@faable/auth-sdk 1.3.12 → 1.3.14

package/dist/api/types.d.ts

@@ -132,7 +132,11 @@ export interface paths {
          */
         get: operations["connection/get"];
         put?: never;
-        post?: never;
+        /**
+         * Update Connections in Account
+         * @description Update Connections in Account
+         */
+        post: operations["connection/update"];
         /**
          * Delete Connection in Account
          * @description Delete Connection in Account
@@ -180,7 +184,11 @@ export interface paths {
          */
         get: operations["client/get"];
         put?: never;
-        post?: never;
+        /**
+         * Update Clients in Account
+         * @description Update Clients in Account
+         */
+        post: operations["client/update"];
         /**
          * Delete Client in Account
          * @description Delete Client in Account
@@ -191,6 +199,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/client/{client_id}/rotate-secret": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Rotate a Client's secret
+         * @description Generates a fresh `client_secret` for the given Client and persists it. The previous secret is invalidated immediately — there is no grace period. Returns the full Client; the dashboard must surface the new secret to the admin once. Existing client_credentials / authorization_code integrations using the old secret will start failing at the token endpoint immediately after this call.
+         */
+        post: operations["client/rotateSecret"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/user": {
         parameters: {
             query?: never;
@@ -243,6 +271,86 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/user/{user_id}/change-email": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start the user's email change flow
+         * @description Initiates the email-change flow for the given user. Validates the new email, ensures it is not already in use in the tenant, revokes any pending change for the same user, creates a Ticket (`type='change_email'`), and sends a verification email to the new address. Re-authentication is not required — an active session/Bearer is enough. The change does NOT take effect until the user clicks the link in the email and confirms via `/change-email-confirm`.
+         */
+        post: operations["user/changeEmail"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/change-email-verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Verify a change-email ticket and apply the change
+         * @description Entry point for the link sent to the new email. Consumes the ticket, applies the email swap (in `new_only` mode) or issues a secondary verification ticket to the old email (in `old_and_new` mode, first step). Redirects to the `redirect_uri` supplied at flow start with `?status=applied|pending_old` appended; falls back to `/flow/email-change-done` on the auth host when no `redirect_uri` was given.
+         */
+        get: operations["user_change_email_verify"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/user/{user_id}/verify-email/start": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start the user's email verification flow
+         * @description Initiates the email-verification flow for the given user. Creates a `verify_email` Ticket and queues the verification email. Idempotent — returns `{status:'already_verified'}` without emitting a ticket if the user is already verified. Re-authentication is not required: an active session/Bearer is enough.
+         */
+        post: operations["user/verifyEmailStart"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/verify-email": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Verify a verify-email ticket and mark the user verified
+         * @description Entry point for the link sent to the user. Consumes the ticket, sets `email_verified=true` with `email_verified_method='verification_flow'`. Redirects to the `redirect_uri` supplied at start with `?status=verified|already_verified` appended; falls back to `/flow/verify-email-done` on the auth host when no `redirect_uri` was given. Invalid/expired tickets redirect to the same fallback with `?status=invalid_link` or `?status=expired`.
+         */
+        get: operations["user_verify_email_confirm"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/identity": {
         parameters: {
             query?: never;
@@ -328,7 +436,11 @@ export interface paths {
          */
         get: operations["role/get"];
         put?: never;
-        post?: never;
+        /**
+         * Update Roles in Account
+         * @description Update Roles in Account
+         */
+        post: operations["role/update"];
         /**
          * Delete Role in Account
          * @description Delete Role in Account
@@ -448,7 +560,11 @@ export interface paths {
          */
         get: operations["team/get"];
         put?: never;
-        post?: never;
+        /**
+         * Update Teams in Account
+         * @description Update Teams in Account
+         */
+        post: operations["team/update"];
         /**
          * Delete Team in Account
          * @description Delete Team in Account
@@ -516,7 +632,7 @@ export interface paths {
         };
         /**
          * List Team Members
-         * @description List all Users that belong to the given Team in the current Account.
+         * @description List all Users that belong to the given Team in the current Account. Supports `?expand=user,team,roles` to inline referenced rows.
          */
         get: operations["team/listMembers"];
         put?: never;
@@ -551,6 +667,70 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/team/{team_id}/invite": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List pending invites for a Team
+         * @description Returns all pending (not consumed, not expired) team invites for the given team. Accepts a FaableQL `query` parameter on the `email` field.
+         */
+        get: operations["team/listInvites"];
+        put?: never;
+        /**
+         * Invite a user to a Team by email
+         * @description Invites a user by email. `mode='auto'` (default) adds the user directly when the email already corresponds to a user in this tenant and falls back to a ticketed invite + email otherwise. `mode='invite'` always issues a ticket + email even when the user exists. Re-inviting the same email to the same team invalidates the previous pending invite.
