@faable/auth-sdk 2.6.15 → 2.6.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/dist/FaableAuthApi.d.ts +13 -12
  2. package/dist/api/generated-client.d.ts +21 -14
  3. package/dist/api/types.d.ts +139 -18
  4. package/dist/version.js +2 -2
  5. package/package.json +1 -1
  6. package/spec/openapi.json +280 -7
package/dist/FaableAuthApi.d.ts CHANGED
@@ -79,6 +79,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
79
79
  default?: "email" | "sms" | "whatsapp" | "factor" | undefined;
80
80
  visible?: ("email" | "sms" | "whatsapp" | "factor")[] | undefined;
81
81
  } | undefined;
82
+ default_country_iso?: string | null | undefined;
82
83
  webauthn_rp_id?: string | null | undefined;
83
84
  createdAt: string;
84
85
  updatedAt?: string | undefined;
@@ -95,7 +96,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
95
96
  nickname?: string | null | undefined;
96
97
  email?: string | null | undefined;
97
98
  email_verified: boolean;
98
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
99
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
99
100
  email_verified_at?: string | null | undefined;
100
101
  email_change_locked_at?: string | null | undefined;
101
102
  email_bounced_at?: string | null | undefined;
@@ -105,7 +106,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
105
106
  passkey_prompt_dismissed_at?: string | null | undefined;
106
107
  phone?: string | null | undefined;
107
108
  phone_verified: boolean;
108
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
109
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
109
110
  phone_verified_at?: string | null | undefined;
110
111
  country_iso?: string | null | undefined;
111
112
  birth_date?: string | null | undefined;
@@ -153,7 +154,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
153
154
  nickname?: string | null | undefined;
154
155
  email?: string | null | undefined;
155
156
  email_verified: boolean;
156
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
157
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
157
158
  email_verified_at?: string | null | undefined;
158
159
  email_change_locked_at?: string | null | undefined;
159
160
  email_bounced_at?: string | null | undefined;
@@ -163,7 +164,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
163
164
  passkey_prompt_dismissed_at?: string | null | undefined;
164
165
  phone?: string | null | undefined;
165
166
  phone_verified: boolean;
166
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
167
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
167
168
  phone_verified_at?: string | null | undefined;
168
169
  country_iso?: string | null | undefined;
169
170
  birth_date?: string | null | undefined;
@@ -214,7 +215,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
214
215
  nickname?: string | null | undefined;
215
216
  email?: string | null | undefined;
216
217
  email_verified: boolean;
217
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
218
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
218
219
  email_verified_at?: string | null | undefined;
219
220
  email_change_locked_at?: string | null | undefined;
220
221
  email_bounced_at?: string | null | undefined;
@@ -224,7 +225,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
224
225
  passkey_prompt_dismissed_at?: string | null | undefined;
225
226
  phone?: string | null | undefined;
226
227
  phone_verified: boolean;
227
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
228
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
228
229
  phone_verified_at?: string | null | undefined;
229
230
  country_iso?: string | null | undefined;
230
231
  birth_date?: string | null | undefined;
@@ -274,7 +275,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
274
275
  nickname?: string | null | undefined;
275
276
  email?: string | null | undefined;
276
277
  email_verified: boolean;
277
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
278
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
278
279
  email_verified_at?: string | null | undefined;
279
280
  email_change_locked_at?: string | null | undefined;
280
281
  email_bounced_at?: string | null | undefined;
@@ -284,7 +285,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
284
285
  passkey_prompt_dismissed_at?: string | null | undefined;
285
286
  phone?: string | null | undefined;
286
287
  phone_verified: boolean;
287
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
288
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
288
289
  phone_verified_at?: string | null | undefined;
289
290
  country_iso?: string | null | undefined;
290
291
  birth_date?: string | null | undefined;
@@ -333,7 +334,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
333
334
  nickname?: string | null | undefined;
334
335
  email?: string | null | undefined;
335
336
  email_verified: boolean;
336
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
337
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
337
338
  email_verified_at?: string | null | undefined;
338
339
  email_change_locked_at?: string | null | undefined;
339
340
  email_bounced_at?: string | null | undefined;
@@ -343,7 +344,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
343
344
  passkey_prompt_dismissed_at?: string | null | undefined;
344
345
  phone?: string | null | undefined;
345
346
  phone_verified: boolean;
346
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
347
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
347
348
  phone_verified_at?: string | null | undefined;
348
349
  country_iso?: string | null | undefined;
349
350
  birth_date?: string | null | undefined;
@@ -392,7 +393,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
392
393
  nickname?: string | null | undefined;
393
394
  email?: string | null | undefined;
394
395
  email_verified: boolean;
395
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
396
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
396
397
  email_verified_at?: string | null | undefined;
397
398
  email_change_locked_at?: string | null | undefined;
398
