@faable/auth-sdk 2.7.27 → 2.7.29

package/dist/FaableAuthApi.d.ts

@@ -108,18 +108,19 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             nickname?: string | null | undefined;
             email?: string | null | undefined;
             email_verified: boolean;
-            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
             email_verified_at?: string | null | undefined;
             email_change_locked_at?: string | null | undefined;
             email_bounced_at?: string | null | undefined;
             welcome_sent_at?: string | null | undefined;
+            imported_at?: string | null | undefined;
             passkey_prompted_at?: string | null | undefined;
             passkey_prompt_count?: number | undefined;
             passkey_prompt_dismissed_at?: string | null | undefined;
             phone?: string | null | undefined;
             phone_e164?: boolean | undefined;
             phone_verified: boolean;
-            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
             phone_verified_at?: string | null | undefined;
             country_iso?: string | null | undefined;
             birth_date?: string | null | undefined;
@@ -167,18 +168,19 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             nickname?: string | null | undefined;
             email?: string | null | undefined;
             email_verified: boolean;
-            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
             email_verified_at?: string | null | undefined;
             email_change_locked_at?: string | null | undefined;
             email_bounced_at?: string | null | undefined;
             welcome_sent_at?: string | null | undefined;
+            imported_at?: string | null | undefined;
             passkey_prompted_at?: string | null | undefined;
             passkey_prompt_count?: number | undefined;
             passkey_prompt_dismissed_at?: string | null | undefined;
             phone?: string | null | undefined;
             phone_e164?: boolean | undefined;
             phone_verified: boolean;
-            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
             phone_verified_at?: string | null | undefined;
             country_iso?: string | null | undefined;
             birth_date?: string | null | undefined;
@@ -229,18 +231,19 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             nickname?: string | null | undefined;
             email?: string | null | undefined;
             email_verified: boolean;
-            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
             email_verified_at?: string | null | undefined;
             email_change_locked_at?: string | null | undefined;
             email_bounced_at?: string | null | undefined;
             welcome_sent_at?: string | null | undefined;
+            imported_at?: string | null | undefined;
             passkey_prompted_at?: string | null | undefined;
             passkey_prompt_count?: number | undefined;
             passkey_prompt_dismissed_at?: string | null | undefined;
             phone?: string | null | undefined;
             phone_e164?: boolean | undefined;
             phone_verified: boolean;
-            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
             phone_verified_at?: string | null | undefined;
             country_iso?: string | null | undefined;
             birth_date?: string | null | undefined;
@@ -290,18 +293,19 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         nickname?: string | null | undefined;
         email?: string | null | undefined;
         email_verified: boolean;
-        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
         email_verified_at?: string | null | undefined;
         email_change_locked_at?: string | null | undefined;
         email_bounced_at?: string | null | undefined;
         welcome_sent_at?: string | null | undefined;
+        imported_at?: string | null | undefined;
         passkey_prompted_at?: string | null | undefined;
         passkey_prompt_count?: number | undefined;
         passkey_prompt_dismissed_at?: string | null | undefined;
         phone?: string | null | undefined;
         phone_e164?: boolean | undefined;
         phone_verified: boolean;
-        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
         phone_verified_at?: string | null | undefined;
         country_iso?: string | null | undefined;
         birth_date?: string | null | undefined;
@@ -350,18 +354,19 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         nickname?: string | null | undefined;
         email?: string | null | undefined;
         email_verified: boolean;
-        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
         email_verified_at?: string | null | undefined;
         email_change_locked_at?: string | null | undefined;
         email_bounced_at?: string | null | undefined;
         welcome_sent_at?: string | null | undefined;
+        imported_at?: string | null | undefined;
         passkey_prompted_at?: string | null | undefined;
         passkey_prompt_count?: number | undefined;
         passkey_prompt_dismissed_at?: string | null | undefined;
         phone?: string | null | undefined;
         phone_e164?: boolean | undefined;
         phone_verified: boolean;
-        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
         phone_verified_at?: string | null | undefined;
         country_iso?: string | null | undefined;
         birth_date?: string | null | undefined;
@@ -410,18 +415,19 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         nickname?: string | null | undefined;
         email?: string | null | undefined;
         email_verified: boolean;
-        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
         email_verified_at?: string | null | undefined;
         email_change_locked_at?: string | null | undefined;
         email_bounced_at?: string | null | undefined;
         welcome_sent_at?: string | null | undefined;
+        imported_at?: string | null | undefined;
         passkey_prompted_at?: string | null | undefined;
         passkey_prompt_count?: number | undefined;
         passkey_prompt_dismissed_at?: string | null | undefined;
         phone?: string | null | undefined;
         phone_e164?: boolean | undefined;
         phone_verified: boolean;
-        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
         phone_verified_at?: string | null | undefined;
         country_iso?: string | null | undefined;
         birth_date?: string | null | undefined;

package/dist/api/generated-client.d.ts

@@ -2279,8 +2279,11 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
      *
      * Set a credential's password
      *
-     * Sets or rotates the password for a database credential. The previous password is invalidated immediately. Records a `credential.password_changed` audit entry (initiated_by=admin) for traceability. The confirmation email is only sent when an EXISTING password is rotated: setting the first password on a credential that had none is a creation, not a change. The password is never returned.