+         */
+        post: operations["team/invite"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/team/{team_id}/invite/{ticket_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Revoke a pending team invite
+         * @description Marks a pending team invite as consumed so it can no longer be accepted. Returns 400 if the invite is already consumed and 404 if it does not exist or belongs to a different team.
+         */
+        delete: operations["team/revokeInvite"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/invite-verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Verify a team-invite ticket and add the user to the team
+         * @description Entry point for the link sent to the invitee. Consumes the ticket, creates the user if needed (with `email_verified=true` — the click proves ownership), and adds them to the team with the invited roles. Then redirects to the `redirect_uri` supplied at invite time with `?status=accepted` appended; falls back to `/flow/team-invite-done` on the auth host when no `redirect_uri` was given. Idempotent if the user is already a member.
+         */
+        get: operations["team_invite_verify"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api": {
         parameters: {
             query?: never;
@@ -1326,7 +1506,21 @@ export interface components {
                  * @default false
                  */
                 welcome_email_enabled: boolean;
+                /**
+                 * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                 * @default false
+                 */
+                verify_email_auto_send: boolean;
             };
+            /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+            email_change_verification_mode?: "new_only" | "old_and_new";
+            /**
+             * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+             *
+             *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+             *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+             */
+            email_oauth_sync_policy?: "preserve_manual" | "always_sync";
             /** @description AuthAccount creation date */
             createdAt: string;
             /** @description AuthAccount updated date */
@@ -1340,7 +1534,14 @@ export interface components {
              * @default false
              */
             welcome_email_enabled: boolean;
+            /**
+             * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+             * @default false
+             */
+            verify_email_auto_send: boolean;
         };
+        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+        EmailChangeVerificationMode: "new_only" | "old_and_new";
         /** @description Connection */
         Connection: {
             /** @description Connection ID */
@@ -1376,6 +1577,10 @@ export interface components {
             authorize_params: {
                 [key: string]: string;
             };
+            /** @description Derived: true when the connection_type has shared Faable defaults AND the tenant has not set its own client_id/client_secret. Read-only — set by the server on every read. */
+            readonly is_using_default_credentials: boolean;
+            /** @description Per-connection override of `Account.email_oauth_sync_policy`. When set on a Connection, takes precedence over the Account-level setting for logins through this IdP. When unset (default), the Account-level policy applies. Use this to allow `always_sync` for a trusted IdP (e.g. corporate SSO) while keeping `preserve_manual` for others within the same tenant. */
+            email_oauth_sync_policy?: "preserve_manual" | "always_sync";
             /** @description Object is related with this account */
             account: string;
             /**
@@ -1419,6 +1624,13 @@ export interface components {
             authorize_params: {
                 [key: string]: string;
             };
+            /**
+             * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+             *
+             *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+             *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+             */
+            email_oauth_sync_policy?: "preserve_manual" | "always_sync";
             /** @description Add Metadata */
             metadata?: {
                 [key: string]: unknown;
@@ -1428,6 +1640,29 @@ export interface components {
         ConnectionMetadataCreate: {
             [key: string]: unknown;
         };
+        /** @description Partial update for a Connection. Only the supplied fields are modified. `connection_type` is intentionally excluded — changing it would orphan every identity already linked to this connection. */
+        ConnectionUpdate: {
+            connection_name?: string;
+            enabled?: boolean;
+            enabled_clients?: string[];
+            scope?: string[];
+            client_id?: string;
+            client_secret?: string;
+            issuer?: string;
+            authorize_url?: string;
+            token_url?: string;
+            userinfo_url?: string;
+            jwks_url?: string;
+            response_type?: string;
+            /**
+             * @description Authorize params
+             * @default {}
+             */
+            authorize_params: {
+                [key: string]: string;
+            };
+            email_oauth_sync_policy?: "preserve_manual" | "always_sync" | null;
+        };
         /** @description Client */
         Client: {
             /** @description Client ID */
@@ -1493,6 +1728,36 @@ export interface components {
         ClientMetadataCreate: {
             [key: string]: unknown;
         };
+        /** @description Partial update for a Client. Only the supplied fields are modified. `client_id` and `client_secret` are not editable through this endpoint to prevent accidental rotation; use a dedicated endpoint when secret rotation is added. */
+        ClientUpdate: {
+            /** @description Human-readable client name shown in consent screens. */
+            name?: string;
+            /** @description Free-form description for internal admin use. */
+            description?: string;
+            /** @description Whitelist of allowed OAuth `redirect_uri` values. */
+            callbacks?: string[];
+            /** @description Whitelist of allowed `post_logout_redirect_uri` values. */
+            logout_urls?: string[];
+            refresh_token?: {