399
  email_bounced_at?: string | null | undefined;
@@ -402,7 +403,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
402
403
  passkey_prompt_dismissed_at?: string | null | undefined;
403
404
  phone?: string | null | undefined;
404
405
  phone_verified: boolean;
405
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
406
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
406
407
  phone_verified_at?: string | null | undefined;
407
408
  country_iso?: string | null | undefined;
408
409
  birth_date?: string | null | undefined;
package/dist/api/generated-client.d.ts CHANGED
@@ -75,6 +75,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
75
75
  default?: "email" | "sms" | "whatsapp" | "factor" | undefined;
76
76
  visible?: ("email" | "sms" | "whatsapp" | "factor")[] | undefined;
77
77
  } | undefined;
78
+ default_country_iso?: string | null | undefined;
78
79
  webauthn_rp_id?: string | null | undefined;
79
80
  createdAt: string;
80
81
  updatedAt?: string | undefined;
@@ -136,6 +137,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
136
137
  default?: "email" | "sms" | "whatsapp" | "factor" | undefined;
137
138
  visible?: ("email" | "sms" | "whatsapp" | "factor")[] | undefined;
138
139
  } | undefined;
140
+ default_country_iso?: string | null | undefined;
139
141
  webauthn_rp_id?: string | null | undefined;
140
142
  createdAt: string;
141
143
  updatedAt?: string | undefined;
@@ -203,6 +205,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
203
205
  default?: "email" | "sms" | "whatsapp" | "factor" | undefined;
204
206
  visible?: ("email" | "sms" | "whatsapp" | "factor")[] | undefined;
205
207
  } | undefined;
208
+ default_country_iso?: string | null | undefined;
206
209
  webauthn_rp_id?: string | null | undefined;
207
210
  createdAt: string;
208
211
  updatedAt?: string | undefined;
@@ -275,6 +278,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
275
278
  default?: "email" | "sms" | "whatsapp" | "factor" | undefined;
276
279
  visible?: ("email" | "sms" | "whatsapp" | "factor")[] | undefined;
277
280
  } | undefined;
281
+ default_country_iso?: string | null | undefined;
278
282
  webauthn_rp_id?: string | null | undefined;
279
283
  createdAt: string;
280
284
  updatedAt?: string | undefined;
@@ -331,6 +335,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
331
335
  default?: "email" | "sms" | "whatsapp" | "factor" | undefined;
332
336
  visible?: ("email" | "sms" | "whatsapp" | "factor")[] | undefined;
333
337
  } | undefined;
338
+ default_country_iso?: string | null | undefined;
334
339
  webauthn_rp_id?: string | null | undefined;
335
340
  createdAt: string;
336
341
  updatedAt?: string | undefined;
@@ -390,6 +395,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
390
395
  default?: "email" | "sms" | "whatsapp" | "factor" | undefined;
391
396
  visible?: ("email" | "sms" | "whatsapp" | "factor")[] | undefined;
392
397
  } | undefined;
398
+ default_country_iso?: string | null | undefined;
393
399
  webauthn_rp_id?: string | null | undefined;
394
400
  createdAt: string;
395
401
  updatedAt?: string | undefined;
@@ -531,6 +537,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
531
537
  default?: "email" | "sms" | "whatsapp" | "factor" | undefined;
532
538
  visible?: ("email" | "sms" | "whatsapp" | "factor")[] | undefined;
533
539
  } | undefined;
540
+ default_country_iso?: string | null | undefined;
534
541
  webauthn_rp_id?: string | null | undefined;
535
542
  createdAt: string;
536
543
  updatedAt?: string | undefined;
@@ -3906,7 +3913,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
3906
3913
  nickname?: string | null | undefined;
3907
3914
  email?: string | null | undefined;
3908
3915
  email_verified: boolean;
3909
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
3916
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
3910
3917
  email_verified_at?: string | null | undefined;
3911
3918
  email_change_locked_at?: string | null | undefined;
3912
3919
  email_bounced_at?: string | null | undefined;
@@ -3916,7 +3923,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
3916
3923
  passkey_prompt_dismissed_at?: string | null | undefined;
3917
3924
  phone?: string | null | undefined;
3918
3925
  phone_verified: boolean;
3919
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
3926
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
3920
3927
  phone_verified_at?: string | null | undefined;
3921
3928
  country_iso?: string | null | undefined;
3922
3929
  birth_date?: string | null | undefined;
@@ -3969,7 +3976,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
3969
3976
  nickname?: string | null | undefined;
3970
3977
  email?: string | null | undefined;
3971
3978
  email_verified: boolean;
3972
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
3979
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
3973
3980
  email_verified_at?: string | null | undefined;
3974
3981
  email_change_locked_at?: string | null | undefined;
3975
3982
  email_bounced_at?: string | null | undefined;
@@ -3979,7 +3986,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
3979
3986
  passkey_prompt_dismissed_at?: string | null | undefined;
3980
3987
  phone?: string | null | undefined;
3981
3988
  phone_verified: boolean;
3982
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
3989
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
3983
3990
  phone_verified_at?: string | null | undefined;
3984
3991
  country_iso?: string | null | undefined;
3985
3992
  birth_date?: string | null | undefined;
@@ -4032,7 +4039,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
4032
4039
  nickname?: string | null | undefined;
4033
4040
  email?: string | null | undefined;
4034
4041
  email_verified: boolean;
4035
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
4042
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
4036
4043
  email_verified_at?: string | null | undefined;
4037
4044
  email_change_locked_at?: string | null | undefined;
4038
4045
  email_bounced_at?: string | null | undefined;
