@faable/auth-sdk 2.7.105 → 2.7.107

package/dist/FaableAuthApi.d.ts

@@ -88,7 +88,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             type: "string" | "enum";
             options?: string[] | undefined;
             max_length?: number | undefined;
-        }[] | undefined;
+        }[] | null | undefined;
         login_flow?: string | null | undefined;
         mfa_policy?: {
             mode?: "required" | "optional" | "off" | undefined;
@@ -839,7 +839,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
                 type: "string" | "enum";
                 options?: string[] | undefined;
                 max_length?: number | undefined;
-            }[] | undefined;
+            }[] | null | undefined;
             mfa_policy?: {
                 mode?: "required" | "optional" | "off" | undefined;
                 allowed_factors?: ("webauthn" | "totp")[] | undefined;
@@ -922,7 +922,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
                 type: "string" | "enum";
                 options?: string[] | undefined;
                 max_length?: number | undefined;
-            }[] | undefined;
+            }[] | null | undefined;
             mfa_policy?: {
                 mode?: "required" | "optional" | "off" | undefined;
                 allowed_factors?: ("webauthn" | "totp")[] | undefined;
@@ -1008,7 +1008,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
                 type: "string" | "enum";
                 options?: string[] | undefined;
                 max_length?: number | undefined;
-            }[] | undefined;
+            }[] | null | undefined;
             mfa_policy?: {
                 mode?: "required" | "optional" | "off" | undefined;
                 allowed_factors?: ("webauthn" | "totp")[] | undefined;
@@ -1093,7 +1093,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             type: "string" | "enum";
             options?: string[] | undefined;
             max_length?: number | undefined;
-        }[] | undefined;
+        }[] | null | undefined;
         mfa_policy?: {
             mode?: "required" | "optional" | "off" | undefined;
             allowed_factors?: ("webauthn" | "totp")[] | undefined;