+                /** @enum {unknown} */
+                expiration_mode: "expire" | "not-expire";
+                infinite_token_lifetime: boolean;
+                token_lifetime: number;
+            };
+            client_uri?: string | null;
+            logo_uri?: string | null;
+            tos_uri?: string | null;
+            policy_uri?: string | null;
+            contacts?: string[];
+            grant_types?: string[];
+            response_types?: string[];
+            token_endpoint_auth_method?: string;
+            application_type?: string;
+            software_id?: string | null;
+            software_version?: string | null;
+            frontchannel_logout_uri?: string | null;
+            frontchannel_logout_session_required?: boolean;
+        };
         /** @description User */
         User: {
             /** @description User ID */
@@ -1516,10 +1781,20 @@ export interface components {
              * @default false
              */
             email_verified: boolean;
+            /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
+            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+            /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
+            email_verified_at?: string | null;
+            /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+            email_change_locked_at?: string | null;
             /** @description contact phone number */
             phone?: string | null;
             /** @description phone is verified */
             phone_verified: boolean;
+            /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
+            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+            /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
+            phone_verified_at?: string | null;
             /** @description country iso code */
             country_iso?: string | null;
             /** @description user birth_date */
@@ -1660,12 +1935,16 @@ export interface components {
             given_name?: string;
             /** @description family name */
             family_name?: string;
-            /** @description contact email */
+            /** @description Contact email. Changing the email to a new value automatically resets `email_verified` to false (and clears `email_verified_method` / `email_verified_at`) unless the same patch sets `email_verified` explicitly. The override is the documented way to import a pre-verified user from another IdP. */
             email?: string;
+            /** @description Flip the email verification flag. Setting `true` marks the email as verified by the admin (`email_verified_method=manual`). Setting `false` clears the verification metadata. */
+            email_verified?: boolean;
             /** @description New password for this user */
             password?: string;
-            /** @description contact phone number */
+            /** @description Contact phone number. Changing it to a new value automatically resets `phone_verified` to false (and clears `phone_verified_method` / `phone_verified_at`) unless the same patch sets `phone_verified` explicitly. */
             phone?: string;
+            /** @description Flip the phone verification flag. Setting `true` marks the phone as verified by the admin (`phone_verified_method=manual`). */
+            phone_verified?: boolean;
             /** @description user country as iso string */
             country_iso?: string;
             /** @description user birth_date */
@@ -1783,6 +2062,13 @@ export interface components {
         RoleMetadataCreate: {
             [key: string]: unknown;
         };
+        /** @description Partial update for a Role. Only the supplied fields are modified. */
+        RoleUpdate: {
+            /** @description New human-readable identifier for the role. */
+            name?: string;
+            /** @description New free-form description of what users in this role do. */
+            description?: string;
+        };
         /** @description RoleMember */
         RoleMember: {
             /** @description RoleMember ID */
@@ -1879,6 +2165,21 @@ export interface components {
         TeamMetadataCreate: {
             [key: string]: unknown;
         };
+        /** @description Partial update for a Team. Only the supplied fields are modified. `slug` is auto-derived from `name` and is not user-editable. */
+        TeamUpdate: {
+            /** @description New human-readable name for the team. */
+            name?: string;
+            /** @description New free-form description for the team. */
+            description?: string;
+            /** @description Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely. */
+            metadata?: {
+                [key: string]: unknown;
+            };
+        };
+        /** @description Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely. */
+        TeamUpdateMetadata: {
+            [key: string]: unknown;
+        };
         /** @description TeamMember */
         TeamMember: {
             /** @description TeamMember ID */
@@ -1919,6 +2220,14 @@ export interface components {
              *     ]
              */
             users: string[];
+            /**
+             * @description Role ids to grant to the added members within the scope of this team.
+             * @default []
+             * @example [
+             *       "role_6555fd293acc2f0fac0e3452"
+             *     ]
+             */
+            roles: string[];
         };
         /** @description A permission exposed by an API: a single value that may end up in the `permissions` claim of an access_token, plus a human-readable description shown in the consent prompt. */
         Permission: {
@@ -2397,6 +2706,17 @@ export interface components {
             message?: string;
             /** @description Type-specific structured payload */
             data?: unknown;
+            user?: components["schemas"]["User"] | string | unknown;
+            client?: components["schemas"]["Client"] | string | unknown;
+            connection?: components["schemas"]["Connection"] | string | unknown;
+            team?: components["schemas"]["Team"] | string | unknown;
+            identity?: components["schemas"]["Identity"] | string | unknown;
+            ticket?: string;
+            /**
+             * Format: date-time
+             * @description When this log row will be auto-deleted by the Mongo TTL monitor. Absent on rows recorded without `ttl_seconds`.
