@faable/auth-sdk 2.7.103 → 2.7.105

package/dist/api/types.d.ts

@@ -284,6 +284,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/internal/accounts": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Every tenant with its usage counters (platform)
+         * @description All accounts on the platform, each with its users, clients, connections, last login, first end-user login and whether it has a verified custom domain. Platform token with `read:accounts`.
+         */
+        get: operations["internal/accountsOverview"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/account/{account_id}/transfer": {
         parameters: {
             query?: never;
@@ -4512,7 +4532,7 @@ export interface paths {
         head?: never;
         /**
          * Update current User profile
-         * @description Updates the profile of the User behind the current session or bearer token. Only `name`, `company_name` and `country_iso` can be changed; `company_name` is merged into `user_metadata` without touching its other keys. A Bearer token must belong to this Account.
+         * @description Updates the profile of the User behind the current session or bearer token. Only `name`, `company_name`, `country_iso` and the custom `fields` the application declares (`profile_fields`) can be changed; `company_name` and `fields` are merged into `user_metadata` without touching its other keys. A Bearer token must belong to this Account.
          */
         patch: operations["session/me_update"];
         trace?: never;
@@ -4557,6 +4577,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/me/credentials": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * How the current User signs in
+         * @description Whether the User behind the session or bearer token has a password, and which connections they are linked to. A Bearer token must belong to this Account and be a user token.
+         */
+        get: operations["session/me_credentials"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/me/password": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Set or change the current User password
+         * @description Sets the password of the User behind the session or bearer token, creating their `database` credential if they have none (e.g. they signed up with Google). Changing an existing password needs `current_password`. Setting the first one needs a verified email and a recent sign-in: `auth_time` within 5 minutes and, when the User has a second factor, a sign-in that completed it (`acr` = `urn:faable:loa:2`); otherwise `reauth_required`, and the app signs in again with `max_age=0`. The connection's password policy applies. Every other session of the User is revoked, and the User gets a security email. A Bearer token must belong to this Account and be a user token.
+         */
+        post: operations["session/me_password"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/logout": {
         parameters: {
             query?: never;
@@ -5565,6 +5625,17 @@ export interface components {
                 /** @description Colour theme of the hosted login screens. `system` (the default): the visitor's OS decides, and the visitor can switch it from the screen. `light` / `dark`: forced, and the switch is hidden — for applications whose own pages are only one of the two. A `theme` query parameter on `/authorize` overrides this for that login. */
                 theme?: "system" | "light" | "dark";
             };
+            /** @description Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata["faable.com/fields"]`. On a Client it replaces the account's list entirely; absent = inherit. */
+            profile_fields?: {
+                /** @description The field key, as it is stored in `user_metadata["faable.com/fields"]`. */
+                key: string;
+                /** @description `string`: free text up to `max_length`. `enum`: one of `options`. */
+                type: "string" | "enum";
+                /** @description The accepted values when `type` is `enum`. */
+                options?: string[];
+                /** @description Longest accepted value for a `string` field. Default 200. */
+                max_length?: number;
+            }[];
             /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
             login_flow?: string | null;
             /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
@@ -5900,6 +5971,17 @@ export interface components {
                 /** @description Colour theme of the hosted login screens. `system` (the default): the visitor's OS decides, and the visitor can switch it from the screen. `light` / `dark`: forced, and the switch is hidden — for applications whose own pages are only one of the two. A `theme` query parameter on `/authorize` overrides this for that login. */
                 theme?: "system" | "light" | "dark";
             };
+            /** @description Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata["faable.com/fields"]`. On a Client it replaces the account's list entirely; absent = inherit. */
+            profile_fields?: {
+                /** @description The field key, as it is stored in `user_metadata["faable.com/fields"]`. */
+                key: string;
+                /** @description `string`: free text up to `max_length`. `enum`: one of `options`. */
