@@ -4485,6 +4812,72 @@ export interface operations {
             };
         };
     };
+    "team/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                team_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Partial update for a Team. Only the supplied fields are modified. `slug` is auto-derived from `name` and is not user-editable. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description New human-readable name for the team. */
+                    name?: string;
+                    /** @description New free-form description for the team. */
+                    description?: string;
+                    /** @description Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely. */
+                    metadata?: {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description Team */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Team ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the team. Shown in the dashboard and in team-picker UI.
+                         * @example Acme Engineering
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.
+                         * @example acme-engineering
+                         */
+                        slug: string;
+                        /** @description Optional free-form description of the team. */
+                        description: string | null;
+                        /** @description Optional URL of an image used as the team avatar/logo. */
+                        logo_url: string | null;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description TeamMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Team creation date */
+                        createdAt: string;
+                        /** @description Team updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
     "team/remove": {
         parameters: {
             query?: never;
@@ -4559,6 +4952,14 @@ export interface operations {
                      *     ]
                      */
                     users: string[];
+                    /**
+                     * @description Role ids to grant to the added members within the scope of this team.
+                     * @default []
+                     * @example [
+                     *       "role_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
+                    roles?: string[];
                 };
             };
         };
@@ -4717,6 +5118,14 @@ export interface operations {
                      *     ]
                      */
                     users: string[];
+                    /**
+                     * @description Role ids to grant to the added members within the scope of this team.
+                     * @default []
+                     * @example [
+                     *       "role_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
+                    roles?: string[];
                 };
             };
         };
@@ -4806,6 +5215,182 @@ export interface operations {
             };
         };
     };
+    "team/listInvites": {
+        parameters: {
+            query?: {
+                /** @description FaableQL filter. Supported fields: `email`. Example: `?query=email:foo@bar.com` */
+                query?: string;
+            };
+            header?: never;
+            path: {
+                team_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: {
+                            /** @description TeamInvite ID */
+                            id: string;
+                            /** @description Email address that was invited */
+                            email: string;
+                            /** @description Team the invitee will be added to upon acceptance. */
+                            team: components["schemas"]["Team"] | string | unknown;
+                            /** @description User that created the invitation, if known. */
+                            inviter?: components["schemas"]["User"] | string | unknown;
+                            /** @description Role ids that will be applied to the new TeamMember on acceptance. */
+                            roles: string[];
+                            /** @description `auto` adds the user directly if they already exist in the tenant and only falls back to a ticketed invite when the email is unknown. `invite` always issues a ticket + email regardless of whether the user exists. */
+                            mode: "auto" | "invite";
+                            /** @description URI to redirect the invitee to after a successful accept. */
+                            redirect_uri?: string;
+                            /** @description ISO 8601 timestamp at which the invite stops being valid. */
+                            expires_at: string;
+                            /** @description ISO 8601 timestamp at which the invite was accepted. Absent for pending invites. */
+                            consume_date?: string;
+                            /** @description Object is related with this account */
+                            account: string;
+                            /**
+                             * @description TeamInviteMetadata
+                             * @default {}
+                             */
+                            metadata: {
+                                [key: string]: unknown;
+                            };
+                            /** @description TeamInvite creation date */
+                            createdAt: string;
+                            /** @description TeamInvite updated date */
+                            updatedAt?: string;
+                        }[];
+                    };
+                };
+            };
+        };
+    };
+    "team/invite": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                team_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Payload for inviting a user to a team by email. `mode='auto'` (default) adds the user immediately if they already exist in the tenant and falls back to a ticketed invite otherwise. `mode='invite'` always issues a ticket + email. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Email of the user to invite to the team.
+                     * @example someone@example.com
+                     */
+                    email: string;
+                    /**
+                     * @description Role ids granted to the resulting TeamMember within the scope of this team.
+                     * @default []
+                     */
+                    roles?: string[];
+                    /** @description `auto` adds the user directly if they already exist in the tenant and only falls back to a ticketed invite when the email is unknown. `invite` always issues a ticket + email regardless of whether the user exists. */
+                    mode?: "auto" | "invite";
+                    /** @description Where to redirect the invitee after a successful accept. Defaults to `/`. */
+                    redirect_uri?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description `invited` when a ticket + email was issued, `added` when the user was added directly (auto mode + existing user). */
+                        status: "invited" | "added";
+                        /** @description ID of the issued invite ticket (when status=invited). */
+                        ticket_id?: string;
+                        /** @description TeamMember */
+                        member?: {
+                            /** @description TeamMember ID */
+                            id: string;
+                            /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
+                            user: components["schemas"]["User"] | string | unknown;
+                            /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
+                            team: components["schemas"]["Team"] | string | unknown;
+                            /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
+                            roles: (components["schemas"]["Role"] | string | unknown)[];
+                            /** @description Object is related with this account */
+                            account: string;
+                            /**
+                             * @description TeamMemberMetadata
+                             * @default {}
+                             */
+                            metadata: {
+                                [key: string]: unknown;
+                            };
+                            /** @description TeamMember creation date */
+                            createdAt: string;
+                            /** @description TeamMember updated date */
+                            updatedAt?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "team/revokeInvite": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                team_id: string;
+                ticket_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "revoked";
+                    };
+                };
+            };
+        };
+    };
+    team_invite_verify: {
+        parameters: {
+            query: {
+                ticket: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     "api/list": {
         parameters: {
             query?: {
@@ -6073,6 +6658,8 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
+                        /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+                        email_change_locked_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "1.3.12",
+  "version": "1.3.13",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",