+             */
+            expires_at?: string;
             /** @description Object is related with this account */
             account: string;
             /**
@@ -2552,6 +2872,18 @@ export interface components {
             callback_hostnames?: string[];
             default_connection?: string | null;
             enabled_locales?: string[];
+            notification_settings?: {
+                /**
+                 * @description Send the built-in welcome email on user.created
+                 * @default false
+                 */
+                welcome_email_enabled: boolean;
+                /**
+                 * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                 * @default false
+                 */
+                verify_email_auto_send: boolean;
+            };
         };
         OAuthTokenParams: {
             /** @description Grant Type. https://oauth.net/2/grant-types/ */
@@ -2655,7 +2987,21 @@ export interface operations {
                              * @default false
                              */
                             welcome_email_enabled: boolean;
+                            /**
+                             * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                             * @default false
+                             */
+                            verify_email_auto_send: boolean;
                         };
+                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+                        email_change_verification_mode?: "new_only" | "old_and_new";
+                        /**
+                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                         *
+                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                         */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -2752,7 +3098,21 @@ export interface operations {
                              * @default false
                              */
                             welcome_email_enabled: boolean;
+                            /**
+                             * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                             * @default false
+                             */
+                            verify_email_auto_send: boolean;
                         };
+                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+                        email_change_verification_mode?: "new_only" | "old_and_new";
+                        /**
+                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                         *
+                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                         */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -2804,7 +3164,21 @@ export interface operations {
                              * @default false
                              */
                             welcome_email_enabled: boolean;
+                            /**
+                             * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                             * @default false
+                             */
+                            verify_email_auto_send: boolean;
                         };
+                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+                        email_change_verification_mode?: "new_only" | "old_and_new";
+                        /**
+                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                         *
+                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                         */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -2832,6 +3206,18 @@ export interface operations {
                     callback_hostnames?: string[];
                     default_connection?: string | null;
                     enabled_locales?: string[];
+                    notification_settings?: {
+                        /**
+                         * @description Send the built-in welcome email on user.created
+                         * @default false
+                         */
+                        welcome_email_enabled?: boolean;
+                        /**
+                         * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                         * @default false
+                         */
+                        verify_email_auto_send?: boolean;
+                    };
                 };
             };
         };
@@ -2864,7 +3250,21 @@ export interface operations {
                              * @default false
                              */
                             welcome_email_enabled: boolean;
+                            /**
+                             * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                             * @default false
+                             */
+                            verify_email_auto_send: boolean;
                         };
+                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+                        email_change_verification_mode?: "new_only" | "old_and_new";
+                        /**
+                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                         *
+                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                         */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -2925,7 +3325,21 @@ export interface operations {
                              * @default false
                              */
                             welcome_email_enabled: boolean;
+                            /**
+                             * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                             * @default false
+                             */
+                            verify_email_auto_send: boolean;
                         };
+                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+                        email_change_verification_mode?: "new_only" | "old_and_new";
+                        /**
+                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                         *
+                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                         */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -2946,6 +3360,8 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
+                /** @description Full-text search across: `connection_name`, `connection_type`. */
+                q?: string;
             };
             header?: never;
             path?: never;
@@ -3000,6 +3416,13 @@ export interface operations {
                     authorize_params?: {
                         [key: string]: string;
                     };
+                    /**
+                     * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                     *
+                     *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                     *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                     */
+                    email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                     /** @description Add Metadata */
                     metadata?: {
                         [key: string]: unknown;
@@ -3048,6 +3471,10 @@ export interface operations {
                         authorize_params: {
                             [key: string]: string;
                         };
+                        /** @description Derived: true when the connection_type has shared Faable defaults AND the tenant has not set its own client_id/client_secret. Read-only — set by the server on every read. */
+                        readonly is_using_default_credentials: boolean;