@@ -4042,7 +4049,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
4042
4049
  passkey_prompt_dismissed_at?: string | null | undefined;
4043
4050
  phone?: string | null | undefined;
4044
4051
  phone_verified: boolean;
4045
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
4052
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
4046
4053
  phone_verified_at?: string | null | undefined;
4047
4054
  country_iso?: string | null | undefined;
4048
4055
  birth_date?: string | null | undefined;
@@ -4096,7 +4103,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
4096
4103
  nickname?: string | null | undefined;
4097
4104
  email?: string | null | undefined;
4098
4105
  email_verified: boolean;
4099
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
4106
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
4100
4107
  email_verified_at?: string | null | undefined;
4101
4108
  email_change_locked_at?: string | null | undefined;
4102
4109
  email_bounced_at?: string | null | undefined;
@@ -4106,7 +4113,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
4106
4113
  passkey_prompt_dismissed_at?: string | null | undefined;
4107
4114
  phone?: string | null | undefined;
4108
4115
  phone_verified: boolean;
4109
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
4116
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
4110
4117
  phone_verified_at?: string | null | undefined;
4111
4118
  country_iso?: string | null | undefined;
4112
4119
  birth_date?: string | null | undefined;
@@ -4154,7 +4161,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
4154
4161
  nickname?: string | null | undefined;
4155
4162
  email?: string | null | undefined;
4156
4163
  email_verified: boolean;
4157
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
4164
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
4158
4165
  email_verified_at?: string | null | undefined;
4159
4166
  email_change_locked_at?: string | null | undefined;
4160
4167
  email_bounced_at?: string | null | undefined;
@@ -4164,7 +4171,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
4164
4171
  passkey_prompt_dismissed_at?: string | null | undefined;
4165
4172
  phone?: string | null | undefined;
4166
4173
  phone_verified: boolean;
4167
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
4174
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
4168
4175
  phone_verified_at?: string | null | undefined;
4169
4176
  country_iso?: string | null | undefined;
4170
4177
  birth_date?: string | null | undefined;
@@ -4215,7 +4222,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
4215
4222
  nickname?: string | null | undefined;
4216
4223
  email?: string | null | undefined;
4217
4224
  email_verified: boolean;
4218
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
4225
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
4219
4226
  email_verified_at?: string | null | undefined;
4220
4227
  email_change_locked_at?: string | null | undefined;
4221
4228
  email_bounced_at?: string | null | undefined;
@@ -4225,7 +4232,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
4225
4232
  passkey_prompt_dismissed_at?: string | null | undefined;
4226
4233
  phone?: string | null | undefined;
4227
4234
  phone_verified: boolean;
4228
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
4235
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
4229
4236
  phone_verified_at?: string | null | undefined;
4230
4237
  country_iso?: string | null | undefined;
4231
4238
  birth_date?: string | null | undefined;
@@ -4315,7 +4322,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
4315
4322
  nickname?: string | null | undefined;
4316
4323
  email?: string | null | undefined;
4317
4324
  email_verified: boolean;
4318
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
4325
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
4319
4326
  email_verified_at?: string | null | undefined;
4320
4327
  email_change_locked_at?: string | null | undefined;
4321
4328
  email_bounced_at?: string | null | undefined;
@@ -4325,7 +4332,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
4325
4332
  passkey_prompt_dismissed_at?: string | null | undefined;
4326
4333
  phone?: string | null | undefined;
4327
4334
  phone_verified: boolean;
4328
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null | undefined;
4335
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
4329
4336
  phone_verified_at?: string | null | undefined;
4330
4337
  country_iso?: string | null | undefined;
4331
4338
  birth_date?: string | null | undefined;
package/dist/api/types.d.ts CHANGED
@@ -524,6 +524,46 @@ export interface paths {
524
524
  patch?: never;
525
525
  trace?: never;
526
526
  };
527
+ "/user/{user_id}/verify-phone/start": {
528
+ parameters: {
529
+ query?: never;
530
+ header?: never;
531
+ path?: never;
532
+ cookie?: never;
533
+ };
534
+ get?: never;
535
+ put?: never;
536
+ /**
537
+ * Send a verification code to the user's phone
538
+ * @description Sends a 6-digit code by SMS to the user's phone (optionally setting a new phone first) and returns an opaque `state` to confirm it with. Same authorization as `verify-email/start`: the user themself (session or bearer), an admin of another tenant, or a machine token. Counts against the tenant's monthly SMS allowance. Fails with 409 `sms_unavailable` when no SMS can go out (no provider, plan does not allow it, allowance exhausted).
539
+ */
540
+ post: operations["user/verifyPhoneStart"];
541
+ delete?: never;
542
+ options?: never;
543
+ head?: never;
544
+ patch?: never;
545
+ trace?: never;
546
+ };
547
+ "/verify-phone/confirm": {
548
+ parameters: {
549
+ query?: never;
550
+ header?: never;
551
+ path?: never;
552
+ cookie?: never;
553
+ };
554
+ get?: never;
555
+ put?: never;
556
+ /**
557
+ * Confirm a phone verification code
558
+ * @description Marks the phone verified (`phone_verified_method: sms_otp`) when the code matches the pending verification identified by `state`. Five wrong codes burn the `state`; start again. No session needed: the `state` plus the code are the proof.
