@faable/auth-sdk 2.6.14 → 2.6.16

package/dist/api/types.d.ts

@@ -128,6 +128,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/recovery-channels/capabilities": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Recovery channel capabilities for this tenant
+         * @description Which recovery channels the platform can send, whether the plan allows the paid ones, this month's SMS usage against the included amount, and the tenant configuration as resolved. Drives the "Recovery channels" editor in the dashboard.
+         */
+        get: operations["account/recoveryChannelsCapabilities"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/connection": {
         parameters: {
             query?: never;
@@ -504,6 +524,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/user/{user_id}/verify-phone/start": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Send a verification code to the user's phone
+         * @description Sends a 6-digit code by SMS to the user's phone (optionally setting a new phone first) and returns an opaque `state` to confirm it with. Same authorization as `verify-email/start`: the user themself (session or bearer), an admin of another tenant, or a machine token. Counts against the tenant's monthly SMS allowance. Fails with 409 `sms_unavailable` when no SMS can go out (no provider, plan does not allow it, allowance exhausted).
+         */
+        post: operations["user/verifyPhoneStart"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/verify-phone/confirm": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Confirm a phone verification code
+         * @description Marks the phone verified (`phone_verified_method: sms_otp`) when the code matches the pending verification identified by `state`. Five wrong codes burn the `state`; start again. No session needed: the `state` plus the code are the proof.
+         */
+        post: operations["user/verifyPhoneConfirm"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/user/{user_id}/factors": {
         parameters: {
             query?: never;
@@ -2851,6 +2911,17 @@ export interface components {
                 /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                 remember_device_days?: number;
             };
+            /** @description Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`. */
+            recovery_channels?: {
+                /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                default?: "email" | "sms" | "whatsapp" | "factor";
+                /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+            };
+            /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
+            default_country_iso?: string | null;
             /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
             webauthn_rp_id?: string | null;
             /** @description AuthAccount creation date */
@@ -3141,6 +3212,15 @@ export interface components {
                 /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                 remember_device_days?: number;
             };
+            /** @description Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`. */
+            recovery_channels?: {
+                /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                default?: "email" | "sms" | "whatsapp" | "factor";
+                /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+            };
             /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
             login_flow?: string | null;
             /** @description Object is related with this account */
@@ -3245,6 +3325,14 @@ export interface components {
                 /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                 remember_device_days?: number;
             } | null;
+            recovery_channels?: {
+                /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                default?: "email" | "sms" | "whatsapp" | "factor";
+                /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+            } | null;
             login_flow?: string | null;
             /**
              * @description Free-form client metadata. Replaces the whole object — send the full merged value, not a partial delta.
@@ -3285,7 +3373,7 @@ export interface components {
              */
             email_verified: boolean;
             /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
-            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
             /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
             email_verified_at?: string | null;
             /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -3304,8 +3392,8 @@ export interface components {
             phone?: string | null;
             /** @description phone is verified */
             phone_verified: boolean;
-            /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
-            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+            /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
+            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
             /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
             phone_verified_at?: string | null;
             /** @description country iso code */
@@ -4694,6 +4782,15 @@ export interface components {
                 /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                 remember_device_days?: number;
             } | null;
+            recovery_channels?: {
+                /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                default?: "email" | "sms" | "whatsapp" | "factor";
+                /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+            } | null;
+            default_country_iso?: string | null;
             webauthn_rp_id?: string | null;
             login_flow?: string | null;
         };
@@ -4890,6 +4987,17 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`. */
+                        recovery_channels?: {
+                            /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                            enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                            /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                            default?: "email" | "sms" | "whatsapp" | "factor";
+                            /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                            visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+                        };
+                        /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
+                        default_country_iso?: string | null;
                         /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
                         webauthn_rp_id?: string | null;
                         /** @description AuthAccount creation date */
@@ -5060,6 +5168,17 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`. */
+                        recovery_channels?: {
+                            /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                            enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                            /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                            default?: "email" | "sms" | "whatsapp" | "factor";
+                            /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                            visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+                        };
+                        /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
+                        default_country_iso?: string | null;
                         /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
                         webauthn_rp_id?: string | null;
                         /** @description AuthAccount creation date */
@@ -5184,6 +5303,17 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`. */
+                        recovery_channels?: {
+                            /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                            enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                            /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                            default?: "email" | "sms" | "whatsapp" | "factor";
+                            /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                            visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+                        };
+                        /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
+                        default_country_iso?: string | null;
                         /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
                         webauthn_rp_id?: string | null;
                         /** @description AuthAccount creation date */
@@ -5274,6 +5404,15 @@ export interface operations {
                         /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                         remember_device_days?: number;
                     } | null;
+                    recovery_channels?: {
+                        /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                        enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                        /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                        default?: "email" | "sms" | "whatsapp" | "factor";
+                        /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                        visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+                    } | null;
+                    default_country_iso?: string | null;
                     webauthn_rp_id?: string | null;
                     login_flow?: string | null;
                 };
@@ -5379,6 +5518,17 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`. */
+                        recovery_channels?: {
+                            /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                            enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                            /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                            default?: "email" | "sms" | "whatsapp" | "factor";
+                            /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                            visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+                        };
+                        /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
+                        default_country_iso?: string | null;
                         /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
                         webauthn_rp_id?: string | null;
                         /** @description AuthAccount creation date */
@@ -5512,6 +5662,17 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`. */
+                        recovery_channels?: {
+                            /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                            enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                            /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                            default?: "email" | "sms" | "whatsapp" | "factor";
+                            /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                            visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+                        };
+                        /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
+                        default_country_iso?: string | null;
                         /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
                         webauthn_rp_id?: string | null;
                         /** @description AuthAccount creation date */
@@ -5523,6 +5684,57 @@ export interface operations {
             };
         };
     };
+    "account/recoveryChannelsCapabilities": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Whether the platform can send on each channel right now. */
+                        provider: {
+                            sms: boolean;
+                            whatsapp: boolean;
+                        };
