@faable/auth-sdk 2.7.27 → 2.7.29

package/dist/api/types.d.ts

@@ -760,6 +760,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/user/import": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Import users, with their password hashes
+         * @description Creates up to 500 users per request, for migrations from another provider. Each row can carry a `password_hash` exported from that provider (bcrypt, scrypt, Firebase scrypt, PBKDF2, argon2): the user signs in with their existing password and the hash is upgraded to argon2id on that first login. Fast digests (MD5, SHA-1, SHA-2) and low costs are refused per row with `weak_password_hash`. Rows are matched by email, so the same file can be sent twice: existing users are `skipped` unless `update_existing`. A bad row never fails the batch: each row gets its own `status` and `error`. Imported users get none of the built-in new-user emails. The response never contains a hash, and neither does the audit log.
+         */
+        post: operations["user/import"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/user/export": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Export users, optionally with their password hashes
+         * @description Pages through every user of the tenant, 500 at a time, in the row shape `POST /user/import` takes. With `include_hashes` each row carries its `password_hash` (needs the `read:password_hashes` scope, is audited as `credentials.exported` and notifies its subscribers). Provider access and refresh tokens of linked identities are never exported. Available on every plan.
+         */
+        get: operations["user/export"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/identity": {
         parameters: {
             query?: never;
@@ -891,7 +931,7 @@ export interface paths {
         put?: never;
         /**
          * Set a credential's password
-         * @description Sets or rotates the password for a database credential. The previous password is invalidated immediately. Records a `credential.password_changed` audit entry (initiated_by=admin) for traceability. The confirmation email is only sent when an EXISTING password is rotated: setting the first password on a credential that had none is a creation, not a change. The password is never returned.
+         * @description Sets or rotates the password for a database credential. Send exactly one of `password` (plaintext, hashed with argon2id) or `password_hash` (a hash exported from another provider: bcrypt, scrypt, Firebase scrypt, PBKDF2 or argon2 — verified on the first login and upgraded to argon2id). The previous password is invalidated immediately. A plaintext password records a `credential.password_changed` audit entry (initiated_by=admin); the confirmation email is only sent when an EXISTING password is rotated. An imported hash records `credential.password_imported` with its algorithm and sends no email. Neither the password nor the hash is ever returned or logged.
          */
         post: operations["credentials/setPassword"];
         delete?: never;
@@ -4727,8 +4767,8 @@ export interface components {
              * @default false
              */
             email_verified: boolean;
-            /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `password_reset` — user completed the recovery link that was emailed to them (the `email` channel only). `null` — the field was cleared (admin un-verified the email). */
-            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null;
+            /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `password_reset` — user completed the recovery link that was emailed to them (the `email` channel only). `import` — the user arrived verified from another provider through `POST /user/import` (asserted by whoever ran the migration). `null` — the field was cleared (admin un-verified the email). */
+            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null;
             /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
             email_verified_at?: string | null;
             /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -4737,6 +4777,8 @@ export interface components {
             email_bounced_at?: string | null;
             /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
             welcome_sent_at?: string | null;
+            /** @description ISO 8601 timestamp of when the user was created by `POST /user/import`. Imported users get none of the built-in new-user emails (verification, welcome, `user.created` notifications); `user.created` webhooks still fire and carry this field. */
+            imported_at?: string | null;
             /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
             passkey_prompted_at?: string | null;
             /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
@@ -4750,7 +4792,7 @@ export interface components {
             /** @description phone is verified */
             phone_verified: boolean;
             /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
-            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null;
+            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null;
             /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
             phone_verified_at?: string | null;
             /** @description country iso code */
@@ -6305,6 +6347,8 @@ export interface components {
          *     - `same_email` (400): The new email is the same as the current one.
          *     - `user_has_no_email` (400): The operation needs an email but the user has none.
          *     - `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.
+         *     - `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.
+         *     - `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.
          *     - `invalid_code` (400): The verification code is wrong, expired or already used.
          *     - `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.
          *     - `phone_changed` (400): The phone on the user changed after the code was sent. Start again.
@@ -6374,7 +6418,7 @@ export interface components {
          *     - `revision_not_found` (404): The revision is not in the flow history.
