@faable/auth-sdk 2.6.19 → 2.6.21

package/dist/FaableAuthApi.d.ts

@@ -105,6 +105,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             passkey_prompt_count?: number | undefined;
             passkey_prompt_dismissed_at?: string | null | undefined;
             phone?: string | null | undefined;
+            phone_e164?: boolean | undefined;
             phone_verified: boolean;
             phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
             phone_verified_at?: string | null | undefined;
@@ -163,6 +164,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             passkey_prompt_count?: number | undefined;
             passkey_prompt_dismissed_at?: string | null | undefined;
             phone?: string | null | undefined;
+            phone_e164?: boolean | undefined;
             phone_verified: boolean;
             phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
             phone_verified_at?: string | null | undefined;
@@ -224,6 +226,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             passkey_prompt_count?: number | undefined;
             passkey_prompt_dismissed_at?: string | null | undefined;
             phone?: string | null | undefined;
+            phone_e164?: boolean | undefined;
             phone_verified: boolean;
             phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
             phone_verified_at?: string | null | undefined;
@@ -284,6 +287,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         passkey_prompt_count?: number | undefined;
         passkey_prompt_dismissed_at?: string | null | undefined;
         phone?: string | null | undefined;
+        phone_e164?: boolean | undefined;
         phone_verified: boolean;
         phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
         phone_verified_at?: string | null | undefined;
@@ -343,6 +347,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         passkey_prompt_count?: number | undefined;
         passkey_prompt_dismissed_at?: string | null | undefined;
         phone?: string | null | undefined;
+        phone_e164?: boolean | undefined;
         phone_verified: boolean;
         phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
         phone_verified_at?: string | null | undefined;
@@ -402,6 +407,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         passkey_prompt_count?: number | undefined;
         passkey_prompt_dismissed_at?: string | null | undefined;
         phone?: string | null | undefined;
+        phone_e164?: boolean | undefined;
         phone_verified: boolean;
         phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
         phone_verified_at?: string | null | undefined;

package/dist/api/generated-client.d.ts

@@ -3935,6 +3935,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         passkey_prompt_count?: number | undefined;
         passkey_prompt_dismissed_at?: string | null | undefined;
         phone?: string | null | undefined;
+        phone_e164?: boolean | undefined;
         phone_verified: boolean;
         phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
         phone_verified_at?: string | null | undefined;
@@ -3998,6 +3999,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         passkey_prompt_count?: number | undefined;
         passkey_prompt_dismissed_at?: string | null | undefined;
         phone?: string | null | undefined;
+        phone_e164?: boolean | undefined;
         phone_verified: boolean;
         phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
         phone_verified_at?: string | null | undefined;
@@ -4061,6 +4063,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         passkey_prompt_count?: number | undefined;
         passkey_prompt_dismissed_at?: string | null | undefined;
         phone?: string | null | undefined;
+        phone_e164?: boolean | undefined;
         phone_verified: boolean;
         phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
         phone_verified_at?: string | null | undefined;
@@ -4125,6 +4128,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             passkey_prompt_count?: number | undefined;
             passkey_prompt_dismissed_at?: string | null | undefined;
             phone?: string | null | undefined;
+            phone_e164?: boolean | undefined;
             phone_verified: boolean;
             phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
             phone_verified_at?: string | null | undefined;
@@ -4183,6 +4187,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             passkey_prompt_count?: number | undefined;
             passkey_prompt_dismissed_at?: string | null | undefined;
             phone?: string | null | undefined;
+            phone_e164?: boolean | undefined;
             phone_verified: boolean;
             phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
             phone_verified_at?: string | null | undefined;
@@ -4244,6 +4249,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             passkey_prompt_count?: number | undefined;
             passkey_prompt_dismissed_at?: string | null | undefined;
             phone?: string | null | undefined;
+            phone_e164?: boolean | undefined;
             phone_verified: boolean;
             phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
             phone_verified_at?: string | null | undefined;
@@ -4346,6 +4352,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         passkey_prompt_count?: number | undefined;
         passkey_prompt_dismissed_at?: string | null | undefined;
         phone?: string | null | undefined;
+        phone_e164?: boolean | undefined;
         phone_verified: boolean;
         phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | null | undefined;
         phone_verified_at?: string | null | undefined;

