@faable/auth-sdk 2.6.15 → 2.6.17

package/dist/api/types.d.ts

@@ -524,6 +524,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/user/{user_id}/verify-phone/start": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Send a verification code to the user's phone
+         * @description Sends a 6-digit code by SMS to the user's phone (optionally setting a new phone first) and returns an opaque `state` to confirm it with. Same authorization as `verify-email/start`: the user themself (session or bearer), an admin of another tenant, or a machine token. Counts against the tenant's monthly SMS allowance. Fails with 409 `sms_unavailable` when no SMS can go out (no provider, plan does not allow it, allowance exhausted).
+         */
+        post: operations["user/verifyPhoneStart"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/verify-phone/confirm": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Confirm a phone verification code
+         * @description Marks the phone verified (`phone_verified_method: sms_otp`) when the code matches the pending verification identified by `state`. Five wrong codes burn the `state`; start again. No session needed: the `state` plus the code are the proof.
+         */
+        post: operations["user/verifyPhoneConfirm"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/user/{user_id}/factors": {
         parameters: {
             query?: never;
@@ -2753,6 +2793,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/reset-code/verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Redeem a password-reset code sent by SMS/WhatsApp
+         * @description Second entry point to the new-password screen, for a reset delivered as a 6-digit code instead of a link. Answers the same `redirect_url` that the emailed link would land on. Five wrong codes consume the ticket; the error is always `invalid_code` and reveals nothing about the account.
+         */
+        post: operations["reset_code_verify"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/dbconnections/recovery_options": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Recovery channels to offer for an identifier
+         * @description For the forgot-password screen. With the tenant's `visible` list empty (the default) it answers from configuration alone and never looks the account up. Otherwise it returns the channels the user can pick, with masked destinations.
+         */
+        post: operations["recovery_options"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/dbconnections/signup": {
         parameters: {
             query?: never;
@@ -2880,6 +2960,8 @@ export interface components {
                 /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
                 visible?: ("email" | "sms" | "whatsapp" | "factor")[];
             };
+            /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
+            default_country_iso?: string | null;
             /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
             webauthn_rp_id?: string | null;
             /** @description AuthAccount creation date */
@@ -3331,7 +3413,7 @@ export interface components {
              */
             email_verified: boolean;
             /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
-            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
             /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
             email_verified_at?: string | null;
             /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -3350,8 +3432,8 @@ export interface components {
             phone?: string | null;
             /** @description phone is verified */
             phone_verified: boolean;
-            /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
-            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+            /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
+            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
             /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
             phone_verified_at?: string | null;
             /** @description country iso code */
@@ -4748,6 +4830,7 @@ export interface components {
                 /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
                 visible?: ("email" | "sms" | "whatsapp" | "factor")[];
             } | null;
+            default_country_iso?: string | null;
             webauthn_rp_id?: string | null;
             login_flow?: string | null;
         };
@@ -4953,6 +5036,8 @@ export interface operations {
                             /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
                             visible?: ("email" | "sms" | "whatsapp" | "factor")[];
                         };
+                        /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
+                        default_country_iso?: string | null;
                         /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
                         webauthn_rp_id?: string | null;
                         /** @description AuthAccount creation date */
@@ -5132,6 +5217,8 @@ export interface operations {
                             /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
                             visible?: ("email" | "sms" | "whatsapp" | "factor")[];
                         };
+                        /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
+                        default_country_iso?: string | null;
                         /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
                         webauthn_rp_id?: string | null;
                         /** @description AuthAccount creation date */
@@ -5265,6 +5352,8 @@ export interface operations {
                             /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
                             visible?: ("email" | "sms" | "whatsapp" | "factor")[];
                         };
+                        /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
+                        default_country_iso?: string | null;
                         /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
                         webauthn_rp_id?: string | null;
                         /** @description AuthAccount creation date */
@@ -5363,6 +5452,7 @@ export interface operations {
                         /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
                         visible?: ("email" | "sms" | "whatsapp" | "factor")[];
                     } | null;
+                    default_country_iso?: string | null;
                     webauthn_rp_id?: string | null;
                     login_flow?: string | null;
                 };
@@ -5477,6 +5567,8 @@ export interface operations {
                             /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
                             visible?: ("email" | "sms" | "whatsapp" | "factor")[];
                         };
+                        /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
+                        default_country_iso?: string | null;
                         /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
                         webauthn_rp_id?: string | null;
                         /** @description AuthAccount creation date */
@@ -5619,6 +5711,8 @@ export interface operations {
                             /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
                             visible?: ("email" | "sms" | "whatsapp" | "factor")[];
                         };
+                        /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
+                        default_country_iso?: string | null;
                         /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
                         webauthn_rp_id?: string | null;
                         /** @description AuthAccount creation date */
@@ -7060,7 +7154,7 @@ export interface operations {
                          */
                         email_verified: boolean;
                         /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
-                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
                         email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -7079,8 +7173,8 @@ export interface operations {