          * @enum {string}
          */
-        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "plan_required" | "not_logged_in" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "signup_disabled" | "email_taken" | "invalid_email" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found";
+        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "plan_required" | "not_logged_in" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "signup_disabled" | "email_taken" | "invalid_email" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found";
         /** @description Every error response has this shape. Branch on `error_code`, never on `message`: the message is written for a person and may change. */
         ErrorResponse: {
             /** @description The HTTP status, repeated. */
@@ -10769,8 +10813,8 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
-                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `password_reset` — user completed the recovery link that was emailed to them (the `email` channel only). `null` — the field was cleared (admin un-verified the email). */
-                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null;
+                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `password_reset` — user completed the recovery link that was emailed to them (the `email` channel only). `import` — the user arrived verified from another provider through `POST /user/import` (asserted by whoever ran the migration). `null` — the field was cleared (admin un-verified the email). */
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null;
                         /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
                         email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -10779,6 +10823,8 @@ export interface operations {
                         email_bounced_at?: string | null;
                         /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
                         welcome_sent_at?: string | null;
+                        /** @description ISO 8601 timestamp of when the user was created by `POST /user/import`. Imported users get none of the built-in new-user emails (verification, welcome, `user.created` notifications); `user.created` webhooks still fire and carry this field. */
+                        imported_at?: string | null;
                         /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
                         passkey_prompted_at?: string | null;
                         /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
@@ -10792,7 +10838,7 @@ export interface operations {
                         /** @description phone is verified */
                         phone_verified: boolean;
                         /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
-                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null;
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null;
                         /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
                         phone_verified_at?: string | null;
                         /** @description country iso code */
@@ -10995,8 +11041,8 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
-                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `password_reset` — user completed the recovery link that was emailed to them (the `email` channel only). `null` — the field was cleared (admin un-verified the email). */
-                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null;
+                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `password_reset` — user completed the recovery link that was emailed to them (the `email` channel only). `import` — the user arrived verified from another provider through `POST /user/import` (asserted by whoever ran the migration). `null` — the field was cleared (admin un-verified the email). */
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null;
                         /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
                         email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -11005,6 +11051,8 @@ export interface operations {
                         email_bounced_at?: string | null;
                         /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
                         welcome_sent_at?: string | null;
+                        /** @description ISO 8601 timestamp of when the user was created by `POST /user/import`. Imported users get none of the built-in new-user emails (verification, welcome, `user.created` notifications); `user.created` webhooks still fire and carry this field. */
+                        imported_at?: string | null;
                         /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
                         passkey_prompted_at?: string | null;
                         /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
@@ -11018,7 +11066,7 @@ export interface operations {
                         /** @description phone is verified */
                         phone_verified: boolean;
                         /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
-                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null;
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null;
                         /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
                         phone_verified_at?: string | null;
                         /** @description country iso code */
@@ -11265,8 +11313,8 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
-                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `password_reset` — user completed the recovery link that was emailed to them (the `email` channel only). `null` — the field was cleared (admin un-verified the email). */
-                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null;
+                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `password_reset` — user completed the recovery link that was emailed to them (the `email` channel only). `import` — the user arrived verified from another provider through `POST /user/import` (asserted by whoever ran the migration). `null` — the field was cleared (admin un-verified the email). */
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null;
                         /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
                         email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -11275,6 +11323,8 @@ export interface operations {
                         email_bounced_at?: string | null;
                         /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
                         welcome_sent_at?: string | null;
+                        /** @description ISO 8601 timestamp of when the user was created by `POST /user/import`. Imported users get none of the built-in new-user emails (verification, welcome, `user.created` notifications); `user.created` webhooks still fire and carry this field. */
+                        imported_at?: string | null;
                         /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
                         passkey_prompted_at?: string | null;
                         /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
@@ -11288,7 +11338,7 @@ export interface operations {
                         /** @description phone is verified */
                         phone_verified: boolean;
                         /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
-                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null;
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null;
                         /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
                         phone_verified_at?: string | null;
                         /** @description country iso code */
@@ -11497,8 +11547,8 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
-                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `password_reset` — user completed the recovery link that was emailed to them (the `email` channel only). `null` — the field was cleared (admin un-verified the email). */
-                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null;
+                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `password_reset` — user completed the recovery link that was emailed to them (the `email` channel only). `import` — the user arrived verified from another provider through `POST /user/import` (asserted by whoever ran the migration). `null` — the field was cleared (admin un-verified the email). */
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null;
                         /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
                         email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -11507,6 +11557,8 @@ export interface operations {
                         email_bounced_at?: string | null;
                         /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
                         welcome_sent_at?: string | null;
+                        /** @description ISO 8601 timestamp of when the user was created by `POST /user/import`. Imported users get none of the built-in new-user emails (verification, welcome, `user.created` notifications); `user.created` webhooks still fire and carry this field. */
+                        imported_at?: string | null;
                         /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
                         passkey_prompted_at?: string | null;
                         /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