package/dist/api/generated-client.d.ts

@@ -87,7 +87,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             type: "string" | "enum";
             options?: string[] | undefined;
             max_length?: number | undefined;
-        }[] | undefined;
+        }[] | null | undefined;
         login_flow?: string | null | undefined;
         mfa_policy?: {
             mode?: "required" | "optional" | "off" | undefined;
@@ -173,7 +173,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             type: "string" | "enum";
             options?: string[] | undefined;
             max_length?: number | undefined;
-        }[] | undefined;
+        }[] | null | undefined;
         login_flow?: string | null | undefined;
         mfa_policy?: {
             mode?: "required" | "optional" | "off" | undefined;
@@ -279,7 +279,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             type: "string" | "enum";
             options?: string[] | undefined;
             max_length?: number | undefined;
-        }[] | undefined;
+        }[] | null | undefined;
         login_flow?: string | null | undefined;
         mfa_policy?: {
             mode?: "required" | "optional" | "off" | undefined;
@@ -368,7 +368,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             type: "string" | "enum";
             options?: string[] | undefined;
             max_length?: number | undefined;
-        }[] | undefined;
+        }[] | null | undefined;
         login_flow?: string | null | undefined;
         mfa_policy?: {
             mode?: "required" | "optional" | "off" | undefined;
@@ -502,25 +502,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             } | undefined;
             profile_fields?: {
                 key: string;
-                type: "string" | "enum"; /**
-                 * `POST /user/{user_id}/passkey-prompt/reset` — operationId: `user/resetPasskeyPrompt`
-                 *
-                 * Reset a user's passkey offer counter
-                 *
-                 * The post-login "create a passkey" offer stops after `login_methods.passkey_promotion_max_prompts` times and snoozes between them. This clears both, so the user is offered a passkey again on their next login — for "why does it keep asking" and "please ask me again" alike.
-                 *
-                 * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
-                 * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
-                 * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
-                 * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
-                 * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
-                 * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
-                 * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
-                 * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
-                 */
+                type: "string" | "enum";
                 options?: string[] | undefined;
                 max_length?: number | undefined;
-            }[] | undefined;
+            }[] | null | undefined;
             login_flow?: string | null | undefined;
             mfa_policy?: {
                 mode?: "required" | "optional" | "off" | undefined;
@@ -587,25 +572,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             } | undefined;
             profile_fields?: {
                 key: string;
-                type: "string" | "enum"; /**
-                 * `POST /user/{user_id}/passkey-prompt/reset` — operationId: `user/resetPasskeyPrompt`
-                 *
-                 * Reset a user's passkey offer counter
-                 *
-                 * The post-login "create a passkey" offer stops after `login_methods.passkey_promotion_max_prompts` times and snoozes between them. This clears both, so the user is offered a passkey again on their next login — for "why does it keep asking" and "please ask me again" alike.
-                 *
-                 * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
-                 * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
-                 * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
-                 * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
-                 * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
-                 * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
-                 * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
-                 * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
-                 */
+                type: "string" | "enum";
                 options?: string[] | undefined;
                 max_length?: number | undefined;
-            }[] | undefined;
+            }[] | null | undefined;
             login_flow?: string | null | undefined;
             mfa_policy?: {
                 mode?: "required" | "optional" | "off" | undefined;
@@ -675,25 +645,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             } | undefined;
             profile_fields?: {
                 key: string;
-                type: "string" | "enum"; /**
-                 * `POST /user/{user_id}/passkey-prompt/reset` — operationId: `user/resetPasskeyPrompt`
-                 *
-                 * Reset a user's passkey offer counter
-                 *
-                 * The post-login "create a passkey" offer stops after `login_methods.passkey_promotion_max_prompts` times and snoozes between them. This clears both, so the user is offered a passkey again on their next login — for "why does it keep asking" and "please ask me again" alike.
-                 *
-                 * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
-                 * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
-                 * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
-                 * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
-                 * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
-                 * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
-                 * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
-                 * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
-                 */
+                type: "string" | "enum";
                 options?: string[] | undefined;
                 max_length?: number | undefined;
-            }[] | undefined;
+            }[] | null | undefined;
             login_flow?: string | null | undefined;
             mfa_policy?: {
                 mode?: "required" | "optional" | "off" | undefined;
@@ -958,7 +913,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             type: "string" | "enum";
             options?: string[] | undefined;
             max_length?: number | undefined;
-        }[] | undefined;
+        }[] | null | undefined;
         login_flow?: string | null | undefined;
         mfa_policy?: {
             mode?: "required" | "optional" | "off" | undefined;
@@ -1592,7 +1547,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             type: "string" | "enum";
             options?: string[] | undefined;
             max_length?: number | undefined;
-        }[] | undefined;
+        }[] | null | undefined;
         mfa_policy?: {
             mode?: "required" | "optional" | "off" | undefined;
             allowed_factors?: ("webauthn" | "totp")[] | undefined;
@@ -1691,7 +1646,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             type: "string" | "enum";
             options?: string[] | undefined;
             max_length?: number | undefined;
-        }[] | undefined;
+        }[] | null | undefined;
         mfa_policy?: {
             mode?: "required" | "optional" | "off" | undefined;
             allowed_factors?: ("webauthn" | "totp")[] | undefined;
@@ -1791,7 +1746,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             type: "string" | "enum";
             options?: string[] | undefined;
             max_length?: number | undefined;
-        }[] | undefined;
+        }[] | null | undefined;
         mfa_policy?: {
             mode?: "required" | "optional" | "off" | undefined;
             allowed_factors?: ("webauthn" | "totp")[] | undefined;
@@ -1892,7 +1847,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
                 type: "string" | "enum";
                 options?: string[] | undefined;
                 max_length?: number | undefined;
-            }[] | undefined;
+            }[] | null | undefined;
             mfa_policy?: {
                 mode?: "required" | "optional" | "off" | undefined;
                 allowed_factors?: ("webauthn" | "totp")[] | undefined;
@@ -1975,7 +1930,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
                 type: "string" | "enum";
                 options?: string[] | undefined;
                 max_length?: number | undefined;
-            }[] | undefined;
+            }[] | null | undefined;
             mfa_policy?: {
                 mode?: "required" | "optional" | "off" | undefined;
                 allowed_factors?: ("webauthn" | "totp")[] | undefined;
@@ -2061,7 +2016,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
                 type: "string" | "enum";
                 options?: string[] | undefined;
                 max_length?: number | undefined;
-            }[] | undefined;
+            }[] | null | undefined;
             mfa_policy?: {
                 mode?: "required" | "optional" | "off" | undefined;
                 allowed_factors?: ("webauthn" | "totp")[] | undefined;
@@ -2163,7 +2118,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             type: "string" | "enum";
             options?: string[] | undefined;
             max_length?: number | undefined;
-        }[] | undefined;
+        }[] | null | undefined;
         mfa_policy?: {
             mode?: "required" | "optional" | "off" | undefined;
             allowed_factors?: ("webauthn" | "totp")[] | undefined;
@@ -2263,7 +2218,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             type: "string" | "enum";
             options?: string[] | undefined;
             max_length?: number | undefined;
-        }[] | undefined;
+        }[] | null | undefined;
         mfa_policy?: {
             mode?: "required" | "optional" | "off" | undefined;
             allowed_factors?: ("webauthn" | "totp")[] | undefined;
@@ -2820,9 +2775,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
      *
      * Set a credential's password
      *
-     * Sets or rotates the password for a database credential. Send exactly one of `password` (plaintext, hashed with argon2id) or `password_hash` (a hash exported from another provider: bcrypt, scrypt, Firebase scrypt, PBKDF2 or argon2 — verified on the first login and upgraded to argon2id). The previous password is invalidated immediately. A plaintext password records a `credential.password_changed` audit entry (initiated_by=admin); the confirmation email is only sent when an EXISTING password is rotated. An imported hash records `credential.password_imported` with its algorithm and sends no email. Neither the password nor the hash is ever returned or logged.
+     * Sets or rotates the password for a database credential. Send exactly one of `password` (plaintext, hashed with argon2id) or `password_hash` (a hash exported from another provider: bcrypt, scrypt, Firebase scrypt, PBKDF2 or argon2 — verified on the first login and upgraded to argon2id). A plaintext password must meet the password policy of the connection the credential belongs to (`password_too_weak` lists what is missing); an imported hash cannot be checked and is not. The previous password is invalidated immediately. A plaintext password records a `credential.password_changed` audit entry (initiated_by=admin); the confirmation email is only sent when an EXISTING password is rotated. An imported hash records `credential.password_imported` with its algorithm and sends no email. Neither the password nor the hash is ever returned or logged.
      *
      * @throws {FaableApiError} `bad_request` (400) — The request is malformed. `message` says what is wrong.
+     * @throws {FaableApiError} `password_too_weak` (400) — The password does not meet the connection policy. `message` lists each unmet rule.
      * @throws {FaableApiError} `invalid_password_hash` (400) — The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.
      * @throws {FaableApiError} `weak_password_hash` (400) — The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.
      * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.

