@faable/auth-sdk 2.7.44 → 2.7.46

package/dist/FaableAuthApi.d.ts

@@ -93,6 +93,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         } | undefined;
         default_country_iso?: string | null | undefined;
         webauthn_rp_id?: string | null | undefined;
+        logout_confirm_required?: boolean | undefined;
         createdAt: string;
         updatedAt?: string | undefined;
     }>;
@@ -793,6 +794,8 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             software_version?: string | null | undefined;
             frontchannel_logout_uri?: string | null | undefined;
             frontchannel_logout_session_required?: boolean | undefined;
+            backchannel_logout_uri?: string | null | undefined;
+            backchannel_logout_session_required?: boolean | undefined;
             login_methods?: {
                 order?: string[] | undefined;
                 disabled_connections?: string[] | undefined;
@@ -854,6 +857,8 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             software_version?: string | null | undefined;
             frontchannel_logout_uri?: string | null | undefined;
             frontchannel_logout_session_required?: boolean | undefined;
+            backchannel_logout_uri?: string | null | undefined;
+            backchannel_logout_session_required?: boolean | undefined;
             login_methods?: {
                 order?: string[] | undefined;
                 disabled_connections?: string[] | undefined;
@@ -918,6 +923,8 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             software_version?: string | null | undefined;
             frontchannel_logout_uri?: string | null | undefined;
             frontchannel_logout_session_required?: boolean | undefined;
+            backchannel_logout_uri?: string | null | undefined;
+            backchannel_logout_session_required?: boolean | undefined;
             login_methods?: {
                 order?: string[] | undefined;
                 disabled_connections?: string[] | undefined;
@@ -981,6 +988,8 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
         software_version?: string | null | undefined;
         frontchannel_logout_uri?: string | null | undefined;
         frontchannel_logout_session_required?: boolean | undefined;
+        backchannel_logout_uri?: string | null | undefined;
+        backchannel_logout_session_required?: boolean | undefined;
         login_methods?: {
             order?: string[] | undefined;
             disabled_connections?: string[] | undefined;