@@ -11520,7 +11572,7 @@ export interface operations {
                         /** @description phone is verified */
                         phone_verified: boolean;
                         /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
-                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null;
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null;
                         /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
                         phone_verified_at?: string | null;
                         /** @description country iso code */
@@ -13114,6 +13166,326 @@ export interface operations {
             };
         };
     };
+    "user/import": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    users: {
+                        /** @description The user's email. */
+                        email: string;
+                        /** @description The email was verified at the previous provider. Recorded with `email_verified_method: import`. */
+                        email_verified?: boolean;
+                        name?: string;
+                        given_name?: string;
+                        family_name?: string;
+                        phone?: string;
+                        birth_date?: string;
+                        locale?: string;
+                        picture?: string;
+                        /** @description User Metadata */
+                        user_metadata?: {
+                            [key: string]: unknown;
+                        };
+                        /** @description App Metadata */
+                        app_metadata?: {
+                            [key: string]: unknown;
+                        };
+                        /** @description A password hash exported from another provider. Verified on the first login and upgraded to argon2id. Fast digests (MD5, SHA-1, SHA-2) and low costs are refused with `weak_password_hash`. */
+                        password_hash?: string | {
+                            /** @description `bcrypt`, `argon2id`, `argon2i`, `argon2d`, `scrypt`, `pbkdf2-sha256`, `pbkdf2-sha512` or `firebase-scrypt`. */
+                            algorithm: string;
+                            /** @description The hash, or its base64 digest when `salt` is given. */
+                            hash: string;
+                            /** @description Base64 salt. */
+                            salt?: string;
+                            /** @description Algorithm parameters: `iterations` (pbkdf2); `N`, `r`, `p` (scrypt); `signer_key`, `salt_separator`, `rounds`, `mem_cost` (firebase-scrypt). */
+                            params?: {
+                                [key: string]: number | string;
+                            };
+                        };
+                        identities?: {
+                            /** @description connection_name of the social/enterprise connection. */
+                            connection: string;
+                            /** @description The user's id at the provider (GitHub id, Google `sub`…), so their first social login finds this user instead of creating a new one. */
+                            identity_id: string;
+                            /** @description Provider profile, stored as-is. */
+                            profile_data?: {
+                                [key: string]: unknown;
+                            };
+                        }[];
+                    }[];
+                    /** @description connection_name of the database connection the password hashes go to. Defaults to the tenant database connection. */
+                    connection?: string;
+                    /**
+                     * @description Set the password hash and identities of users that already exist (matched by email) instead of skipping them. Their profile is never overwritten.
+                     * @default false
+                     */
+                    update_existing?: boolean;
+                    /**
+                     * @description Validate every row and resolve every match without writing anything.
+                     * @default false
+                     */
+                    dry_run?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        summary: {
+                            total: number;
+                            created: number;
+                            updated: number;
+                            skipped: number;
+                            error: number;
+                        };
+                        results: {
+                            /** @description Position of the row in `users`. */
+                            index: number;
+                            email: string;
+                            status: "created" | "updated" | "skipped" | "error";
+                            user_id?: string;
+                            error?: {
+                                code: string;
+                                message: string;
+                            };
+                        }[];
+                    };
+                };
+            };
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "user/export": {
+        parameters: {
+            query?: {
+                /** @description `next_cursor` of the previous page. */
+                cursor?: string;
+                limit?: number;
+                /** @description connection_name of the database connection whose password hashes are exported. Defaults to the tenant database connection. */
+                connection?: string;
+                /** @description Include `password_hash`. Needs the `read:password_hashes` scope, is written to the audit log and notifies the `credentials.exported` subscribers. */
+                include_hashes?: boolean;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        users: {
+                            user_id: string;
+                            email: string | null;
+                            email_verified: boolean;
+                            name?: string;
+                            given_name?: string;
+                            family_name?: string;
+                            phone?: string;
+                            birth_date?: string;
+                            locale?: string;
+                            picture?: string;
+                            user_metadata?: {
+                                [key: string]: unknown;
+                            };
+                            app_metadata?: {
+                                [key: string]: unknown;
+                            };
+                            /** @description `legacy_unexportable`: the password is still stored in a pre-2026 format that is not exported; it upgrades on the next login. */
+                            password_hash_status: "set" | "not_set" | "no_credential" | "legacy_unexportable";
+                            /** @description Self-describing hash (argon2id PHC for passwords set on Faable; the original format for imported ones not yet upgraded). Only with `include_hashes`. */
+                            password_hash?: string;
+                            identities?: {
+                                connection: string;
+                                identity_id: string;
+                                profile_data?: {
+                                    [key: string]: unknown;
+                                };
+                            }[];
+                        }[];
+                        next_cursor: string | null;
+                        connection: string | null;
+                    };
+                };
+            };
+            /**
+             * @description `invalid_connection` — The connection does not exist, is disabled, or is not of the type this flow needs.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_connection" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
     "identity/list": {
         parameters: {
             query?: {
@@ -14453,7 +14825,20 @@ export interface operations {
             content: {
                 "application/json": {
                     /** @description New plaintext password (hashed on write). */
-                    password: string;
+                    password?: string;
+                    /** @description A password hash exported from another provider. Verified on the first login and upgraded to argon2id. Fast digests (MD5, SHA-1, SHA-2) and low costs are refused with `weak_password_hash`. */
+                    password_hash?: string | {
+                        /** @description `bcrypt`, `argon2id`, `argon2i`, `argon2d`, `scrypt`, `pbkdf2-sha256`, `pbkdf2-sha512` or `firebase-scrypt`. */
+                        algorithm: string;
+                        /** @description The hash, or its base64 digest when `salt` is given. */
+                        hash: string;
+                        /** @description Base64 salt. */
+                        salt?: string;
+                        /** @description Algorithm parameters: `iterations` (pbkdf2); `N`, `r`, `p` (scrypt); `signer_key`, `salt_separator`, `rounds`, `mem_cost` (firebase-scrypt). */
+                        params?: {
+                            [key: string]: number | string;
+                        };
+                    };
                 };
             };
         };
@@ -14489,7 +14874,15 @@ export interface operations {
                     };
                 };
             };
-            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            /**
+             * @description `bad_request` — The request is malformed. `message` says what is wrong.