package/dist/api/generated-client.js

@@ -805,9 +805,10 @@ export class GeneratedFaableAuthApi extends FaableApi {
      *
      * Set a credential's password
      *
-     * Sets or rotates the password for a database credential. Send exactly one of `password` (plaintext, hashed with argon2id) or `password_hash` (a hash exported from another provider: bcrypt, scrypt, Firebase scrypt, PBKDF2 or argon2 — verified on the first login and upgraded to argon2id). The previous password is invalidated immediately. A plaintext password records a `credential.password_changed` audit entry (initiated_by=admin); the confirmation email is only sent when an EXISTING password is rotated. An imported hash records `credential.password_imported` with its algorithm and sends no email. Neither the password nor the hash is ever returned or logged.
+     * Sets or rotates the password for a database credential. Send exactly one of `password` (plaintext, hashed with argon2id) or `password_hash` (a hash exported from another provider: bcrypt, scrypt, Firebase scrypt, PBKDF2 or argon2 — verified on the first login and upgraded to argon2id). A plaintext password must meet the password policy of the connection the credential belongs to (`password_too_weak` lists what is missing); an imported hash cannot be checked and is not. The previous password is invalidated immediately. A plaintext password records a `credential.password_changed` audit entry (initiated_by=admin); the confirmation email is only sent when an EXISTING password is rotated. An imported hash records `credential.password_imported` with its algorithm and sends no email. Neither the password nor the hash is ever returned or logged.
      *
      * @throws {FaableApiError} `bad_request` (400) — The request is malformed. `message` says what is wrong.
+     * @throws {FaableApiError} `password_too_weak` (400) — The password does not meet the connection policy. `message` lists each unmet rule.
      * @throws {FaableApiError} `invalid_password_hash` (400) — The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.
      * @throws {FaableApiError} `weak_password_hash` (400) — The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.
      * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.