+                type: "string" | "enum";
+                /** @description The accepted values when `type` is `enum`. */
+                options?: string[];
+                /** @description Longest accepted value for a `string` field. Default 200. */
+                max_length?: number;
+            }[];
             /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
             mfa_policy?: {
                 /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -6043,6 +6125,17 @@ export interface components {
                 /** @description Colour theme of the hosted login screens. `system` (the default): the visitor's OS decides, and the visitor can switch it from the screen. `light` / `dark`: forced, and the switch is hidden — for applications whose own pages are only one of the two. A `theme` query parameter on `/authorize` overrides this for that login. */
                 theme?: "system" | "light" | "dark";
             } | null;
+            /** @description Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata["faable.com/fields"]`. On a Client it replaces the account's list entirely; absent = inherit. */
+            profile_fields?: {
+                /** @description The field key, as it is stored in `user_metadata["faable.com/fields"]`. */
+                key: string;
+                /** @description `string`: free text up to `max_length`. `enum`: one of `options`. */
+                type: "string" | "enum";
+                /** @description The accepted values when `type` is `enum`. */
+                options?: string[];
+                /** @description Longest accepted value for a `string` field. Default 200. */
+                max_length?: number;
+            }[] | null;
             mfa_policy?: {
                 /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
                 mode?: "off" | "optional" | "required";
@@ -7630,8 +7723,8 @@ export interface components {
             expires_at: string;
             /** Format: date-time */
             revoked_at?: string;
-            /** @description `admin`: revoked through the Management API. `logout`: the user signed out. `user`: the user revoked it from another device. */
-            revoked_reason?: "admin" | "logout" | "user";
+            /** @description `admin`: revoked through the Management API. `logout`: the user signed out. `user`: the user revoked it from another device. `password_change`: the user set or changed their password, which ends every other session. */
+            revoked_reason?: "admin" | "logout" | "user" | "password_change";
             /** @description Object is related with this account */
             account: string;
             /**
@@ -7906,6 +7999,17 @@ export interface components {
                 /** @description Colour theme of the hosted login screens. `system` (the default): the visitor's OS decides, and the visitor can switch it from the screen. `light` / `dark`: forced, and the switch is hidden — for applications whose own pages are only one of the two. A `theme` query parameter on `/authorize` overrides this for that login. */
                 theme?: "system" | "light" | "dark";
             } | null;
+            /** @description Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata["faable.com/fields"]`. On a Client it replaces the account's list entirely; absent = inherit. */
+            profile_fields?: {
+                /** @description The field key, as it is stored in `user_metadata["faable.com/fields"]`. */
+                key: string;
+                /** @description `string`: free text up to `max_length`. `enum`: one of `options`. */
+                type: "string" | "enum";
+                /** @description The accepted values when `type` is `enum`. */
+                options?: string[];
+                /** @description Longest accepted value for a `string` field. Default 200. */
+                max_length?: number;
+            }[] | null;
             mfa_policy?: {
                 /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
                 mode?: "off" | "optional" | "required";
@@ -8116,6 +8220,10 @@ export interface components {
          *     - `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.
          *     - `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.
          *     - `step_up_required` (403): Confirm an existing factor before changing your factors.
+         *     - `reauth_required` (403): The operation needs a recent sign-in (and the second factor, when the user has one). Sign in again with `max_age=0` and retry with the new token.
+         *     - `invalid_current_password` (400): The current password is wrong.
+         *     - `email_not_verified` (403): The user's email is not verified, and the operation needs it to be.
+         *     - `invalid_profile_field` (400): A profile field is not declared for this application, or its value does not match the declaration. `message` names the key.
          *     - `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.
          *     - `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.
          *     - `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.
@@ -8170,7 +8278,7 @@ export interface components {
          *     - `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.