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
-                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
-                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
                         phone_verified_at?: string | null;
                         /** @description country iso code */
@@ -7200,7 +7294,7 @@ export interface operations {
                          */
                         email_verified: boolean;
                         /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
-                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
                         email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -7219,8 +7313,8 @@ export interface operations {
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
-                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
-                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
                         phone_verified_at?: string | null;
                         /** @description country iso code */
@@ -7380,7 +7474,7 @@ export interface operations {
                          */
                         email_verified: boolean;
                         /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
-                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
                         email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -7399,8 +7493,8 @@ export interface operations {
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
-                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
-                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
                         phone_verified_at?: string | null;
                         /** @description country iso code */
@@ -7520,7 +7614,7 @@ export interface operations {
                          */
                         email_verified: boolean;
                         /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
-                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
                         email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -7539,8 +7633,8 @@ export interface operations {
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
-                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
-                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
                         phone_verified_at?: string | null;
                         /** @description country iso code */
@@ -7746,6 +7840,8 @@ export interface operations {
                 "application/json": {
                     /** @description Optional connection_name to disambiguate when the tenant has more than one database connection. Defaults to the tenant database connection. */
                     connection?: string;
+                    /** @description How to deliver it: `email` (the link) or `sms` / `whatsapp` (a 6-digit code to the verified phone on file). Falls back to the tenant default when not available for this user; the response says which channel was used. */
+                    channel?: "email" | "sms" | "whatsapp" | "factor";
                 };
             };
         };
@@ -7761,6 +7857,7 @@ export interface operations {
                         status: "sent";
                         credential_id: string;
                         ticket_id: string;
+                        channel: "email" | "sms" | "whatsapp" | "factor";
                     };
                 };
             };
@@ -7792,6 +7889,8 @@ export interface operations {
                             createdAt: string;
                             expires_at: string;
                             ttl: number;
+                            /** @description How this ticket reaches the person: `email` (the link), `sms` / `whatsapp` (a code), `factor`. Older tickets are `email`. */
+                            channel: string;
                             /** @description The link from the ticket email. Present only while the ticket is usable — a dead link is noise, not a recovery path. */
                             link?: string;
                         }[];
@@ -7826,6 +7925,73 @@ export interface operations {
             };
         };
     };
+    "user/verifyPhoneStart": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Phone to verify. When given, it replaces the user's phone (normalised to E.164 with the account's `default_country_iso` as fallback) before the code is sent. When omitted, the code goes to the phone already on the user. */
+                    phone?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "sent";
+                        destination_masked: string;
+                        /** @description Opaque handle to confirm with. It is what lets a tenant backend start the verification (M2M) and send the person to `/flow/verify-phone?state=…` without a session. */
+                        state: string;
+                        expires_in: number;
+                    };
+                };
+            };
+        };
+    };
+    "user/verifyPhoneConfirm": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    state: string;
+                    code: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "verified";
+                        user_id: string;
+                    };
+                };
+            };
+        };
+    };
     "user/factors": {
         parameters: {
             query?: never;
@@ -12393,7 +12559,7 @@ export interface operations {
                          */
                         email_verified: boolean;
                         /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
-                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
                         email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -12412,8 +12578,8 @@ export interface operations {
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
-                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
-                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null;
                         /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
                         phone_verified_at?: string | null;
                         /** @description country iso code */
@@ -13207,6 +13373,8 @@ export interface operations {
             content: {
                 "application/json": {
                     email: string;
+                    /** @description How to deliver the reset: `email` (link), `sms` / `whatsapp` (a 6-digit code to the verified phone on file). Silently falls back to the tenant default when the channel is not available for this user — the response never says which channels an account has. */
+                    channel?: "email" | "sms" | "whatsapp" | "factor";
                 };
             };
         };
@@ -13270,6 +13438,69 @@ export interface operations {
             };
         };
     };
+    reset_code_verify: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    email: string;
+                    code: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        redirect_url: string;
+                    };
+                };
+            };
+        };
+    };
+    recovery_options: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    email: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Whether the screen should offer a choice. False when the tenant keeps `visible` empty — then nothing here depends on the account existing. */
+                        picker: boolean;
+                        default: "email" | "sms" | "whatsapp" | "factor";
+                        channels: {
+                            channel: "email" | "sms" | "whatsapp" | "factor";
+                            destination_masked?: string;
+                        }[];
+                    };
+                };
+            };
+        };
+    };
     signup: {
         parameters: {
             query?: never;

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.6.15";
+export const version = "2.6.17";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "1f0c0e0";
+export const commit = "bcc574e";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.6.15",
+  "version": "2.6.17",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",