+     * Sets or rotates the password for a database credential. Send exactly one of `password` (plaintext, hashed with argon2id) or `password_hash` (a hash exported from another provider: bcrypt, scrypt, Firebase scrypt, PBKDF2 or argon2 — verified on the first login and upgraded to argon2id). The previous password is invalidated immediately. A plaintext password records a `credential.password_changed` audit entry (initiated_by=admin); the confirmation email is only sent when an EXISTING password is rotated. An imported hash records `credential.password_imported` with its algorithm and sends no email. Neither the password nor the hash is ever returned or logged.
      *
+     * @throws {FaableApiError} `bad_request` (400) — The request is malformed. `message` says what is wrong.
+     * @throws {FaableApiError} `invalid_password_hash` (400) — The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.
+     * @throws {FaableApiError} `weak_password_hash` (400) — The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.
      * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
      * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
      * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
@@ -5065,18 +5068,19 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         nickname?: string | null | undefined;
         email?: string | null | undefined;
         email_verified: boolean;
-        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
         email_verified_at?: string | null | undefined;
         email_change_locked_at?: string | null | undefined;
         email_bounced_at?: string | null | undefined;
         welcome_sent_at?: string | null | undefined;
+        imported_at?: string | null | undefined;
         passkey_prompted_at?: string | null | undefined;
         passkey_prompt_count?: number | undefined;
         passkey_prompt_dismissed_at?: string | null | undefined;
         phone?: string | null | undefined;
         phone_e164?: boolean | undefined;
         phone_verified: boolean;
-        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
         phone_verified_at?: string | null | undefined;
         country_iso?: string | null | undefined;
         birth_date?: string | null | undefined;
@@ -5140,18 +5144,19 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         nickname?: string | null | undefined;
         email?: string | null | undefined;
         email_verified: boolean;
-        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
         email_verified_at?: string | null | undefined;
         email_change_locked_at?: string | null | undefined;
         email_bounced_at?: string | null | undefined;
         welcome_sent_at?: string | null | undefined;
+        imported_at?: string | null | undefined;
         passkey_prompted_at?: string | null | undefined;
         passkey_prompt_count?: number | undefined;
         passkey_prompt_dismissed_at?: string | null | undefined;
         phone?: string | null | undefined;
         phone_e164?: boolean | undefined;
         phone_verified: boolean;
-        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
         phone_verified_at?: string | null | undefined;
         country_iso?: string | null | undefined;
         birth_date?: string | null | undefined;
@@ -5209,6 +5214,54 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
     userDeleteFactor(user_id: string, factor_id: string): Promise<{
         deleted: boolean;
     }>;
+    /**
+     * `GET /user/export` — operationId: `user/export`
+     *
+     * Export users, optionally with their password hashes
+     *
+     * Pages through every user of the tenant, 500 at a time, in the row shape `POST /user/import` takes. With `include_hashes` each row carries its `password_hash` (needs the `read:password_hashes` scope, is audited as `credentials.exported` and notifies its subscribers). Provider access and refresh tokens of linked identities are never exported. Available on every plan.