          * @enum {string}
          */
-        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "invalid_saml_request" | "saml_sp_mismatch" | "saml_not_enabled" | "invalid_saml_sp" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "consent_options_unavailable" | "consent_choice_invalid" | "registration_disabled" | "invalid_email_domain" | "public_email_domain" | "organization_domain_not_found" | "organization_domain_taken" | "organization_domain_unverified" | "plan_unavailable" | "organization_domain_mismatch" | "team_not_in_organization" | "organization_has_no_idp" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
+        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "invalid_saml_request" | "saml_sp_mismatch" | "saml_not_enabled" | "invalid_saml_sp" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "reauth_required" | "invalid_current_password" | "email_not_verified" | "invalid_profile_field" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "consent_options_unavailable" | "consent_choice_invalid" | "registration_disabled" | "invalid_email_domain" | "public_email_domain" | "organization_domain_not_found" | "organization_domain_taken" | "organization_domain_unverified" | "plan_unavailable" | "organization_domain_mismatch" | "team_not_in_organization" | "organization_has_no_idp" | "organization_not_found" | "invalid_user" | "not_an_organization_admin" | "last_organization_admin" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
         /** @description Every error response has this shape. Branch on `error_code`, never on `message`: the message is written for a person and may change. */
         ErrorResponse: {
             /** @description The HTTP status, repeated. */
@@ -8304,6 +8412,17 @@ export interface operations {
                             /** @description Colour theme of the hosted login screens. `system` (the default): the visitor's OS decides, and the visitor can switch it from the screen. `light` / `dark`: forced, and the switch is hidden — for applications whose own pages are only one of the two. A `theme` query parameter on `/authorize` overrides this for that login. */
                             theme?: "system" | "light" | "dark";
                         };
+                        /** @description Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata["faable.com/fields"]`. On a Client it replaces the account's list entirely; absent = inherit. */
+                        profile_fields?: {
+                            /** @description The field key, as it is stored in `user_metadata["faable.com/fields"]`. */
+                            key: string;
+                            /** @description `string`: free text up to `max_length`. `enum`: one of `options`. */
+                            type: "string" | "enum";
+                            /** @description The accepted values when `type` is `enum`. */
+                            options?: string[];
+                            /** @description Longest accepted value for a `string` field. Default 200. */
+                            max_length?: number;
+                        }[];
                         /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
                         login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
@@ -8663,6 +8782,17 @@ export interface operations {
                             /** @description Colour theme of the hosted login screens. `system` (the default): the visitor's OS decides, and the visitor can switch it from the screen. `light` / `dark`: forced, and the switch is hidden — for applications whose own pages are only one of the two. A `theme` query parameter on `/authorize` overrides this for that login. */
                             theme?: "system" | "light" | "dark";
                         };
+                        /** @description Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata["faable.com/fields"]`. On a Client it replaces the account's list entirely; absent = inherit. */
+                        profile_fields?: {
+                            /** @description The field key, as it is stored in `user_metadata["faable.com/fields"]`. */
+                            key: string;
+                            /** @description `string`: free text up to `max_length`. `enum`: one of `options`. */
+                            type: "string" | "enum";
+                            /** @description The accepted values when `type` is `enum`. */
+                            options?: string[];
+                            /** @description Longest accepted value for a `string` field. Default 200. */
+                            max_length?: number;
+                        }[];
                         /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
                         login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
@@ -8910,6 +9040,17 @@ export interface operations {
                             /** @description Colour theme of the hosted login screens. `system` (the default): the visitor's OS decides, and the visitor can switch it from the screen. `light` / `dark`: forced, and the switch is hidden — for applications whose own pages are only one of the two. A `theme` query parameter on `/authorize` overrides this for that login. */
                             theme?: "system" | "light" | "dark";
                         };
+                        /** @description Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata["faable.com/fields"]`. On a Client it replaces the account's list entirely; absent = inherit. */
+                        profile_fields?: {
+                            /** @description The field key, as it is stored in `user_metadata["faable.com/fields"]`. */
+                            key: string;
+                            /** @description `string`: free text up to `max_length`. `enum`: one of `options`. */
+                            type: "string" | "enum";
+                            /** @description The accepted values when `type` is `enum`. */
+                            options?: string[];
+                            /** @description Longest accepted value for a `string` field. Default 200. */
+                            max_length?: number;
+                        }[];
                         /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
                         login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
@@ -9113,6 +9254,17 @@ export interface operations {
                         /** @description Colour theme of the hosted login screens. `system` (the default): the visitor's OS decides, and the visitor can switch it from the screen. `light` / `dark`: forced, and the switch is hidden — for applications whose own pages are only one of the two. A `theme` query parameter on `/authorize` overrides this for that login. */
                         theme?: "system" | "light" | "dark";
                     } | null;
+                    /** @description Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata["faable.com/fields"]`. On a Client it replaces the account's list entirely; absent = inherit. */
+                    profile_fields?: {
+                        /** @description The field key, as it is stored in `user_metadata["faable.com/fields"]`. */