+                        /** @description Per-connection override of `Account.email_oauth_sync_policy`. When set on a Connection, takes precedence over the Account-level setting for logins through this IdP. When unset (default), the Account-level policy applies. Use this to allow `always_sync` for a trusted IdP (e.g. corporate SSO) while keeping `preserve_manual` for others within the same tenant. */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -3117,6 +3544,10 @@ export interface operations {
                         authorize_params: {
                             [key: string]: string;
                         };
+                        /** @description Derived: true when the connection_type has shared Faable defaults AND the tenant has not set its own client_id/client_secret. Read-only — set by the server on every read. */
+                        readonly is_using_default_credentials: boolean;
+                        /** @description Per-connection override of `Account.email_oauth_sync_policy`. When set on a Connection, takes precedence over the Account-level setting for logins through this IdP. When unset (default), the Account-level policy applies. Use this to allow `always_sync` for a trusted IdP (e.g. corporate SSO) while keeping `preserve_manual` for others within the same tenant. */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -3135,7 +3566,7 @@ export interface operations {
             };
         };
     };
-    "connection/remove": {
+    "connection/update": {
         parameters: {
             query?: never;
             header?: never;
@@ -3144,9 +3575,108 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
-        responses: {
-            /** @description Default Response */
+        /** @description Partial update for a Connection. Only the supplied fields are modified. `connection_type` is intentionally excluded — changing it would orphan every identity already linked to this connection. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    connection_name?: string;
+                    enabled?: boolean;
+                    enabled_clients?: string[];
+                    scope?: string[];
+                    client_id?: string;
+                    client_secret?: string;
+                    issuer?: string;
+                    authorize_url?: string;
+                    token_url?: string;
+                    userinfo_url?: string;
+                    jwks_url?: string;
+                    response_type?: string;
+                    /**
+                     * @description Authorize params
+                     * @default {}
+                     */
+                    authorize_params?: {
+                        [key: string]: string;
+                    };
+                    email_oauth_sync_policy?: "preserve_manual" | "always_sync" | null;
+                };
+            };
+        };
+        responses: {
+            /** @description Connection */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Connection ID */
+                        id: string;
+                        connection_name: string;
+                        /** @enum {unknown} */
+                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc" | "passwordless_email";
+                        /** @default null */
+                        authorize_url: string;
+                        /** @default null */
+                        token_url: string;
+                        /** @default null */
+                        userinfo_url: string;
+                        /** @default null */
+                        client_id: string;
+                        /** @default null */
+                        client_secret: string;
+                        /** @default null */
+                        issuer: string;
+                        /** @default null */
+                        jwks_url: string;
+                        /** @default null */
+                        response_type: string;
+                        enabled: boolean;
+                        /** @default null */
+                        enabled_clients: string[] | null;
+                        /** @default [] */
+                        scope: string[];
+                        /**
+                         * @description Authorize params
+                         * @default {}
+                         */
+                        authorize_params: {
+                            [key: string]: string;
+                        };
+                        /** @description Derived: true when the connection_type has shared Faable defaults AND the tenant has not set its own client_id/client_secret. Read-only — set by the server on every read. */
+                        readonly is_using_default_credentials: boolean;
+                        /** @description Per-connection override of `Account.email_oauth_sync_policy`. When set on a Connection, takes precedence over the Account-level setting for logins through this IdP. When unset (default), the Account-level policy applies. Use this to allow `always_sync` for a trusted IdP (e.g. corporate SSO) while keeping `preserve_manual` for others within the same tenant. */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ConnectionMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Connection creation date */
+                        createdAt: string;
+                        /** @description Connection updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "connection/remove": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                connection_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -3166,6 +3696,8 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
+                /** @description Full-text search across: `name`, `description`, `client_id`. */
+                q?: string;
             };
             header?: never;
             path?: never;
@@ -3327,6 +3859,102 @@ export interface operations {
             };
         };
     };
+    "client/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                client_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Partial update for a Client. Only the supplied fields are modified. `client_id` and `client_secret` are not editable through this endpoint to prevent accidental rotation; use a dedicated endpoint when secret rotation is added. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Human-readable client name shown in consent screens. */
+                    name?: string;
+                    /** @description Free-form description for internal admin use. */
+                    description?: string;
+                    /** @description Whitelist of allowed OAuth `redirect_uri` values. */
+                    callbacks?: string[];
+                    /** @description Whitelist of allowed `post_logout_redirect_uri` values. */
+                    logout_urls?: string[];
+                    refresh_token?: {
+                        /** @enum {unknown} */
+                        expiration_mode: "expire" | "not-expire";
+                        infinite_token_lifetime: boolean;
+                        token_lifetime: number;
+                    };
+                    client_uri?: string | null;
+                    logo_uri?: string | null;
+                    tos_uri?: string | null;
+                    policy_uri?: string | null;
+                    contacts?: string[];
+                    grant_types?: string[];
+                    response_types?: string[];
+                    token_endpoint_auth_method?: string;
+                    application_type?: string;
+                    software_id?: string | null;
+                    software_version?: string | null;
+                    frontchannel_logout_uri?: string | null;