559
+ */
560
+ post: operations["user/verifyPhoneConfirm"];
561
+ delete?: never;
562
+ options?: never;
563
+ head?: never;
564
+ patch?: never;
565
+ trace?: never;
566
+ };
527
567
  "/user/{user_id}/factors": {
528
568
  parameters: {
529
569
  query?: never;
@@ -2880,6 +2920,8 @@ export interface components {
2880
2920
  /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
2881
2921
  visible?: ("email" | "sms" | "whatsapp" | "factor")[];
2882
2922
  };
2923
+ /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
2924
+ default_country_iso?: string | null;
2883
2925
  /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
2884
2926
  webauthn_rp_id?: string | null;
2885
2927
  /** @description AuthAccount creation date */
@@ -3331,7 +3373,7 @@ export interface components {
3331
3373
  */
3332
3374
  email_verified: boolean;
3333
3375
  /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
3334
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
3376
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
3335
3377
  /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
3336
3378
  email_verified_at?: string | null;
3337
3379
  /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -3350,8 +3392,8 @@ export interface components {
3350
3392
  phone?: string | null;
3351
3393
  /** @description phone is verified */
3352
3394
  phone_verified: boolean;
3353
- /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
3354
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
3395
+ /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
3396
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
3355
3397
  /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
3356
3398
  phone_verified_at?: string | null;
3357
3399
  /** @description country iso code */
@@ -4748,6 +4790,7 @@ export interface components {
4748
4790
  /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
4749
4791
  visible?: ("email" | "sms" | "whatsapp" | "factor")[];
4750
4792
  } | null;
4793
+ default_country_iso?: string | null;
4751
4794
  webauthn_rp_id?: string | null;
4752
4795
  login_flow?: string | null;
4753
4796
  };
@@ -4953,6 +4996,8 @@ export interface operations {
4953
4996
  /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
4954
4997
  visible?: ("email" | "sms" | "whatsapp" | "factor")[];
4955
4998
  };
4999
+ /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
5000
+ default_country_iso?: string | null;
4956
5001
  /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
4957
5002
  webauthn_rp_id?: string | null;
4958
5003
  /** @description AuthAccount creation date */
@@ -5132,6 +5177,8 @@ export interface operations {
5132
5177
  /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
5133
5178
  visible?: ("email" | "sms" | "whatsapp" | "factor")[];
5134
5179
  };
5180
+ /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
5181
+ default_country_iso?: string | null;
5135
5182
  /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
5136
5183
  webauthn_rp_id?: string | null;
5137
5184
  /** @description AuthAccount creation date */
@@ -5265,6 +5312,8 @@ export interface operations {
5265
5312
  /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
5266
5313
  visible?: ("email" | "sms" | "whatsapp" | "factor")[];
5267
5314
  };
5315
+ /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
5316
+ default_country_iso?: string | null;
5268
5317
  /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
5269
5318
  webauthn_rp_id?: string | null;
5270
5319
  /** @description AuthAccount creation date */
@@ -5363,6 +5412,7 @@ export interface operations {
5363
5412
  /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
5364
5413
  visible?: ("email" | "sms" | "whatsapp" | "factor")[];
5365
5414
  } | null;
5415
+ default_country_iso?: string | null;
5366
5416
  webauthn_rp_id?: string | null;
5367
5417
  login_flow?: string | null;
5368
5418
  };
@@ -5477,6 +5527,8 @@ export interface operations {
5477
5527
  /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
5478
5528
  visible?: ("email" | "sms" | "whatsapp" | "factor")[];
5479
5529
  };
5530
+ /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
5531
+ default_country_iso?: string | null;
5480
5532
  /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
5481
5533
  webauthn_rp_id?: string | null;
5482
5534
  /** @description AuthAccount creation date */
@@ -5619,6 +5671,8 @@ export interface operations {
5619
5671
  /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
5620
5672
  visible?: ("email" | "sms" | "whatsapp" | "factor")[];
5621
5673
  };
5674
+ /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
5675
+ default_country_iso?: string | null;
5622
5676
  /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
5623
5677
  webauthn_rp_id?: string | null;
5624
5678
  /** @description AuthAccount creation date */
@@ -7060,7 +7114,7 @@ export interface operations {
7060
7114
  */
7061
7115
  email_verified: boolean;
7062
7116
  /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
7063
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
7117
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
7064
7118
  /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
7065
7119
  email_verified_at?: string | null;
7066
7120
  /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -7079,8 +7133,8 @@ export interface operations {
7079
7133
  phone?: string | null;
7080
7134
  /** @description phone is verified */
7081
7135
  phone_verified: boolean;
7082
- /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
7083
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
7136
+ /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
7137
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
7084
7138
  /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
7085
7139
  phone_verified_at?: string | null;
7086
7140
  /** @description country iso code */
@@ -7200,7 +7254,7 @@ export interface operations {
7200
7254
  */
7201
7255
  email_verified: boolean;
7202
7256
  /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
7203
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
7257
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
7204
7258
  /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
7205
7259
  email_verified_at?: string | null;
7206
7260