+                        key: string;
+                        /** @description `string`: free text up to `max_length`. `enum`: one of `options`. */
+                        type: "string" | "enum";
+                        /** @description The accepted values when `type` is `enum`. */
+                        options?: string[];
+                        /** @description Longest accepted value for a `string` field. Default 200. */
+                        max_length?: number;
+                    }[] | null;
                     mfa_policy?: {
                         /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
                         mode?: "off" | "optional" | "required";
@@ -9234,6 +9386,17 @@ export interface operations {
                             /** @description Colour theme of the hosted login screens. `system` (the default): the visitor's OS decides, and the visitor can switch it from the screen. `light` / `dark`: forced, and the switch is hidden — for applications whose own pages are only one of the two. A `theme` query parameter on `/authorize` overrides this for that login. */
                             theme?: "system" | "light" | "dark";
                         };
+                        /** @description Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata["faable.com/fields"]`. On a Client it replaces the account's list entirely; absent = inherit. */
+                        profile_fields?: {
+                            /** @description The field key, as it is stored in `user_metadata["faable.com/fields"]`. */
+                            key: string;
+                            /** @description `string`: free text up to `max_length`. `enum`: one of `options`. */
+                            type: "string" | "enum";
+                            /** @description The accepted values when `type` is `enum`. */
+                            options?: string[];
+                            /** @description Longest accepted value for a `string` field. Default 200. */
+                            max_length?: number;
+                        }[];
                         /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
                         login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
@@ -10236,6 +10399,106 @@ export interface operations {
             };
         };
     };
+    "internal/accountsOverview": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        rows: {
+                            account_id: string;
+                            /** @description The project (`team_<hex>`), or null for a legacy account without one. */
+                            team: string | null;
+                            name: string;
+                            createdAt: string | null;
+                            first_login_at: string | null;
+                            users: number;
+                            last_login: string | null;
+                            clients: number;
+                            connections: number;
+                            custom_domain_verified: boolean;
+                        }[];
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
     "account/transfer": {
         parameters: {
             query?: never;
@@ -10504,6 +10767,17 @@ export interface operations {
                             /** @description Colour theme of the hosted login screens. `system` (the default): the visitor's OS decides, and the visitor can switch it from the screen. `light` / `dark`: forced, and the switch is hidden — for applications whose own pages are only one of the two. A `theme` query parameter on `/authorize` overrides this for that login. */
                             theme?: "system" | "light" | "dark";
                         };
+                        /** @description Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata["faable.com/fields"]`. On a Client it replaces the account's list entirely; absent = inherit. */
+                        profile_fields?: {
+                            /** @description The field key, as it is stored in `user_metadata["faable.com/fields"]`. */
+                            key: string;
+                            /** @description `string`: free text up to `max_length`. `enum`: one of `options`. */
+                            type: "string" | "enum";
+                            /** @description The accepted values when `type` is `enum`. */
+                            options?: string[];
+                            /** @description Longest accepted value for a `string` field. Default 200. */
+                            max_length?: number;
+                        }[];
                         /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
                         login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
@@ -12124,6 +12398,17 @@ export interface operations {
                             /** @description Colour theme of the hosted login screens. `system` (the default): the visitor's OS decides, and the visitor can switch it from the screen. `light` / `dark`: forced, and the switch is hidden — for applications whose own pages are only one of the two. A `theme` query parameter on `/authorize` overrides this for that login. */
                             theme?: "system" | "light" | "dark";
                         };
+                        /** @description Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata["faable.com/fields"]`. On a Client it replaces the account's list entirely; absent = inherit. */
+                        profile_fields?: {
+                            /** @description The field key, as it is stored in `user_metadata["faable.com/fields"]`. */
+                            key: string;
+                            /** @description `string`: free text up to `max_length`. `enum`: one of `options`. */
+                            type: "string" | "enum";
+                            /** @description The accepted values when `type` is `enum`. */
+                            options?: string[];
+                            /** @description Longest accepted value for a `string` field. Default 200. */
+                            max_length?: number;
+                        }[];
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -12348,6 +12633,17 @@ export interface operations {
                             /** @description Colour theme of the hosted login screens. `system` (the default): the visitor's OS decides, and the visitor can switch it from the screen. `light` / `dark`: forced, and the switch is hidden — for applications whose own pages are only one of the two. A `theme` query parameter on `/authorize` overrides this for that login. */
                             theme?: "system" | "light" | "dark";
                         };
+                        /** @description Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata["faable.com/fields"]`. On a Client it replaces the account's list entirely; absent = inherit. */
+                        profile_fields?: {
+                            /** @description The field key, as it is stored in `user_metadata["faable.com/fields"]`. */
+                            key: string;