package/dist/api/generated-client.d.ts

@@ -91,6 +91,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         } | undefined;
         default_country_iso?: string | null | undefined;
         webauthn_rp_id?: string | null | undefined;
+        logout_confirm_required?: boolean | undefined;
         createdAt: string;
         updatedAt?: string | undefined;
     }>;
@@ -164,6 +165,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         } | undefined;
         default_country_iso?: string | null | undefined;
         webauthn_rp_id?: string | null | undefined;
+        logout_confirm_required?: boolean | undefined;
         createdAt: string;
         updatedAt?: string | undefined;
     }>;
@@ -259,6 +261,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         } | undefined;
         default_country_iso?: string | null | undefined;
         webauthn_rp_id?: string | null | undefined;
+        logout_confirm_required?: boolean | undefined;
         createdAt: string;
         updatedAt?: string | undefined;
     }>;
@@ -356,6 +359,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             } | undefined;
             default_country_iso?: string | null | undefined;
             webauthn_rp_id?: string | null | undefined;
+            logout_confirm_required?: boolean | undefined;
             createdAt: string;
             updatedAt?: string | undefined;
         }[]>;
@@ -413,6 +417,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             } | undefined;
             default_country_iso?: string | null | undefined;
             webauthn_rp_id?: string | null | undefined;
+            logout_confirm_required?: boolean | undefined;
             createdAt: string;
             updatedAt?: string | undefined;
         }>>;
@@ -473,6 +478,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             } | undefined;
             default_country_iso?: string | null | undefined;
             webauthn_rp_id?: string | null | undefined;
+            logout_confirm_required?: boolean | undefined;
             createdAt: string;
             updatedAt?: string | undefined;
         }>>;
@@ -702,6 +708,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         } | undefined;
         default_country_iso?: string | null | undefined;
         webauthn_rp_id?: string | null | undefined;
+        logout_confirm_required?: boolean | undefined;
         createdAt: string;
         updatedAt?: string | undefined;
     }>;
@@ -1218,6 +1225,8 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         software_version?: string | null | undefined;
         frontchannel_logout_uri?: string | null | undefined;
         frontchannel_logout_session_required?: boolean | undefined;
+        backchannel_logout_uri?: string | null | undefined;
+        backchannel_logout_session_required?: boolean | undefined;
         login_methods?: {
             order?: string[] | undefined;
             disabled_connections?: string[] | undefined;
@@ -1295,6 +1304,8 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         software_version?: string | null | undefined;
         frontchannel_logout_uri?: string | null | undefined;
         frontchannel_logout_session_required?: boolean | undefined;
+        backchannel_logout_uri?: string | null | undefined;
+        backchannel_logout_session_required?: boolean | undefined;
         login_methods?: {
             order?: string[] | undefined;
             disabled_connections?: string[] | undefined;
@@ -1373,6 +1384,8 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         software_version?: string | null | undefined;
         frontchannel_logout_uri?: string | null | undefined;
         frontchannel_logout_session_required?: boolean | undefined;
+        backchannel_logout_uri?: string | null | undefined;
+        backchannel_logout_session_required?: boolean | undefined;
         login_methods?: {
             order?: string[] | undefined;
             disabled_connections?: string[] | undefined;
@@ -1452,6 +1465,8 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             software_version?: string | null | undefined;
             frontchannel_logout_uri?: string | null | undefined;
             frontchannel_logout_session_required?: boolean | undefined;
+            backchannel_logout_uri?: string | null | undefined;
+            backchannel_logout_session_required?: boolean | undefined;
             login_methods?: {
                 order?: string[] | undefined;
                 disabled_connections?: string[] | undefined;
@@ -1513,6 +1528,8 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             software_version?: string | null | undefined;
             frontchannel_logout_uri?: string | null | undefined;
             frontchannel_logout_session_required?: boolean | undefined;
+            backchannel_logout_uri?: string | null | undefined;
+            backchannel_logout_session_required?: boolean | undefined;
             login_methods?: {
                 order?: string[] | undefined;
                 disabled_connections?: string[] | undefined;
@@ -1577,6 +1594,8 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             software_version?: string | null | undefined;
             frontchannel_logout_uri?: string | null | undefined;
             frontchannel_logout_session_required?: boolean | undefined;
+            backchannel_logout_uri?: string | null | undefined;
+            backchannel_logout_session_required?: boolean | undefined;
             login_methods?: {
                 order?: string[] | undefined;
                 disabled_connections?: string[] | undefined;
@@ -1657,6 +1676,8 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         software_version?: string | null | undefined;
         frontchannel_logout_uri?: string | null | undefined;
         frontchannel_logout_session_required?: boolean | undefined;
+        backchannel_logout_uri?: string | null | undefined;
+        backchannel_logout_session_required?: boolean | undefined;
         login_methods?: {
             order?: string[] | undefined;
             disabled_connections?: string[] | undefined;
@@ -1735,6 +1756,8 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         software_version?: string | null | undefined;
         frontchannel_logout_uri?: string | null | undefined;
         frontchannel_logout_session_required?: boolean | undefined;
+        backchannel_logout_uri?: string | null | undefined;
+        backchannel_logout_session_required?: boolean | undefined;
         login_methods?: {
             order?: string[] | undefined;
             disabled_connections?: string[] | undefined;