+                    frontchannel_logout_session_required?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Client */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Client ID */
+                        id: string;
+                        name: string;
+                        description: string;
+                        client_id: string;
+                        client_secret: string;
+                        callbacks: string[];
+                        logout_urls: string[];
+                        refresh_token: {
+                            /** @enum {unknown} */
+                            expiration_mode: "expire" | "not-expire";
+                            infinite_token_lifetime: boolean;
+                            token_lifetime: number;
+                        };
+                        client_uri?: string | null;
+                        logo_uri?: string | null;
+                        tos_uri?: string | null;
+                        policy_uri?: string | null;
+                        contacts?: string[];
+                        grant_types?: string[];
+                        response_types?: string[];
+                        token_endpoint_auth_method?: string;
+                        application_type?: string;
+                        software_id?: string | null;
+                        software_version?: string | null;
+                        frontchannel_logout_uri?: string | null;
+                        frontchannel_logout_session_required?: boolean;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ClientMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Client creation date */
+                        createdAt: string;
+                        /** @description Client updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
     "client/remove": {
         parameters: {
             query?: never;
@@ -3347,6 +3975,69 @@ export interface operations {
             };
         };
     };
+    "client/rotateSecret": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                client_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Client */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Client ID */
+                        id: string;
+                        name: string;
+                        description: string;
+                        client_id: string;
+                        client_secret: string;
+                        callbacks: string[];
+                        logout_urls: string[];
+                        refresh_token: {
+                            /** @enum {unknown} */
+                            expiration_mode: "expire" | "not-expire";
+                            infinite_token_lifetime: boolean;
+                            token_lifetime: number;
+                        };
+                        client_uri?: string | null;
+                        logo_uri?: string | null;
+                        tos_uri?: string | null;
+                        policy_uri?: string | null;
+                        contacts?: string[];
+                        grant_types?: string[];
+                        response_types?: string[];
+                        token_endpoint_auth_method?: string;
+                        application_type?: string;
+                        software_id?: string | null;
+                        software_version?: string | null;
+                        frontchannel_logout_uri?: string | null;
+                        frontchannel_logout_session_required?: boolean;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ClientMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Client creation date */
+                        createdAt: string;
+                        /** @description Client updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
     "user/list": {
         parameters: {
             query?: {
@@ -3358,6 +4049,8 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
+                /** @description Full-text search across: `name`, `email`, `phone`. */
+                q?: string;
             };
             header?: never;
             path?: never;
@@ -3450,10 +4143,20 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
+                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
+                        email_verified_at?: string | null;
+                        /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+                        email_change_locked_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
+                        phone_verified_at?: string | null;
                         /** @description country iso code */
                         country_iso?: string | null;
                         /** @description user birth_date */
@@ -3559,10 +4262,20 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
+                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
+                        email_verified_at?: string | null;
+                        /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+                        email_change_locked_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
+                        phone_verified_at?: string | null;
                         /** @description country iso code */
                         country_iso?: string | null;
                         /** @description user birth_date */
@@ -3648,12 +4361,16 @@ export interface operations {
                     given_name?: string;
                     /** @description family name */
                     family_name?: string;
-                    /** @description contact email */
+                    /** @description Contact email. Changing the email to a new value automatically resets `email_verified` to false (and clears `email_verified_method` / `email_verified_at`) unless the same patch sets `email_verified` explicitly. The override is the documented way to import a pre-verified user from another IdP. */
                     email?: string;
+                    /** @description Flip the email verification flag. Setting `true` marks the email as verified by the admin (`email_verified_method=manual`). Setting `false` clears the verification metadata. */
+                    email_verified?: boolean;
                     /** @description New password for this user */
                     password?: string;
-                    /** @description contact phone number */
+                    /** @description Contact phone number. Changing it to a new value automatically resets `phone_verified` to false (and clears `phone_verified_method` / `phone_verified_at`) unless the same patch sets `phone_verified` explicitly. */
                     phone?: string;
+                    /** @description Flip the phone verification flag. Setting `true` marks the phone as verified by the admin (`phone_verified_method=manual`). */
+                    phone_verified?: boolean;
                     /** @description user country as iso string */
                     country_iso?: string;
                     /** @description user birth_date */
@@ -3702,10 +4419,20 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
+                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
+                        email_verified_at?: string | null;
+                        /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+                        email_change_locked_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
+                        phone_verified_at?: string | null;
                         /** @description country iso code */
                         country_iso?: string | null;
                         /** @description user birth_date */
@@ -3772,13 +4499,125 @@ export interface operations {
             };
         };
     };