+                            /** @description `string`: free text up to `max_length`. `enum`: one of `options`. */
+                            type: "string" | "enum";
+                            /** @description The accepted values when `type` is `enum`. */
+                            options?: string[];
+                            /** @description Longest accepted value for a `string` field. Default 200. */
+                            max_length?: number;
+                        }[];
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -12568,6 +12864,17 @@ export interface operations {
                         /** @description Colour theme of the hosted login screens. `system` (the default): the visitor's OS decides, and the visitor can switch it from the screen. `light` / `dark`: forced, and the switch is hidden — for applications whose own pages are only one of the two. A `theme` query parameter on `/authorize` overrides this for that login. */
                         theme?: "system" | "light" | "dark";
                     } | null;
+                    /** @description Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata["faable.com/fields"]`. On a Client it replaces the account's list entirely; absent = inherit. */
+                    profile_fields?: {
+                        /** @description The field key, as it is stored in `user_metadata["faable.com/fields"]`. */
+                        key: string;
+                        /** @description `string`: free text up to `max_length`. `enum`: one of `options`. */
+                        type: "string" | "enum";
+                        /** @description The accepted values when `type` is `enum`. */
+                        options?: string[];
+                        /** @description Longest accepted value for a `string` field. Default 200. */
+                        max_length?: number;
+                    }[] | null;
                     mfa_policy?: {
                         /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
                         mode?: "off" | "optional" | "required";
@@ -12686,6 +12993,17 @@ export interface operations {
                             /** @description Colour theme of the hosted login screens. `system` (the default): the visitor's OS decides, and the visitor can switch it from the screen. `light` / `dark`: forced, and the switch is hidden — for applications whose own pages are only one of the two. A `theme` query parameter on `/authorize` overrides this for that login. */
                             theme?: "system" | "light" | "dark";
                         };
+                        /** @description Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata["faable.com/fields"]`. On a Client it replaces the account's list entirely; absent = inherit. */
+                        profile_fields?: {
+                            /** @description The field key, as it is stored in `user_metadata["faable.com/fields"]`. */
+                            key: string;
+                            /** @description `string`: free text up to `max_length`. `enum`: one of `options`. */
+                            type: "string" | "enum";
+                            /** @description The accepted values when `type` is `enum`. */
+                            options?: string[];
+                            /** @description Longest accepted value for a `string` field. Default 200. */
+                            max_length?: number;
+                        }[];
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -12916,6 +13234,17 @@ export interface operations {
                             /** @description Colour theme of the hosted login screens. `system` (the default): the visitor's OS decides, and the visitor can switch it from the screen. `light` / `dark`: forced, and the switch is hidden — for applications whose own pages are only one of the two. A `theme` query parameter on `/authorize` overrides this for that login. */
                             theme?: "system" | "light" | "dark";
                         };
+                        /** @description Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata["faable.com/fields"]`. On a Client it replaces the account's list entirely; absent = inherit. */
+                        profile_fields?: {
+                            /** @description The field key, as it is stored in `user_metadata["faable.com/fields"]`. */
+                            key: string;
+                            /** @description `string`: free text up to `max_length`. `enum`: one of `options`. */
+                            type: "string" | "enum";
+                            /** @description The accepted values when `type` is `enum`. */
+                            options?: string[];
+                            /** @description Longest accepted value for a `string` field. Default 200. */
+                            max_length?: number;
+                        }[];
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -13144,6 +13473,17 @@ export interface operations {
                             /** @description Colour theme of the hosted login screens. `system` (the default): the visitor's OS decides, and the visitor can switch it from the screen. `light` / `dark`: forced, and the switch is hidden — for applications whose own pages are only one of the two. A `theme` query parameter on `/authorize` overrides this for that login. */
                             theme?: "system" | "light" | "dark";
                         };
+                        /** @description Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata["faable.com/fields"]`. On a Client it replaces the account's list entirely; absent = inherit. */
+                        profile_fields?: {
+                            /** @description The field key, as it is stored in `user_metadata["faable.com/fields"]`. */
+                            key: string;
+                            /** @description `string`: free text up to `max_length`. `enum`: one of `options`. */
+                            type: "string" | "enum";
+                            /** @description The accepted values when `type` is `enum`. */
+                            options?: string[];
+                            /** @description Longest accepted value for a `string` field. Default 200. */
+                            max_length?: number;
+                        }[];
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -29941,8 +30281,8 @@ export interface operations {
                         expires_at: string;
                         /** Format: date-time */
                         revoked_at?: string;
-                        /** @description `admin`: revoked through the Management API. `logout`: the user signed out. `user`: the user revoked it from another device. */
-                        revoked_reason?: "admin" | "logout" | "user";
+                        /** @description `admin`: revoked through the Management API. `logout`: the user signed out. `user`: the user revoked it from another device. `password_change`: the user set or changed their password, which ends every other session. */
+                        revoked_reason?: "admin" | "logout" | "user" | "password_change";