+                        plan: {
+                            /** @description False when billing did not answer. Messaging channels are then treated as not allowed — the failure mode for a paid-per-message channel is "do not send", not "allow". */
+                            known: boolean;
+                            tier?: string;
+                            allows_messaging: boolean;
+                        };
+                        usage: {
+                            /** @description YYYY-MM, UTC. */
+                            month: string;
+                            sent: number;
+                            included: number;
+                            metered: boolean;
+                            hard_ceiling: number;
+                        };
+                        resolved: {
+                            enabled: ("email" | "sms" | "whatsapp" | "factor")[];
+                            default: "email" | "sms" | "whatsapp" | "factor";
+                            visible: ("email" | "sms" | "whatsapp" | "factor")[];
+                        };
+                        /** @description Tenant-level availability (configuration × platform × plan). The per-user step — verified phone, enrolled factor — is not applied here. */
+                        channels: {
+                            channel: "email" | "sms" | "whatsapp" | "factor";
+                            available: boolean;
+                            reason?: string;
+                        }[];
+                    };
+                };
+            };
+        };
+    };
     "connection/list": {
         parameters: {
             query?: {
@@ -6222,6 +6434,15 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`. */
+                        recovery_channels?: {
+                            /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                            enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                            /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                            default?: "email" | "sms" | "whatsapp" | "factor";
+                            /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                            visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+                        };
                         /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
                         login_flow?: string | null;
                         /** @description Object is related with this account */
@@ -6325,6 +6546,15 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`. */
+                        recovery_channels?: {
+                            /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                            enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                            /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                            default?: "email" | "sms" | "whatsapp" | "factor";
+                            /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                            visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+                        };
                         /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
                         login_flow?: string | null;
                         /** @description Object is related with this account */
@@ -6421,6 +6651,14 @@ export interface operations {
                         /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                         remember_device_days?: number;
                     } | null;
+                    recovery_channels?: {
+                        /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                        enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                        /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                        default?: "email" | "sms" | "whatsapp" | "factor";
+                        /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                        visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+                    } | null;
                     login_flow?: string | null;
                     /**
                      * @description Free-form client metadata. Replaces the whole object — send the full merged value, not a partial delta.
@@ -6505,6 +6743,15 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`. */
+                        recovery_channels?: {
+                            /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                            enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                            /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                            default?: "email" | "sms" | "whatsapp" | "factor";
+                            /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                            visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+                        };
                         /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
                         login_flow?: string | null;
                         /** @description Object is related with this account */
@@ -6608,6 +6855,15 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`. */
+                        recovery_channels?: {
+                            /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                            enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                            /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                            default?: "email" | "sms" | "whatsapp" | "factor";
+                            /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                            visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+                        };
                         /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
                         login_flow?: string | null;
                         /** @description Object is related with this account */
@@ -6711,6 +6967,15 @@ export interface operations {
                             /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
                             remember_device_days?: number;
                         };
+                        /** @description Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`. */
+                        recovery_channels?: {
+                            /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                            enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                            /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                            default?: "email" | "sms" | "whatsapp" | "factor";
+                            /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                            visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+                        };
                         /** @description A login flow bound to this client (`loginflow_xxx`), overriding the account's. Absent = inherit. */
                         login_flow?: string | null;
                         /** @description Object is related with this account */
@@ -6849,7 +7114,7 @@ export interface operations {
                          */
                         email_verified: boolean;
                         /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
-                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
                         email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -6868,8 +7133,8 @@ export interface operations {
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
-                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
-                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
                         phone_verified_at?: string | null;
                         /** @description country iso code */
@@ -6989,7 +7254,7 @@ export interface operations {
                          */
                         email_verified: boolean;
                         /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
-                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
                         email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -7008,8 +7273,8 @@ export interface operations {
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
-                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
-                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
                         phone_verified_at?: string | null;
                         /** @description country iso code */
@@ -7169,7 +7434,7 @@ export interface operations {
                          */
                         email_verified: boolean;
                         /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
-                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
                         email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -7188,8 +7453,8 @@ export interface operations {
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
-                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
-                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
                         phone_verified_at?: string | null;
                         /** @description country iso code */
@@ -7309,7 +7574,7 @@ export interface operations {
                          */
                         email_verified: boolean;
                         /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
-                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
                         email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -7328,8 +7593,8 @@ export interface operations {
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
-                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
-                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
                         phone_verified_at?: string | null;
                         /** @description country iso code */
@@ -7615,6 +7880,73 @@ export interface operations {
             };
         };
     };
+    "user/verifyPhoneStart": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Phone to verify. When given, it replaces the user's phone (normalised to E.164 with the account's `default_country_iso` as fallback) before the code is sent. When omitted, the code goes to the phone already on the user. */
+                    phone?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "sent";
+                        destination_masked: string;
+                        /** @description Opaque handle to confirm with. It is what lets a tenant backend start the verification (M2M) and send the person to `/flow/verify-phone?state=…` without a session. */
+                        state: string;
+                        expires_in: number;
+                    };
+                };
+            };
+        };
+    };
+    "user/verifyPhoneConfirm": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    state: string;
+                    code: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "verified";
+                        user_id: string;
+                    };
+                };
+            };
+        };
+    };
     "user/factors": {
         parameters: {
             query?: never;
@@ -12182,7 +12514,7 @@ export interface operations {
                          */
                         email_verified: boolean;
                         /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
-                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
                         email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -12201,8 +12533,8 @@ export interface operations {
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
-                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
-                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
                         phone_verified_at?: string | null;
                         /** @description country iso code */