+     *
+     * @throws {FaableApiError} `invalid_connection` (400) — The connection does not exist, is disabled, or is not of the type this flow needs.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userExport(params?: OpQuery<"user/export">): Promise<{
+        users: {
+            user_id: string;
+            email: string | null;
+            email_verified: boolean;
+            name?: string | undefined;
+            given_name?: string | undefined;
+            family_name?: string | undefined;
+            phone?: string | undefined;
+            birth_date?: string | undefined;
+            locale?: string | undefined;
+            picture?: string | undefined;
+            user_metadata?: {
+                [key: string]: unknown;
+            } | undefined;
+            app_metadata?: {
+                [key: string]: unknown;
+            } | undefined;
+            password_hash_status: "set" | "not_set" | "no_credential" | "legacy_unexportable";
+            password_hash?: string | undefined;
+            identities?: {
+                connection: string;
+                identity_id: string;
+                profile_data?: {
+                    [key: string]: unknown;
+                } | undefined;
+            }[] | undefined;
+        }[];
+        next_cursor: string | null;
+        connection: string | null;
+    }>;
     /**
      * `GET /user/{user_id}/factors` — operationId: `user/factors`
      *
@@ -5260,18 +5313,19 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         nickname?: string | null | undefined;
         email?: string | null | undefined;
         email_verified: boolean;
-        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
         email_verified_at?: string | null | undefined;
         email_change_locked_at?: string | null | undefined;
         email_bounced_at?: string | null | undefined;
         welcome_sent_at?: string | null | undefined;
+        imported_at?: string | null | undefined;
         passkey_prompted_at?: string | null | undefined;
         passkey_prompt_count?: number | undefined;
         passkey_prompt_dismissed_at?: string | null | undefined;
         phone?: string | null | undefined;
         phone_e164?: boolean | undefined;
         phone_verified: boolean;
-        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
         phone_verified_at?: string | null | undefined;
         country_iso?: string | null | undefined;
         birth_date?: string | null | undefined;
@@ -5309,6 +5363,41 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         createdAt: string;
         updatedAt?: string | undefined;
     }>;
+    /**
+     * `POST /user/import` — operationId: `user/import`
+     *
+     * Import users, with their password hashes
+     *
+     * Creates up to 500 users per request, for migrations from another provider. Each row can carry a `password_hash` exported from that provider (bcrypt, scrypt, Firebase scrypt, PBKDF2, argon2): the user signs in with their existing password and the hash is upgraded to argon2id on that first login. Fast digests (MD5, SHA-1, SHA-2) and low costs are refused per row with `weak_password_hash`. Rows are matched by email, so the same file can be sent twice: existing users are `skipped` unless `update_existing`. A bad row never fails the batch: each row gets its own `status` and `error`. Imported users get none of the built-in new-user emails. The response never contains a hash, and neither does the audit log.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userImport(data: OpBody<"user/import">): Promise<{
+        summary: {
+            total: number;
+            created: number;
+            updated: number;
+            skipped: number;
+            error: number;
+        };
+        results: {
+            index: number;
+            email: string;
+            status: "error" | "created" | "skipped" | "updated";
+            user_id?: string | undefined;
+            error?: {
+                code: string;
+                message: string;
+            } | undefined;
+        }[];
+    }>;
     /**
      * `GET /user` — operationId: `user/list`
      *
@@ -5337,18 +5426,19 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             nickname?: string | null | undefined;
             email?: string | null | undefined;
             email_verified: boolean;
-            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
             email_verified_at?: string | null | undefined;
             email_change_locked_at?: string | null | undefined;
             email_bounced_at?: string | null | undefined;
             welcome_sent_at?: string | null | undefined;
+            imported_at?: string | null | undefined;
             passkey_prompted_at?: string | null | undefined;
             passkey_prompt_count?: number | undefined;
             passkey_prompt_dismissed_at?: string | null | undefined;
             phone?: string | null | undefined;
             phone_e164?: boolean | undefined;
             phone_verified: boolean;
-            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
             phone_verified_at?: string | null | undefined;
             country_iso?: string | null | undefined;
             birth_date?: string | null | undefined;
@@ -5396,18 +5486,19 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             nickname?: string | null | undefined;
             email?: string | null | undefined;
             email_verified: boolean;
-            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
             email_verified_at?: string | null | undefined;
             email_change_locked_at?: string | null | undefined;
             email_bounced_at?: string | null | undefined;
             welcome_sent_at?: string | null | undefined;
+            imported_at?: string | null | undefined;
             passkey_prompted_at?: string | null | undefined;
             passkey_prompt_count?: number | undefined;
             passkey_prompt_dismissed_at?: string | null | undefined;
             phone?: string | null | undefined;
             phone_e164?: boolean | undefined;
             phone_verified: boolean;
-            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
             phone_verified_at?: string | null | undefined;
             country_iso?: string | null | undefined;
             birth_date?: string | null | undefined;