package/dist/api/types.d.ts

@@ -3916,6 +3916,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/logout/confirm": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Confirm a parked RP-Initiated Logout
+         * @description Finishes a `/logout` request that was parked pending confirmation (backlog §240) because it carried no verified `id_token_hint`. Single-use: the state cannot be replayed.
+         */
+        post: operations["session/logoutConfirm"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/authorize": {
         parameters: {
             query?: never;
@@ -4495,6 +4515,8 @@ export interface components {
             default_country_iso?: string | null;
             /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
             webauthn_rp_id?: string | null;
+            /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
+            logout_confirm_required?: boolean;
             /** @description AuthAccount creation date */
             createdAt: string;
             /** @description AuthAccount updated date */
@@ -4759,6 +4781,8 @@ export interface components {
             software_version?: string | null;
             frontchannel_logout_uri?: string | null;
             frontchannel_logout_session_required?: boolean;
+            backchannel_logout_uri?: string | null;
+            backchannel_logout_session_required?: boolean;
             /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
             login_methods?: {
                 /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
@@ -4880,6 +4904,8 @@ export interface components {
             software_version?: string | null;
             frontchannel_logout_uri?: string | null;
             frontchannel_logout_session_required?: boolean;
+            backchannel_logout_uri?: string | null;
+            backchannel_logout_session_required?: boolean;
             login_methods?: {
                 /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                 order?: string[];
@@ -6300,6 +6326,10 @@ export interface components {
             frontchannel_logout_uri?: string;
             /** @description OIDC Front-Channel Logout 1.0 — when true, the OP MUST include `iss` and `sid` parameters when calling the frontchannel_logout_uri. */
             frontchannel_logout_session_required?: boolean;
+            /** @description OIDC Back-Channel Logout 1.0 — URL the OP POSTs a signed `logout_token` to when a session this client took part in ends. */
+            backchannel_logout_uri?: string;
+            /** @description OIDC Back-Channel Logout 1.0 — when true, the `logout_token` MUST include a `sid` claim. */
+            backchannel_logout_session_required?: boolean;
             /** @description Non-standard (Auth0-compatible) — origins (scheme://host[:port], no path) allowed to make cross-origin (CORS) requests to the token and passwordless endpoints. Empty allows any origin. */
             web_origins?: string[];
         } & {
@@ -6329,6 +6359,8 @@ export interface components {
             software_version?: string;
             frontchannel_logout_uri?: string;
             frontchannel_logout_session_required?: boolean;
+            backchannel_logout_uri?: string;
+            backchannel_logout_session_required?: boolean;
             web_origins?: string[];
         } & {
             [key: string]: unknown;
@@ -6467,6 +6499,7 @@ export interface components {
             } | null;
             default_country_iso?: string | null;
             webauthn_rp_id?: string | null;
+            logout_confirm_required?: boolean | null;
             login_flow?: string | null;
         };
         FactorSummary: {
@@ -6822,6 +6855,8 @@ export interface operations {
                         default_country_iso?: string | null;
                         /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
                         webauthn_rp_id?: string | null;
+                        /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
+                        logout_confirm_required?: boolean;
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -7167,6 +7202,8 @@ export interface operations {
                         default_country_iso?: string | null;
                         /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
                         webauthn_rp_id?: string | null;
+                        /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
+                        logout_confirm_required?: boolean;
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -7398,6 +7435,8 @@ export interface operations {
                         default_country_iso?: string | null;
                         /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
                         webauthn_rp_id?: string | null;
+                        /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
+                        logout_confirm_required?: boolean;
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -7584,6 +7623,7 @@ export interface operations {
                     } | null;
                     default_country_iso?: string | null;
                     webauthn_rp_id?: string | null;
+                    logout_confirm_required?: boolean | null;
                     login_flow?: string | null;
                 };
             };
@@ -7701,6 +7741,8 @@ export interface operations {
                         default_country_iso?: string | null;
                         /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
                         webauthn_rp_id?: string | null;
+                        /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
+                        logout_confirm_required?: boolean;
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -10167,6 +10209,8 @@ export interface operations {
                         software_version?: string | null;
                         frontchannel_logout_uri?: string | null;
                         frontchannel_logout_session_required?: boolean;
+                        backchannel_logout_uri?: string | null;
+                        backchannel_logout_session_required?: boolean;
                         /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
                         login_methods?: {
                             /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
@@ -10363,6 +10407,8 @@ export interface operations {
                         software_version?: string | null;
                         frontchannel_logout_uri?: string | null;
                         frontchannel_logout_session_required?: boolean;
+                        backchannel_logout_uri?: string | null;