  /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -7219,8 +7273,8 @@ export interface operations {
7219
7273
  phone?: string | null;
7220
7274
  /** @description phone is verified */
7221
7275
  phone_verified: boolean;
7222
- /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
7223
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
7276
+ /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
7277
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
7224
7278
  /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
7225
7279
  phone_verified_at?: string | null;
7226
7280
  /** @description country iso code */
@@ -7380,7 +7434,7 @@ export interface operations {
7380
7434
  */
7381
7435
  email_verified: boolean;
7382
7436
  /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
7383
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
7437
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
7384
7438
  /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
7385
7439
  email_verified_at?: string | null;
7386
7440
  /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -7399,8 +7453,8 @@ export interface operations {
7399
7453
  phone?: string | null;
7400
7454
  /** @description phone is verified */
7401
7455
  phone_verified: boolean;
7402
- /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
7403
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
7456
+ /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
7457
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
7404
7458
  /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
7405
7459
  phone_verified_at?: string | null;
7406
7460
  /** @description country iso code */
@@ -7520,7 +7574,7 @@ export interface operations {
7520
7574
  */
7521
7575
  email_verified: boolean;
7522
7576
  /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
7523
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
7577
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
7524
7578
  /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
7525
7579
  email_verified_at?: string | null;
7526
7580
  /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -7539,8 +7593,8 @@ export interface operations {
7539
7593
  phone?: string | null;
7540
7594
  /** @description phone is verified */
7541
7595
  phone_verified: boolean;
7542
- /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
7543
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
7596
+ /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
7597
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
7544
7598
  /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
7545
7599
  phone_verified_at?: string | null;
7546
7600
  /** @description country iso code */
@@ -7826,6 +7880,73 @@ export interface operations {
7826
7880
  };
7827
7881
  };
7828
7882
  };
7883
+ "user/verifyPhoneStart": {
7884
+ parameters: {
7885
+ query?: never;
7886
+ header?: never;
7887
+ path: {
7888
+ user_id: string;
7889
+ };
7890
+ cookie?: never;
7891
+ };
7892
+ requestBody: {
7893
+ content: {
7894
+ "application/json": {
7895
+ /** @description Phone to verify. When given, it replaces the user's phone (normalised to E.164 with the account's `default_country_iso` as fallback) before the code is sent. When omitted, the code goes to the phone already on the user. */
7896
+ phone?: string;
7897
+ };
7898
+ };
7899
+ };
7900
+ responses: {
7901
+ /** @description Default Response */
7902
+ 200: {
7903
+ headers: {
7904
+ [name: string]: unknown;
7905
+ };
7906
+ content: {
7907
+ "application/json": {
7908
+ /** @enum {string} */
7909
+ status: "sent";
7910
+ destination_masked: string;
7911
+ /** @description Opaque handle to confirm with. It is what lets a tenant backend start the verification (M2M) and send the person to `/flow/verify-phone?state=…` without a session. */
7912
+ state: string;
7913
+ expires_in: number;
7914
+ };
7915
+ };
7916
+ };
7917
+ };
7918
+ };
7919
+ "user/verifyPhoneConfirm": {
7920
+ parameters: {
7921
+ query?: never;
7922
+ header?: never;
7923
+ path?: never;
7924
+ cookie?: never;
7925
+ };
7926
+ requestBody: {
7927
+ content: {
7928
+ "application/json": {
7929
+ state: string;
7930
+ code: string;
7931
+ };
7932
+ };
7933
+ };
7934
+ responses: {
7935
+ /** @description Default Response */
7936
+ 200: {
7937
+ headers: {
7938
+ [name: string]: unknown;
7939
+ };
7940
+ content: {
7941
+ "application/json": {
7942
+ /** @enum {string} */
7943
+ status: "verified";
7944
+ user_id: string;
7945
+ };
7946
+ };
7947
+ };
7948
+ };
7949
+ };
7829
7950
  "user/factors": {
7830
7951
  parameters: {
7831
7952
  query?: never;
@@ -12393,7 +12514,7 @@ export interface operations {
12393
12514
  */
12394
12515
  email_verified: boolean;
12395
12516
  /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
12396
- email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
12517
+ email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
12397
12518
  /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
12398
12519
  email_verified_at?: string | null;
12399
12520
  /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -12412,8 +12533,8 @@ export interface operations {
12412
12533
  phone?: string | null;
12413
12534
  /** @description phone is verified */
12414
12535
  phone_verified: boolean;
12415
- /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
12416
- phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
12536
+ /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
12537
+ phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
12417
12538
  /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
12418
12539
  phone_verified_at?: string | null;
12419
12540
  /** @description country iso code */
package/dist/version.js CHANGED
@@ -9,13 +9,13 @@
9
9
  // login pages could not import the SDK at all. Same pattern as auth-js.
10
10
  //
11
11
  // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
12
- export const version = "2.6.15";
12
+ export const version = "2.6.16";
13
13
  // Short git SHA of the released commit. The version dates a build; this names
14
14
  // the exact tree, so a canonical log line or an audit entry leads straight to
15
15
  // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
16
16
  // link) cannot be mistaken for a real commit — auth only records values that
17
17
  // look like a SHA, and this one never will.