package/dist/api/types.d.ts

@@ -584,6 +584,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/verify-phone/pending": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * What the verification screen should say
+         * @description The masked destination of a pending verification and how long its code is still good for. The screen needs this to say "we sent a code to ···· 628": the `destination_masked` of `start` goes to whoever called it, not to the person typing the code.
+         */
+        get: operations["user/verifyPhonePending"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/verify-phone/restart": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Correct the number and send a new code
+         * @description Replaces the phone of a pending verification and sends a fresh code, returning a new `state`; the old one stops working. No session needed — the `state` is the proof — which is why it refuses with 409 `phone_already_verified` once the person has a verified phone: from that point a leaked `state` must not be able to move the number. Counts against the monthly SMS allowance like `start`.
+         */
+        post: operations["user/verifyPhoneRestart"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/user/{user_id}/factors": {
         parameters: {
             query?: never;
@@ -3585,6 +3625,8 @@ export interface components {
             passkey_prompt_dismissed_at?: string | null;
             /** @description contact phone number */
             phone?: string | null;
+            /** @description Whether `phone` is a valid E.164 number. Calculated on read, never stored: new writes are rejected unless they normalise, so a `false` here is a legacy row that no SMS can reach — fix the number, or set the account default country and write it again. */
+            phone_e164?: boolean;
             /** @description phone is verified */
             phone_verified: boolean;
             /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
@@ -7356,6 +7398,8 @@ export interface operations {
                         passkey_prompt_dismissed_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
+                        /** @description Whether `phone` is a valid E.164 number. Calculated on read, never stored: new writes are rejected unless they normalise, so a `false` here is a legacy row that no SMS can reach — fix the number, or set the account default country and write it again. */
+                        phone_e164?: boolean;
                         /** @description phone is verified */
                         phone_verified: boolean;
                         /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
@@ -7496,6 +7540,8 @@ export interface operations {
                         passkey_prompt_dismissed_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
+                        /** @description Whether `phone` is a valid E.164 number. Calculated on read, never stored: new writes are rejected unless they normalise, so a `false` here is a legacy row that no SMS can reach — fix the number, or set the account default country and write it again. */
+                        phone_e164?: boolean;
                         /** @description phone is verified */
                         phone_verified: boolean;
                         /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
@@ -7676,6 +7722,8 @@ export interface operations {
                         passkey_prompt_dismissed_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
+                        /** @description Whether `phone` is a valid E.164 number. Calculated on read, never stored: new writes are rejected unless they normalise, so a `false` here is a legacy row that no SMS can reach — fix the number, or set the account default country and write it again. */
+                        phone_e164?: boolean;
                         /** @description phone is verified */
                         phone_verified: boolean;
                         /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
@@ -7816,6 +7864,8 @@ export interface operations {
                         passkey_prompt_dismissed_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
+                        /** @description Whether `phone` is a valid E.164 number. Calculated on read, never stored: new writes are rejected unless they normalise, so a `false` here is a legacy row that no SMS can reach — fix the number, or set the account default country and write it again. */
+                        phone_e164?: boolean;
                         /** @description phone is verified */
                         phone_verified: boolean;
                         /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
@@ -8177,6 +8227,69 @@ export interface operations {
             };
         };
     };
+    "user/verifyPhonePending": {
+        parameters: {
+            query: {
+                state: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        destination_masked: string;
+                        expires_in: number;
+                        /** @description Whether the screen may offer "this is not my number". False once the phone is verified: from then on the `state` must not be able to point it somewhere else. */
+                        can_change: boolean;
+                        /** @description The account's default country (ISO 3166-1 alpha-2), so the screen can preselect the right dial code when the person corrects their number. */
+                        default_country?: string;
+                    };
+                };
+            };
+        };
+    };
+    "user/verifyPhoneRestart": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    state: string;
+                    phone: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "sent";
+                        destination_masked: string;
+                        /** @description Opaque handle to confirm with. It is what lets a tenant backend start the verification (M2M) and send the person to `/flow/verify-phone?state=…` without a session. */
+                        state: string;
+                        expires_in: number;
+                    };
+                };
+            };
+        };
+    };
     "user/factors": {
         parameters: {
             query?: never;
@@ -12761,6 +12874,8 @@ export interface operations {
                         passkey_prompt_dismissed_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
+                        /** @description Whether `phone` is a valid E.164 number. Calculated on read, never stored: new writes are rejected unless they normalise, so a `false` here is a legacy row that no SMS can reach — fix the number, or set the account default country and write it again. */
+                        phone_e164?: boolean;
                         /** @description phone is verified */
                         phone_verified: boolean;
                         /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.6.19";
+export const version = "2.6.21";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "c0ff254";
+export const commit = "27ee17f";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.6.19",
+  "version": "2.6.21",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.20.0",
+    "version": "2.22.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -2295,6 +2295,10 @@
             "description": "contact phone number",
             "nullable": true
           },