package/dist/api/types.d.ts

@@ -1051,7 +1051,7 @@ export interface paths {
         put?: never;
         /**
          * Set a credential's password
-         * @description Sets or rotates the password for a database credential. Send exactly one of `password` (plaintext, hashed with argon2id) or `password_hash` (a hash exported from another provider: bcrypt, scrypt, Firebase scrypt, PBKDF2 or argon2 — verified on the first login and upgraded to argon2id). The previous password is invalidated immediately. A plaintext password records a `credential.password_changed` audit entry (initiated_by=admin); the confirmation email is only sent when an EXISTING password is rotated. An imported hash records `credential.password_imported` with its algorithm and sends no email. Neither the password nor the hash is ever returned or logged.
+         * @description Sets or rotates the password for a database credential. Send exactly one of `password` (plaintext, hashed with argon2id) or `password_hash` (a hash exported from another provider: bcrypt, scrypt, Firebase scrypt, PBKDF2 or argon2 — verified on the first login and upgraded to argon2id). A plaintext password must meet the password policy of the connection the credential belongs to (`password_too_weak` lists what is missing); an imported hash cannot be checked and is not. The previous password is invalidated immediately. A plaintext password records a `credential.password_changed` audit entry (initiated_by=admin); the confirmation email is only sent when an EXISTING password is rotated. An imported hash records `credential.password_imported` with its algorithm and sends no email. Neither the password nor the hash is ever returned or logged.
          */
         post: operations["credentials/setPassword"];
         delete?: never;
@@ -5635,7 +5635,7 @@ export interface components {
                 options?: string[];
                 /** @description Longest accepted value for a `string` field. Default 200. */
                 max_length?: number;
-            }[];
+            }[] | null;
             /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
             login_flow?: string | null;
             /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
@@ -5981,7 +5981,7 @@ export interface components {
                 options?: string[];
                 /** @description Longest accepted value for a `string` field. Default 200. */
                 max_length?: number;
-            }[];
+            }[] | null;
             /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
             mfa_policy?: {
                 /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -8422,7 +8422,7 @@ export interface operations {
                             options?: string[];
                             /** @description Longest accepted value for a `string` field. Default 200. */
                             max_length?: number;
-                        }[];
+                        }[] | null;
                         /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
                         login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
@@ -8792,7 +8792,7 @@ export interface operations {
                             options?: string[];
                             /** @description Longest accepted value for a `string` field. Default 200. */
                             max_length?: number;
-                        }[];
+                        }[] | null;
                         /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
                         login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
@@ -9050,7 +9050,7 @@ export interface operations {
                             options?: string[];
                             /** @description Longest accepted value for a `string` field. Default 200. */
                             max_length?: number;
-                        }[];
+                        }[] | null;
                         /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
                         login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
@@ -9396,7 +9396,7 @@ export interface operations {
                             options?: string[];
                             /** @description Longest accepted value for a `string` field. Default 200. */
                             max_length?: number;
-                        }[];
+                        }[] | null;
                         /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
                         login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
@@ -10777,7 +10777,7 @@ export interface operations {
                             options?: string[];
                             /** @description Longest accepted value for a `string` field. Default 200. */
                             max_length?: number;
-                        }[];
+                        }[] | null;
                         /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
                         login_flow?: string | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
@@ -12408,7 +12408,7 @@ export interface operations {
                             options?: string[];
                             /** @description Longest accepted value for a `string` field. Default 200. */
                             max_length?: number;
-                        }[];
+                        }[] | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -12643,7 +12643,7 @@ export interface operations {
                             options?: string[];
                             /** @description Longest accepted value for a `string` field. Default 200. */
                             max_length?: number;
-                        }[];
+                        }[] | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -13003,7 +13003,7 @@ export interface operations {
                             options?: string[];
                             /** @description Longest accepted value for a `string` field. Default 200. */
                             max_length?: number;
-                        }[];
+                        }[] | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -13244,7 +13244,7 @@ export interface operations {
                             options?: string[];
                             /** @description Longest accepted value for a `string` field. Default 200. */
                             max_length?: number;
-                        }[];
+                        }[] | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -13483,7 +13483,7 @@ export interface operations {
                             options?: string[];
                             /** @description Longest accepted value for a `string` field. Default 200. */
                             max_length?: number;
-                        }[];
+                        }[] | null;
                         /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
                         mfa_policy?: {
                             /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
@@ -17926,6 +17926,8 @@ export interface operations {
             /**
              * @description `bad_request` — The request is malformed. `message` says what is wrong.
              *
+             *     `password_too_weak` — The password does not meet the connection policy. `message` lists each unmet rule.
+             *
              *     `invalid_password_hash` — The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.
              *
              *     `weak_password_hash` — The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.
@@ -17939,7 +17941,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "bad_request" | "invalid_password_hash" | "weak_password_hash" | "validation_error";
+                        error_code?: "bad_request" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "validation_error";
                     };
                 };
             };