18
- export const commit = "1f0c0e0";
18
+ export const commit = "c04402e";
19
19
  // What this SDK writes in `x-faable-client`. Exported for a consumer that
20
20
  // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
21
21
  // token request attributed — a bare `authClientCredentials` stamps only what
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@faable/auth-sdk",
3
- "version": "2.6.15",
3
+ "version": "2.6.16",
4
4
  "author": "Marc Pomar <marc@faable.com>",
5
5
  "main": "dist/index.js",
6
6
  "types": "dist/index.d.ts",
package/spec/openapi.json CHANGED
@@ -3,7 +3,7 @@
3
3
  "info": {
4
4
  "title": "@faablecloud/auth",
5
5
  "description": "Auth Platform made by Faable. Manage Users and Roles",
6
- "version": "2.16.0",
6
+ "version": "2.17.0",
7
7
  "license": {
8
8
  "name": "private",
9
9
  "url": "https://faable.com/docs/platform/privacy-policy"
@@ -482,6 +482,13 @@
482
482
  "additionalProperties": false,
483
483
  "description": "Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`."
484
484
  },
485
+ "default_country_iso": {
486
+ "type": "string",
487
+ "minLength": 2,
488
+ "maxLength": 2,
489
+ "description": "ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix.",
490
+ "nullable": true
491
+ },
485
492
  "webauthn_rp_id": {
486
493
  "type": "string",
487
494
  "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
@@ -2237,6 +2244,12 @@
2237
2244
  "federated"
2238
2245
  ]
2239
2246
  },
2247
+ {
2248
+ "type": "string",
2249
+ "enum": [
2250
+ "sms_otp"
2251
+ ]
2252
+ },
2240
2253
  {
2241
2254
  "type": "null"
2242
2255
  }
@@ -2324,11 +2337,17 @@
2324
2337
  "federated"
2325
2338
  ]
2326
2339
  },
2340
+ {
2341
+ "type": "string",
2342
+ "enum": [
2343
+ "sms_otp"
2344
+ ]
2345
+ },
2327
2346
  {
2328
2347
  "type": "null"
2329
2348
  }
2330
2349
  ],
2331
- "description": "How `phone_verified` was last set. Same enum as `email_verified_method`."
2350
+ "description": "How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`)."
2332
2351
  },
2333
2352
  "phone_verified_at": {
2334
2353
  "type": "string",
@@ -6465,6 +6484,18 @@
6465
6484
  }
6466
6485
  ]
6467
6486
  },
6487
+ "default_country_iso": {
6488
+ "anyOf": [
6489
+ {
6490
+ "type": "string",
6491
+ "minLength": 2,
6492
+ "maxLength": 2
6493
+ },
6494
+ {
6495
+ "type": "null"
6496
+ }
6497
+ ]
6498
+ },
6468
6499
  "webauthn_rp_id": {
6469
6500
  "type": "string",
6470
6501
  "nullable": true
@@ -7262,6 +7293,13 @@
7262
7293
  "additionalProperties": false,
7263
7294
  "description": "Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`."
7264
7295
  },
7296
+ "default_country_iso": {
7297
+ "type": "string",
7298
+ "minLength": 2,
7299
+ "maxLength": 2,
7300
+ "description": "ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix.",
7301
+ "nullable": true
7302
+ },
7265
7303
  "webauthn_rp_id": {
7266
7304
  "type": "string",
7267
7305
  "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
@@ -7804,6 +7842,13 @@
7804
7842
  "additionalProperties": false,
7805
7843
  "description": "Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`."
7806
7844
  },
7845
+ "default_country_iso": {
7846
+ "type": "string",
7847
+ "minLength": 2,
7848
+ "maxLength": 2,
7849
+ "description": "ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix.",
7850
+ "nullable": true
7851
+ },
7807
7852
  "webauthn_rp_id": {
7808
7853
  "type": "string",
7809
7854
  "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
@@ -8400,6 +8445,13 @@
8400
8445
  "additionalProperties": false,
8401
8446
  "description": "Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`."
8402
8447
  },
8448
+ "default_country_iso": {
8449
+ "type": "string",
8450
+ "minLength": 2,
8451
+ "maxLength": 2,
8452
+ "description": "ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix.",
8453
+ "nullable": true
8454
+ },
8403
8455
  "webauthn_rp_id": {
8404
8456
  "type": "string",
8405
8457
  "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
@@ -8815,6 +8867,18 @@
8815
8867
  }
8816
8868
  ]
8817
8869
  },
8870
+ "default_country_iso": {
8871
+ "anyOf": [
8872
+ {
8873
+ "type": "string",
8874
+ "minLength": 2,
8875
+ "maxLength": 2
8876
+ },
8877
+ {
8878
+ "type": "null"
8879
+ }
8880
+ ]
8881
+ },
8818
8882
  "webauthn_rp_id": {
8819
8883
  "type": "string",
8820
8884
  "nullable": true
@@ -9297,6 +9361,13 @@
9297
9361
  "additionalProperties": false,
9298
9362
  "description": "Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`."