-    "user/remove": {
+    "user/remove": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    "user/changeEmail": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Payload for `POST /user/:user_id/change-email`. Triggers the verification flow: a Ticket is created and an email is sent to the new address with a confirmation link. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The email address the user wants to switch to. */
+                    new_email: string;
+                    /** @description Override the account-wide policy. Can only raise the bar: passing `old_and_new` forces double verification; `new_only` is ignored if the account requires `old_and_new`. */
+                    verification_mode?: "new_only" | "old_and_new";
+                    /** @description Where to send the user after they click the link in the verification email. The status of the operation is appended as a `?status=applied|pending_old` query param so the calling app can render the right screen. When omitted, the user lands on the auth host's `/flow/email-change-done` fallback. */
+                    redirect_uri?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "verification_sent";
+                        ticket_id: string;
+                        verification_mode: "new_only" | "old_and_new";
+                    };
+                };
+            };
+        };
+    };
+    user_change_email_verify: {
+        parameters: {
+            query: {
+                ticket: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    "user/verifyEmailStart": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Optional payload for `POST /user/:user_id/verify-email/start`. Trigger a verification email send for the given user. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Where to send the user after they click the link. The status of the operation is appended as `?status=verified|already_verified|invalid_link|expired` so the calling app can render the right screen. When omitted, the user lands on the auth host's `/flow/verify-email-done` fallback. */
+                    redirect_uri?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        status: "verification_sent" | "already_verified";
+                        ticket_id?: string;
+                    };
+                };
+            };
+        };
+    };
+    user_verify_email_confirm: {
         parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                user_id: string;
+            query: {
+                ticket: string;
             };
+            header?: never;
+            path?: never;
             cookie?: never;
         };
         requestBody?: never;
@@ -3963,6 +4802,8 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
+                /** @description Full-text search across: `name`, `description`. */
+                q?: string;
             };
             header?: never;
             path?: never;
@@ -4091,6 +4932,61 @@ export interface operations {
             };
         };
     };
+    "role/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                role_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Partial update for a Role. Only the supplied fields are modified. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description New human-readable identifier for the role. */
+                    name?: string;
+                    /** @description New free-form description of what users in this role do. */
+                    description?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Role */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Role ID */
+                        id: string;
+                        /**
+                         * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
+                         * @example admin
+                         */
+                        name: string;
+                        /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
+                        description: string;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description RoleMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Role creation date */
+                        createdAt: string;
+                        /** @description Role updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
     "role/remove": {
         parameters: {
             query?: never;
@@ -4343,6 +5239,8 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
+                /** @description Full-text search across: `name`, `slug`. */
+                q?: string;
             };
             header?: never;
             path?: never;
@@ -4485,6 +5383,72 @@ export interface operations {
             };
         };
     };
+    "team/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                team_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Partial update for a Team. Only the supplied fields are modified. `slug` is auto-derived from `name` and is not user-editable. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description New human-readable name for the team. */
+                    name?: string;
+                    /** @description New free-form description for the team. */
+                    description?: string;
+                    /** @description Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely. */
+                    metadata?: {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description Team */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Team ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the team. Shown in the dashboard and in team-picker UI.
+                         * @example Acme Engineering
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.
+                         * @example acme-engineering
+                         */
+                        slug: string;
+                        /** @description Optional free-form description of the team. */
+                        description: string | null;
+                        /** @description Optional URL of an image used as the team avatar/logo. */
+                        logo_url: string | null;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description TeamMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Team creation date */
+                        createdAt: string;
+                        /** @description Team updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
     "team/remove": {
         parameters: {
             query?: never;
@@ -4559,6 +5523,14 @@ export interface operations {
                      *     ]
                      */
                     users: string[];
+                    /**
+                     * @description Role ids to grant to the added members within the scope of this team.
+                     * @default []
+                     * @example [
+                     *       "role_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
+                    roles?: string[];
                 };
             };
         };
@@ -4672,6 +5644,8 @@ export interface operations {
                 next?: string;
                 /** @description Size of the results array */
                 pageSize?: number;
+                /** @description Expand id-only fields in the response. Accepts repeated params (`expand=user&expand=roles`) or comma-separated (`expand=user,roles`). */
+                expand?: ("user" | "team" | "roles")[];
             };
             header?: never;
             path: {
@@ -4717,6 +5691,14 @@ export interface operations {
                      *     ]
                      */
                     users: string[];
+                    /**
+                     * @description Role ids to grant to the added members within the scope of this team.