@@ -5458,18 +5549,19 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             nickname?: string | null | undefined;
             email?: string | null | undefined;
             email_verified: boolean;
-            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
             email_verified_at?: string | null | undefined;
             email_change_locked_at?: string | null | undefined;
             email_bounced_at?: string | null | undefined;
             welcome_sent_at?: string | null | undefined;
+            imported_at?: string | null | undefined;
             passkey_prompted_at?: string | null | undefined;
             passkey_prompt_count?: number | undefined;
             passkey_prompt_dismissed_at?: string | null | undefined;
             phone?: string | null | undefined;
             phone_e164?: boolean | undefined;
             phone_verified: boolean;
-            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
             phone_verified_at?: string | null | undefined;
             country_iso?: string | null | undefined;
             birth_date?: string | null | undefined;
@@ -5630,18 +5722,19 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         nickname?: string | null | undefined;
         email?: string | null | undefined;
         email_verified: boolean;
-        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
         email_verified_at?: string | null | undefined;
         email_change_locked_at?: string | null | undefined;
         email_bounced_at?: string | null | undefined;
         welcome_sent_at?: string | null | undefined;
+        imported_at?: string | null | undefined;
         passkey_prompted_at?: string | null | undefined;
         passkey_prompt_count?: number | undefined;
         passkey_prompt_dismissed_at?: string | null | undefined;
         phone?: string | null | undefined;
         phone_e164?: boolean | undefined;
         phone_verified: boolean;
-        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null | undefined;
+        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null | undefined;
         phone_verified_at?: string | null | undefined;
         country_iso?: string | null | undefined;
         birth_date?: string | null | undefined;

package/dist/api/generated-client.js

@@ -744,8 +744,11 @@ export class GeneratedFaableAuthApi extends FaableApi {
      *
      * Set a credential's password
      *
-     * Sets or rotates the password for a database credential. The previous password is invalidated immediately. Records a `credential.password_changed` audit entry (initiated_by=admin) for traceability. The confirmation email is only sent when an EXISTING password is rotated: setting the first password on a credential that had none is a creation, not a change. The password is never returned.
+     * Sets or rotates the password for a database credential. Send exactly one of `password` (plaintext, hashed with argon2id) or `password_hash` (a hash exported from another provider: bcrypt, scrypt, Firebase scrypt, PBKDF2 or argon2 — verified on the first login and upgraded to argon2id). The previous password is invalidated immediately. A plaintext password records a `credential.password_changed` audit entry (initiated_by=admin); the confirmation email is only sent when an EXISTING password is rotated. An imported hash records `credential.password_imported` with its algorithm and sends no email. Neither the password nor the hash is ever returned or logged.
      *
+     * @throws {FaableApiError} `bad_request` (400) — The request is malformed. `message` says what is wrong.
+     * @throws {FaableApiError} `invalid_password_hash` (400) — The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.
+     * @throws {FaableApiError} `weak_password_hash` (400) — The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.
      * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
      * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
      * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
@@ -1964,6 +1967,26 @@ export class GeneratedFaableAuthApi extends FaableApi {
         requireId("factor_id", factor_id);
         return this.fetcher.delete(`/user/${user_id}/factors/${factor_id}`);
     }
+    /**
+     * `GET /user/export` — operationId: `user/export`
+     *
+     * Export users, optionally with their password hashes
+     *
+     * Pages through every user of the tenant, 500 at a time, in the row shape `POST /user/import` takes. With `include_hashes` each row carries its `password_hash` (needs the `read:password_hashes` scope, is audited as `credentials.exported` and notifies its subscribers). Provider access and refresh tokens of linked identities are never exported. Available on every plan.
+     *
+     * @throws {FaableApiError} `invalid_connection` (400) — The connection does not exist, is disabled, or is not of the type this flow needs.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userExport(params) {
+        return this.fetcher.request({ method: "GET", url: `/user/export`, params });
+    }
     /**
      * `GET /user/{user_id}/factors` — operationId: `user/factors`
      *
@@ -2005,6 +2028,25 @@ export class GeneratedFaableAuthApi extends FaableApi {
         requireId("user_id", user_id);
         return this.fetcher.get(`/user/${user_id}`);
     }
+    /**
+     * `POST /user/import` — operationId: `user/import`
+     *
+     * Import users, with their password hashes
+     *
+     * Creates up to 500 users per request, for migrations from another provider. Each row can carry a `password_hash` exported from that provider (bcrypt, scrypt, Firebase scrypt, PBKDF2, argon2): the user signs in with their existing password and the hash is upgraded to argon2id on that first login. Fast digests (MD5, SHA-1, SHA-2) and low costs are refused per row with `weak_password_hash`. Rows are matched by email, so the same file can be sent twice: existing users are `skipped` unless `update_existing`. A bad row never fails the batch: each row gets its own `status` and `error`. Imported users get none of the built-in new-user emails. The response never contains a hash, and neither does the audit log.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userImport(data) {
+        return this.fetcher.post(`/user/import`, data);
+    }
     /**
      * `GET /user` — operationId: `user/list`
      *