9299
9363
  },
9364
+ "default_country_iso": {
9365
+ "type": "string",
9366
+ "minLength": 2,
9367
+ "maxLength": 2,
9368
+ "description": "ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix.",
9369
+ "nullable": true
9370
+ },
9300
9371
  "webauthn_rp_id": {
9301
9372
  "type": "string",
9302
9373
  "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
@@ -9812,6 +9883,13 @@
9812
9883
  "additionalProperties": false,
9813
9884
  "description": "Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`."
9814
9885
  },
9886
+ "default_country_iso": {
9887
+ "type": "string",
9888
+ "minLength": 2,
9889
+ "maxLength": 2,
9890
+ "description": "ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix.",
9891
+ "nullable": true
9892
+ },
9815
9893
  "webauthn_rp_id": {
9816
9894
  "type": "string",
9817
9895
  "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
@@ -14895,6 +14973,12 @@
14895
14973
  "federated"
14896
14974
  ]
14897
14975
  },
14976
+ {
14977
+ "type": "string",
14978
+ "enum": [
14979
+ "sms_otp"
14980
+ ]
14981
+ },
14898
14982
  {
14899
14983
  "type": "null"
14900
14984
  }
@@ -14982,11 +15066,17 @@
14982
15066
  "federated"
14983
15067
  ]
14984
15068
  },
15069
+ {
15070
+ "type": "string",
15071
+ "enum": [
15072
+ "sms_otp"
15073
+ ]
15074
+ },
14985
15075
  {
14986
15076
  "type": "null"
14987
15077
  }
14988
15078
  ],
14989
- "description": "How `phone_verified` was last set. Same enum as `email_verified_method`."
15079
+ "description": "How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`)."
14990
15080
  },
14991
15081
  "phone_verified_at": {
14992
15082
  "type": "string",
@@ -15267,6 +15357,12 @@
15267
15357
  "federated"
15268
15358
  ]
15269
15359
  },
15360
+ {
15361
+ "type": "string",
15362
+ "enum": [
15363
+ "sms_otp"
15364
+ ]
15365
+ },
15270
15366
  {
15271
15367
  "type": "null"
15272
15368
  }
@@ -15354,11 +15450,17 @@
15354
15450
  "federated"
15355
15451
  ]
15356
15452
  },
15453
+ {
15454
+ "type": "string",
15455
+ "enum": [
15456
+ "sms_otp"
15457
+ ]
15458
+ },
15357
15459
  {
15358
15460
  "type": "null"
15359
15461
  }
15360
15462
  ],
15361
- "description": "How `phone_verified` was last set. Same enum as `email_verified_method`."
15463
+ "description": "How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`)."
15362
15464
  },
15363
15465
  "phone_verified_at": {
15364
15466
  "type": "string",
@@ -15718,6 +15820,12 @@
15718
15820
  "federated"
15719
15821
  ]
15720
15822
  },
15823
+ {
15824
+ "type": "string",
15825
+ "enum": [
15826
+ "sms_otp"
15827
+ ]
15828
+ },
15721
15829
  {
15722
15830
  "type": "null"
15723
15831
  }
@@ -15805,11 +15913,17 @@
15805
15913
  "federated"
15806
15914
  ]
15807
15915
  },
15916
+ {
15917
+ "type": "string",
15918
+ "enum": [
15919
+ "sms_otp"
15920
+ ]
15921
+ },
15808
15922
  {
15809
15923
  "type": "null"
15810
15924
  }
15811
15925
  ],
15812
- "description": "How `phone_verified` was last set. Same enum as `email_verified_method`."
15926
+ "description": "How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`)."
15813
15927
  },
15814
15928
  "phone_verified_at": {
15815
15929
  "type": "string",
@@ -16088,6 +16202,12 @@
16088
16202
  "federated"
16089
16203
  ]
16090
16204
  },
16205
+ {
16206
+ "type": "string",
16207
+ "enum": [
16208
+ "sms_otp"
16209
+ ]
16210
+ },
16091
16211
  {
16092
16212
  "type": "null"
16093
16213
  }
@@ -16175,11 +16295,17 @@
16175
16295
  "federated"
16176
16296
  ]
16177
16297
  },
16298
+ {
16299
+ "type": "string",
16300
+ "enum": [
16301
+ "sms_otp"
16302
+ ]
16303
+ },
16178
16304
  {
16179
16305
  "type": "null"
16180
16306
  }
16181
16307
  ],
16182
- "description": "How `phone_verified` was last set. Same enum as `email_verified_method`."
16308
+ "description": "How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`)."