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -30096,8 +30436,8 @@ export interface operations {
                         expires_at: string;
                         /** Format: date-time */
                         revoked_at?: string;
-                        /** @description `admin`: revoked through the Management API. `logout`: the user signed out. `user`: the user revoked it from another device. */
-                        revoked_reason?: "admin" | "logout" | "user";
+                        /** @description `admin`: revoked through the Management API. `logout`: the user signed out. `user`: the user revoked it from another device. `password_change`: the user set or changed their password, which ends every other session. */
+                        revoked_reason?: "admin" | "logout" | "user" | "password_change";
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -31566,6 +31906,18 @@ export interface operations {
                     };
                 };
             };
+            /** @description `forbidden` — The credentials are valid but do not allow this operation. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden";
+                    };
+                };
+            };
             /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
             404: {
                 headers: {
@@ -31693,13 +32045,18 @@ export interface operations {
             path?: never;
             cookie?: never;
         };
-        /** @description Profile fields the current User may edit on themselves. `company_name` is stored in `user_metadata`, merged with whatever else is there. */
+        /** @description Profile fields the current User may edit on themselves. `company_name` and `fields` are stored in `user_metadata`, merged with whatever else is there. */
         requestBody: {
             content: {
                 "application/json": {
                     name?: string;
                     company_name?: string;
                     country_iso?: string;
+                    /** @description Custom profile fields, stored in `user_metadata["faable.com/fields"]` and merged by key: keys not named here are kept, `null` removes one. Only the keys the application declares in `profile_fields` (Client, else Account) are accepted; any other key fails the whole request with `invalid_profile_field`. */
+                    fields?: {
+                        key: string;
+                        value: string | null;
+                    }[];
                 };
             };
         };
@@ -31840,6 +32197,8 @@ export interface operations {
             /**
              * @description `bad_request` — The request is malformed. `message` says what is wrong.
              *
+             *     `invalid_profile_field` — A profile field is not declared for this application, or its value does not match the declaration. `message` names the key.
+             *
              *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
              */
             400: {
@@ -31849,7 +32208,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "bad_request" | "validation_error";
+                        error_code?: "bad_request" | "invalid_profile_field" | "validation_error";
                     };
                 };
             };
@@ -32070,6 +32429,238 @@ export interface operations {
             };
         };
     };
+    "session/me_credentials": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Whether the user can sign in with a password: they have a `database` credential with a password set. */
+                        has_password: boolean;
+                        /** @description Every connection the user is linked to: the database one when they have a password, and each social or enterprise identity. Never the provider tokens or profile. */
+                        connections: {
+                            /** @description The Connection id (`connection_xxx`). */
+                            id: string;
+                            /** @description The Connection name. */
+                            name: string;
+                            /** @description The Connection type: `database`, `google`, `github`, … */
+                            type: string;
+                        }[];
+                    };
+                };
+            };
+            /**
+             * @description `mfa_pending` — A second-factor challenge is pending; answer it before continuing.
+             *
+             *     `not_logged_in` — There is no signed-in session for this request.
+             */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "mfa_pending" | "not_logged_in";
+                    };
+                };
+            };
+            /** @description `forbidden` — The credentials are valid but do not allow this operation. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "session/me_password": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    password: string;
+                    current_password?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description How many other sessions of the user were ended. */
+                        revoked_sessions: number;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_current_password` — The current password is wrong.
+             *
+             *     `password_too_weak` — The password does not meet the connection policy. `message` lists each unmet rule.
+             *
+             *     `no_database_connection` — The tenant has no database connection, so there is nowhere to store a password. Create one and retry.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_current_password" | "password_too_weak" | "no_database_connection" | "validation_error";
+                    };
+                };
+            };
+            /**
+             * @description `mfa_pending` — A second-factor challenge is pending; answer it before continuing.
+             *
+             *     `not_logged_in` — There is no signed-in session for this request.
+             */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "mfa_pending" | "not_logged_in";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `reauth_required` — The operation needs a recent sign-in (and the second factor, when the user has one). Sign in again with `max_age=0` and retry with the new token.
+             *
+             *     `email_not_verified` — The user's email is not verified, and the operation needs it to be.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "reauth_required" | "email_not_verified";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `conflict` — The request conflicts with the current state of the resource. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "conflict";
+                    };
+                };
+            };
+            /**
+             * @description `too_many_login_attempts` — Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.
+             *
+             *     `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.
+             */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_login_attempts" | "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
     "session/logout": {
         parameters: {
             query?: {