+          "phone_e164": {
+            "type": "boolean",
+            "description": "Whether `phone` is a valid E.164 number. Calculated on read, never stored: new writes are rejected unless they normalise, so a `false` here is a legacy row that no SMS can reach — fix the number, or set the account default country and write it again."
+          },
           "phone_verified": {
             "type": "boolean",
             "description": "phone is verified"
@@ -15101,6 +15105,10 @@
                       "description": "contact phone number",
                       "nullable": true
                     },
+                    "phone_e164": {
+                      "type": "boolean",
+                      "description": "Whether `phone` is a valid E.164 number. Calculated on read, never stored: new writes are rejected unless they normalise, so a `false` here is a legacy row that no SMS can reach — fix the number, or set the account default country and write it again."
+                    },
                     "phone_verified": {
                       "type": "boolean",
                       "description": "phone is verified"
@@ -15485,6 +15493,10 @@
                       "description": "contact phone number",
                       "nullable": true
                     },
+                    "phone_e164": {
+                      "type": "boolean",
+                      "description": "Whether `phone` is a valid E.164 number. Calculated on read, never stored: new writes are rejected unless they normalise, so a `false` here is a legacy row that no SMS can reach — fix the number, or set the account default country and write it again."
+                    },
                     "phone_verified": {
                       "type": "boolean",
                       "description": "phone is verified"
@@ -15948,6 +15960,10 @@
                       "description": "contact phone number",
                       "nullable": true
                     },
+                    "phone_e164": {
+                      "type": "boolean",
+                      "description": "Whether `phone` is a valid E.164 number. Calculated on read, never stored: new writes are rejected unless they normalise, so a `false` here is a legacy row that no SMS can reach — fix the number, or set the account default country and write it again."
+                    },
                     "phone_verified": {
                       "type": "boolean",
                       "description": "phone is verified"
@@ -16330,6 +16346,10 @@
                       "description": "contact phone number",
                       "nullable": true
                     },
+                    "phone_e164": {
+                      "type": "boolean",
+                      "description": "Whether `phone` is a valid E.164 number. Calculated on read, never stored: new writes are rejected unless they normalise, so a `false` here is a legacy row that no SMS can reach — fix the number, or set the account default country and write it again."
+                    },
                     "phone_verified": {
                       "type": "boolean",
                       "description": "phone is verified"
@@ -17220,6 +17240,129 @@
         }
       }
     },
+    "/verify-phone/pending": {
+      "get": {
+        "operationId": "user/verifyPhonePending",
+        "summary": "What the verification screen should say",
+        "tags": [
+          "user"
+        ],
+        "description": "The masked destination of a pending verification and how long its code is still good for. The screen needs this to say \"we sent a code to ···· 628\": the `destination_masked` of `start` goes to whoever called it, not to the person typing the code.",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "state",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "destination_masked",
+                    "expires_in",
+                    "can_change"
+                  ],
+                  "properties": {
+                    "destination_masked": {
+                      "type": "string"
+                    },
+                    "expires_in": {
+                      "type": "integer"
+                    },
+                    "can_change": {
+                      "type": "boolean",
+                      "description": "Whether the screen may offer \"this is not my number\". False once the phone is verified: from then on the `state` must not be able to point it somewhere else."
+                    },
+                    "default_country": {
+                      "type": "string",
+                      "description": "The account's default country (ISO 3166-1 alpha-2), so the screen can preselect the right dial code when the person corrects their number."
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/verify-phone/restart": {
+      "post": {
+        "operationId": "user/verifyPhoneRestart",
+        "summary": "Correct the number and send a new code",
+        "tags": [
+          "user"
+        ],
+        "description": "Replaces the phone of a pending verification and sends a fresh code, returning a new `state`; the old one stops working. No session needed — the `state` is the proof — which is why it refuses with 409 `phone_already_verified` once the person has a verified phone: from that point a leaked `state` must not be able to move the number. Counts against the monthly SMS allowance like `start`.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "state",
+                  "phone"
+                ],
+                "properties": {
+                  "state": {
+                    "type": "string"
+                  },
+                  "phone": {
+                    "type": "string",
+                    "minLength": 4
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "status",
+                    "destination_masked",
+                    "state",
+                    "expires_in"
+                  ],
+                  "properties": {
+                    "status": {
+                      "type": "string",
+                      "enum": [
+                        "sent"
+                      ]
+                    },
+                    "destination_masked": {
+                      "type": "string"
+                    },
+                    "state": {
+                      "type": "string",
+                      "description": "Opaque handle to confirm with. It is what lets a tenant backend start the verification (M2M) and send the person to `/flow/verify-phone?state=…` without a session."
+                    },
+                    "expires_in": {
+                      "type": "integer"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/user/{user_id}/factors": {
       "get": {
         "operationId": "user/factors",
@@ -32138,6 +32281,10 @@
                       "description": "contact phone number",
                       "nullable": true
                     },
+                    "phone_e164": {
+                      "type": "boolean",
+                      "description": "Whether `phone` is a valid E.164 number. Calculated on read, never stored: new writes are rejected unless they normalise, so a `false` here is a legacy row that no SMS can reach — fix the number, or set the account default country and write it again."
+                    },
                     "phone_verified": {
                       "type": "boolean",
                       "description": "phone is verified"