16183
16309
  },
16184
16310
  "phone_verified_at": {
16185
16311
  "type": "string",
@@ -16815,6 +16941,141 @@
16815
16941
  }
16816
16942
  }
16817
16943
  },
16944
+ "/user/{user_id}/verify-phone/start": {
16945
+ "post": {
16946
+ "operationId": "user/verifyPhoneStart",
16947
+ "summary": "Send a verification code to the user's phone",
16948
+ "tags": [
16949
+ "user"
16950
+ ],
16951
+ "description": "Sends a 6-digit code by SMS to the user's phone (optionally setting a new phone first) and returns an opaque `state` to confirm it with. Same authorization as `verify-email/start`: the user themself (session or bearer), an admin of another tenant, or a machine token. Counts against the tenant's monthly SMS allowance. Fails with 409 `sms_unavailable` when no SMS can go out (no provider, plan does not allow it, allowance exhausted).",
16952
+ "requestBody": {
16953
+ "required": true,
16954
+ "content": {
16955
+ "application/json": {
16956
+ "schema": {
16957
+ "type": "object",
16958
+ "properties": {
16959
+ "phone": {
16960
+ "type": "string",
16961
+ "description": "Phone to verify. When given, it replaces the user's phone (normalised to E.164 with the account's `default_country_iso` as fallback) before the code is sent. When omitted, the code goes to the phone already on the user."
16962
+ }
16963
+ },
16964
+ "additionalProperties": false
16965
+ }
16966
+ }
16967
+ }
16968
+ },
16969
+ "parameters": [
16970
+ {
16971
+ "schema": {
16972
+ "type": "string"
16973
+ },
16974
+ "in": "path",
16975
+ "name": "user_id",
16976
+ "required": true
16977
+ }
16978
+ ],
16979
+ "responses": {
16980
+ "200": {
16981
+ "description": "Default Response",
16982
+ "content": {
16983
+ "application/json": {
16984
+ "schema": {
16985
+ "type": "object",
16986
+ "required": [
16987
+ "status",
16988
+ "destination_masked",
16989
+ "state",
16990
+ "expires_in"
16991
+ ],
16992
+ "properties": {
16993
+ "status": {
16994
+ "type": "string",
16995
+ "enum": [
16996
+ "sent"
16997
+ ]
16998
+ },
16999
+ "destination_masked": {
17000
+ "type": "string"
17001
+ },
17002
+ "state": {
17003
+ "type": "string",
17004
+ "description": "Opaque handle to confirm with. It is what lets a tenant backend start the verification (M2M) and send the person to `/flow/verify-phone?state=…` without a session."
17005
+ },
17006
+ "expires_in": {
17007
+ "type": "integer"
17008
+ }
17009
+ }
17010
+ }
17011
+ }
17012
+ }
17013
+ }
17014
+ }
17015
+ }
17016
+ },
17017
+ "/verify-phone/confirm": {
17018
+ "post": {
17019
+ "operationId": "user/verifyPhoneConfirm",
17020
+ "summary": "Confirm a phone verification code",
17021
+ "tags": [
17022
+ "user"
17023
+ ],
17024
+ "description": "Marks the phone verified (`phone_verified_method: sms_otp`) when the code matches the pending verification identified by `state`. Five wrong codes burn the `state`; start again. No session needed: the `state` plus the code are the proof.",
17025
+ "requestBody": {
17026
+ "required": true,
17027
+ "content": {
17028
+ "application/json": {
17029
+ "schema": {
17030
+ "type": "object",
17031
+ "required": [
17032
+ "state",
17033
+ "code"
17034
+ ],
17035
+ "properties": {
17036
+ "state": {
17037
+ "type": "string"
17038
+ },
17039
+ "code": {
17040
+ "type": "string",
17041
+ "minLength": 4,
17042
+ "maxLength": 12
17043
+ }
17044
+ },
17045
+ "additionalProperties": false
17046
+ }
17047
+ }
17048
+ }
17049
+ },
17050
+ "responses": {
17051
+ "200": {
17052
+ "description": "Default Response",
17053
+ "content": {
17054
+ "application/json": {
17055
+ "schema": {
17056
+ "type": "object",
17057
+ "required": [
17058
+ "status",
17059
+ "user_id"
17060
+ ],
17061
+ "properties": {
17062
+ "status": {
17063
+ "type": "string",
17064
+ "enum": [
17065
+ "verified"
17066
+ ]
17067
+ },
17068
+ "user_id": {
17069
+ "type": "string"
17070
+ }
17071
+ }
17072
+ }
17073
+ }
17074
+ }
17075
+ }
17076
+ }
17077
+ }
17078
+ },
16818
17079
  "/user/{user_id}/factors": {
16819
17080
  "get": {
16820
17081
  "operationId": "user/factors",
@@ -31526,6 +31787,12 @@
31526
31787
  "federated"
31527
31788
  ]
31528
31789
  },
31790
+ {
31791
+ "type": "string",
31792
+ "enum": [
31793
+ "sms_otp"
31794
+ ]
31795
+ },
31529
31796
  {
31530
31797
  "type": "null"
31531
31798
  }
@@ -31613,11 +31880,17 @@
31613
31880
  "federated"
31614
31881
  ]
31615
31882
  },
31883
+ {
31884
+ "type": "string",
31885
+ "enum": [
31886
+ "sms_otp"
31887
+ ]
31888
+ },
31616
31889
  {
31617
31890
  "type": "null"
31618
31891
  }
31619
31892
  ],
31620
- "description": "How `phone_verified` was last set. Same enum as `email_verified_method`."
31893
+ "description": "How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`)."
31621
31894
  },
31622
31895
  "phone_verified_at": {
31623
31896
  "type": "string",