+             *
+             *     `invalid_password_hash` — The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.
+             *
+             *     `weak_password_hash` — The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -14497,7 +14890,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "validation_error";
+                        error_code?: "bad_request" | "invalid_password_hash" | "weak_password_hash" | "validation_error";
                     };
                 };
             };
@@ -24049,8 +24442,8 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
-                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `password_reset` — user completed the recovery link that was emailed to them (the `email` channel only). `null` — the field was cleared (admin un-verified the email). */
-                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null;
+                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `password_reset` — user completed the recovery link that was emailed to them (the `email` channel only). `import` — the user arrived verified from another provider through `POST /user/import` (asserted by whoever ran the migration). `null` — the field was cleared (admin un-verified the email). */
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null;
                         /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
                         email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -24059,6 +24452,8 @@ export interface operations {
                         email_bounced_at?: string | null;
                         /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
                         welcome_sent_at?: string | null;
+                        /** @description ISO 8601 timestamp of when the user was created by `POST /user/import`. Imported users get none of the built-in new-user emails (verification, welcome, `user.created` notifications); `user.created` webhooks still fire and carry this field. */
+                        imported_at?: string | null;
                         /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
                         passkey_prompted_at?: string | null;
                         /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
@@ -24072,7 +24467,7 @@ export interface operations {
                         /** @description phone is verified */
                         phone_verified: boolean;
                         /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
-                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null;
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null;
                         /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
                         phone_verified_at?: string | null;
                         /** @description country iso code */
@@ -24334,8 +24729,8 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
-                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `password_reset` — user completed the recovery link that was emailed to them (the `email` channel only). `null` — the field was cleared (admin un-verified the email). */
-                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null;
+                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `password_reset` — user completed the recovery link that was emailed to them (the `email` channel only). `import` — the user arrived verified from another provider through `POST /user/import` (asserted by whoever ran the migration). `null` — the field was cleared (admin un-verified the email). */
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null;
                         /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
                         email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
@@ -24344,6 +24739,8 @@ export interface operations {
                         email_bounced_at?: string | null;
                         /** @description ISO 8601 timestamp of the built-in welcome email send. Set once by the platform; guarantees at most one welcome per user. */
                         welcome_sent_at?: string | null;
+                        /** @description ISO 8601 timestamp of when the user was created by `POST /user/import`. Imported users get none of the built-in new-user emails (verification, welcome, `user.created` notifications); `user.created` webhooks still fire and carry this field. */
+                        imported_at?: string | null;
                         /** @description ISO 8601 timestamp of the last time the hosted "create a passkey" offer was shown to this user after a login. Drives the snooze in `login_methods.passkey_promotion_snooze_days`. */
                         passkey_prompted_at?: string | null;
                         /** @description How many times the passkey offer has been shown to this user. Capped by `login_methods.passkey_promotion_max_prompts`; reset by an administrator through `POST /user/:id/passkey-prompt/reset`. */
@@ -24357,7 +24754,7 @@ export interface operations {
                         /** @description phone is verified */
                         phone_verified: boolean;
                         /** @description How `phone_verified` was last set. Same enum as `email_verified_method`, plus `sms_otp` — the user typed a code sent by SMS (`POST /user/:id/verify-phone/start`). */
-                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | null;
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | "sms_otp" | "password_reset" | "import" | null;
                         /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
                         phone_verified_at?: string | null;
                         /** @description country iso code */