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.7.105";
+export const version = "2.7.107";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "8329c0e";
+export const commit = "720cd27";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.7.105",
+  "version": "2.7.107",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.78.0",
+    "version": "2.78.2",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -399,7 +399,8 @@
               "additionalProperties": false
             },
             "maxItems": 20,
-            "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+            "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit.",
+            "nullable": true
           },
           "login_flow": {
             "type": "string",
@@ -1791,7 +1792,8 @@
               "additionalProperties": false
             },
             "maxItems": 20,
-            "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+            "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit.",
+            "nullable": true
           },
           "mfa_policy": {
             "type": "object",
@@ -9141,7 +9143,8 @@
                         "additionalProperties": false
                       },
                       "maxItems": 20,
-                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit.",
+                      "nullable": true
                     },
                     "login_flow": {
                       "type": "string",
@@ -9947,7 +9950,8 @@
                         "additionalProperties": false
                       },
                       "maxItems": 20,
-                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit.",
+                      "nullable": true
                     },
                     "login_flow": {
                       "type": "string",
@@ -10990,7 +10994,8 @@
                         "additionalProperties": false
                       },
                       "maxItems": 20,
-                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit.",
+                      "nullable": true
                     },
                     "login_flow": {
                       "type": "string",
@@ -12272,7 +12277,8 @@
                         "additionalProperties": false
                       },
                       "maxItems": 20,
-                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit.",
+                      "nullable": true
                     },
                     "login_flow": {
                       "type": "string",
@@ -15532,7 +15538,8 @@
                         "additionalProperties": false
                       },
                       "maxItems": 20,
-                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit.",
+                      "nullable": true
                     },
                     "login_flow": {
                       "type": "string",
@@ -19777,7 +19784,8 @@
                         "additionalProperties": false
                       },
                       "maxItems": 20,
-                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit.",
+                      "nullable": true
                     },
                     "mfa_policy": {
                       "type": "object",
@@ -20586,7 +20594,8 @@
                         "additionalProperties": false
                       },
                       "maxItems": 20,
-                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit.",
+                      "nullable": true
                     },
                     "mfa_policy": {
                       "type": "object",
@@ -22069,7 +22078,8 @@
                         "additionalProperties": false
                       },
                       "maxItems": 20,
-                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit.",
+                      "nullable": true
                     },
                     "mfa_policy": {
                       "type": "object",
@@ -22878,7 +22888,8 @@
                         "additionalProperties": false
                       },
                       "maxItems": 20,
-                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit.",
+                      "nullable": true
                     },
                     "mfa_policy": {
                       "type": "object",
@@ -23688,7 +23699,8 @@
                         "additionalProperties": false
                       },
                       "maxItems": 20,
-                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit.",
+                      "nullable": true
                     },
                     "mfa_policy": {
                       "type": "object",
@@ -33399,7 +33411,7 @@
         "tags": [
           "credentials"
         ],
-        "description": "Sets or rotates the password for a database credential. Send exactly one of `password` (plaintext, hashed with argon2id) or `password_hash` (a hash exported from another provider: bcrypt, scrypt, Firebase scrypt, PBKDF2 or argon2 — verified on the first login and upgraded to argon2id). The previous password is invalidated immediately. A plaintext password records a `credential.password_changed` audit entry (initiated_by=admin); the confirmation email is only sent when an EXISTING password is rotated. An imported hash records `credential.password_imported` with its algorithm and sends no email. Neither the password nor the hash is ever returned or logged.",
+        "description": "Sets or rotates the password for a database credential. Send exactly one of `password` (plaintext, hashed with argon2id) or `password_hash` (a hash exported from another provider: bcrypt, scrypt, Firebase scrypt, PBKDF2 or argon2 — verified on the first login and upgraded to argon2id). A plaintext password must meet the password policy of the connection the credential belongs to (`password_too_weak` lists what is missing); an imported hash cannot be checked and is not. The previous password is invalidated immediately. A plaintext password records a `credential.password_changed` audit entry (initiated_by=admin); the confirmation email is only sent when an EXISTING password is rotated. An imported hash records `credential.password_imported` with its algorithm and sends no email. Neither the password nor the hash is ever returned or logged.",
         "requestBody": {
           "required": true,
           "content": {
@@ -33558,7 +33570,7 @@
             }
           },
           "400": {
-            "description": "`bad_request` — The request is malformed. `message` says what is wrong.\n\n`invalid_password_hash` — The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n\n`weak_password_hash` — The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`bad_request` — The request is malformed. `message` says what is wrong.\n\n`password_too_weak` — The password does not meet the connection policy. `message` lists each unmet rule.\n\n`invalid_password_hash` — The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n\n`weak_password_hash` — The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -33573,6 +33585,7 @@
                           "type": "string",
                           "enum": [
                             "bad_request",
+                            "password_too_weak",
                             "invalid_password_hash",
                             "weak_password_hash",
                             "validation_error"