+                     * @default []
+                     * @example [
+                     *       "role_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
+                    roles?: string[];
                 };
             };
         };
@@ -4806,6 +5788,182 @@ export interface operations {
             };
         };
     };
+    "team/listInvites": {
+        parameters: {
+            query?: {
+                /** @description FaableQL filter. Supported fields: `email`. Example: `?query=email:foo@bar.com` */
+                query?: string;
+            };
+            header?: never;
+            path: {
+                team_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: {
+                            /** @description TeamInvite ID */
+                            id: string;
+                            /** @description Email address that was invited */
+                            email: string;
+                            /** @description Team the invitee will be added to upon acceptance. */
+                            team: components["schemas"]["Team"] | string | unknown;
+                            /** @description User that created the invitation, if known. */
+                            inviter?: components["schemas"]["User"] | string | unknown;
+                            /** @description Role ids that will be applied to the new TeamMember on acceptance. */
+                            roles: string[];
+                            /** @description `auto` adds the user directly if they already exist in the tenant and only falls back to a ticketed invite when the email is unknown. `invite` always issues a ticket + email regardless of whether the user exists. */
+                            mode: "auto" | "invite";
+                            /** @description URI to redirect the invitee to after a successful accept. */
+                            redirect_uri?: string;
+                            /** @description ISO 8601 timestamp at which the invite stops being valid. */
+                            expires_at: string;
+                            /** @description ISO 8601 timestamp at which the invite was accepted. Absent for pending invites. */
+                            consume_date?: string;
+                            /** @description Object is related with this account */
+                            account: string;
+                            /**
+                             * @description TeamInviteMetadata
+                             * @default {}
+                             */
+                            metadata: {
+                                [key: string]: unknown;
+                            };
+                            /** @description TeamInvite creation date */
+                            createdAt: string;
+                            /** @description TeamInvite updated date */
+                            updatedAt?: string;
+                        }[];
+                    };
+                };
+            };
+        };
+    };
+    "team/invite": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                team_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Payload for inviting a user to a team by email. `mode='auto'` (default) adds the user immediately if they already exist in the tenant and falls back to a ticketed invite otherwise. `mode='invite'` always issues a ticket + email. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Email of the user to invite to the team.
+                     * @example someone@example.com
+                     */
+                    email: string;
+                    /**
+                     * @description Role ids granted to the resulting TeamMember within the scope of this team.
+                     * @default []
+                     */
+                    roles?: string[];
+                    /** @description `auto` adds the user directly if they already exist in the tenant and only falls back to a ticketed invite when the email is unknown. `invite` always issues a ticket + email regardless of whether the user exists. */
+                    mode?: "auto" | "invite";
+                    /** @description Where to redirect the invitee after a successful accept. Defaults to `/`. */
+                    redirect_uri?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description `invited` when a ticket + email was issued, `added` when the user was added directly (auto mode + existing user). */
+                        status: "invited" | "added";
+                        /** @description ID of the issued invite ticket (when status=invited). */
+                        ticket_id?: string;
+                        /** @description TeamMember */
+                        member?: {
+                            /** @description TeamMember ID */
+                            id: string;
+                            /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
+                            user: components["schemas"]["User"] | string | unknown;
+                            /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
+                            team: components["schemas"]["Team"] | string | unknown;
+                            /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
+                            roles: (components["schemas"]["Role"] | string | unknown)[];
+                            /** @description Object is related with this account */
+                            account: string;
+                            /**
+                             * @description TeamMemberMetadata
+                             * @default {}
+                             */
+                            metadata: {
+                                [key: string]: unknown;
+                            };
+                            /** @description TeamMember creation date */
+                            createdAt: string;
+                            /** @description TeamMember updated date */
+                            updatedAt?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "team/revokeInvite": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                team_id: string;
+                ticket_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "revoked";
+                    };
+                };
+            };
+        };
+    };
+    team_invite_verify: {
+        parameters: {
+            query: {
+                ticket: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     "api/list": {
         parameters: {
             query?: {
@@ -4817,6 +5975,8 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
+                /** @description Full-text search across: `name`, `description`, `identifier`, `slug`. */
+                q?: string;
             };
             header?: never;
             path?: never;
@@ -5731,6 +6891,10 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "client" | "connection" | "team" | "identity")[];
+                /** @description Full-text search across: `message`. */
+                q?: string;
             };
             header?: never;
             path?: never;
@@ -5756,7 +6920,10 @@ export interface operations {
     };
     "log/get": {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "client" | "connection" | "team" | "identity")[];
+            };
             header?: never;
             path: {
                 log_id: string;
@@ -5782,6 +6949,17 @@ export interface operations {
                         message?: string;
                         /** @description Type-specific structured payload */
                         data?: unknown;
+                        user?: components["schemas"]["User"] | string | unknown;
+                        client?: components["schemas"]["Client"] | string | unknown;
+                        connection?: components["schemas"]["Connection"] | string | unknown;
+                        team?: components["schemas"]["Team"] | string | unknown;
+                        identity?: components["schemas"]["Identity"] | string | unknown;
+                        ticket?: string;
+                        /**
+                         * Format: date-time
+                         * @description When this log row will be auto-deleted by the Mongo TTL monitor. Absent on rows recorded without `ttl_seconds`.
+                         */
+                        expires_at?: string;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -5831,6 +7009,8 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
+                /** @description Full-text search across: `domain`. */
+                q?: string;
             };
             header?: never;
             path?: never;
@@ -6073,10 +7253,20 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
+                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
+                        email_verified_at?: string | null;
+                        /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+                        email_change_locked_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
+                        phone_verified_at?: string | null;
                         /** @description country iso code */
                         country_iso?: string | null;
                         /** @description user birth_date */