+                        backchannel_logout_session_required?: boolean;
                         /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
                         login_methods?: {
                             /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
@@ -10561,6 +10607,8 @@ export interface operations {
                     software_version?: string | null;
                     frontchannel_logout_uri?: string | null;
                     frontchannel_logout_session_required?: boolean;
+                    backchannel_logout_uri?: string | null;
+                    backchannel_logout_session_required?: boolean;
                     login_methods?: {
                         /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
                         order?: string[];
@@ -10650,6 +10698,8 @@ export interface operations {
                         software_version?: string | null;
                         frontchannel_logout_uri?: string | null;
                         frontchannel_logout_session_required?: boolean;
+                        backchannel_logout_uri?: string | null;
+                        backchannel_logout_session_required?: boolean;
                         /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
                         login_methods?: {
                             /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
@@ -10852,6 +10902,8 @@ export interface operations {
                         software_version?: string | null;
                         frontchannel_logout_uri?: string | null;
                         frontchannel_logout_session_required?: boolean;
+                        backchannel_logout_uri?: string | null;
+                        backchannel_logout_session_required?: boolean;
                         /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
                         login_methods?: {
                             /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
@@ -11052,6 +11104,8 @@ export interface operations {
                         software_version?: string | null;
                         frontchannel_logout_uri?: string | null;
                         frontchannel_logout_session_required?: boolean;
+                        backchannel_logout_uri?: string | null;
+                        backchannel_logout_session_required?: boolean;
                         /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
                         login_methods?: {
                             /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
@@ -26194,6 +26248,95 @@ export interface operations {
             };
         };
     };
+    "session/logoutConfirm": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The `state` the confirmation screen was opened with. */
+                    state: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /**
+             * @description `invalid_state` — The `state` is missing, expired, or does not describe a resumable step.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_state" | "validation_error";
+                    };
+                };
+            };
+            /** @description `state_mismatch` — The `state` belongs to another account, session, client or ceremony. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "state_mismatch";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
     authorize: {
         parameters: {
             query: {
@@ -27663,6 +27806,10 @@ export interface operations {
                     frontchannel_logout_uri?: string;
                     /** @description OIDC Front-Channel Logout 1.0 — when true, the OP MUST include `iss` and `sid` parameters when calling the frontchannel_logout_uri. */
                     frontchannel_logout_session_required?: boolean;
+                    /** @description OIDC Back-Channel Logout 1.0 — URL the OP POSTs a signed `logout_token` to when a session this client took part in ends. */
+                    backchannel_logout_uri?: string;
+                    /** @description OIDC Back-Channel Logout 1.0 — when true, the `logout_token` MUST include a `sid` claim. */
+                    backchannel_logout_session_required?: boolean;
                     /** @description Non-standard (Auth0-compatible) — origins (scheme://host[:port], no path) allowed to make cross-origin (CORS) requests to the token and passwordless endpoints. Empty allows any origin. */
                     web_origins?: string[];
                 } & {
@@ -27701,6 +27848,8 @@ export interface operations {
                         software_version?: string;
                         frontchannel_logout_uri?: string;
                         frontchannel_logout_session_required?: boolean;
+                        backchannel_logout_uri?: string;
+                        backchannel_logout_session_required?: boolean;
                         web_origins?: string[];
                     } & {
                         [key: string]: unknown;

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.7.44";
+export const version = "2.7.46";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "bbde982";
+export const commit = "fec6e7a";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.7.44",
+  "version": "2.7.46",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.44.0",
+    "version": "2.46.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -494,6 +494,10 @@
             "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
             "nullable": true
           },
+          "logout_confirm_required": {
+            "type": "boolean",
+            "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
+          },
           "createdAt": {
             "type": "string",
             "description": "AuthAccount creation date"
@@ -1489,6 +1493,13 @@
           "frontchannel_logout_session_required": {
             "type": "boolean"
           },
+          "backchannel_logout_uri": {
+            "type": "string",
+            "nullable": true
+          },
+          "backchannel_logout_session_required": {
+            "type": "boolean"
+          },
           "login_methods": {
             "type": "object",
             "properties": {
@@ -2128,6 +2139,13 @@
           "frontchannel_logout_session_required": {
             "type": "boolean"
           },
+          "backchannel_logout_uri": {
+            "type": "string",
+            "nullable": true
+          },
+          "backchannel_logout_session_required": {
+            "type": "boolean"
+          },
           "login_methods": {
             "anyOf": [
               {
@@ -6398,6 +6416,14 @@
             "type": "boolean",
             "description": "OIDC Front-Channel Logout 1.0 — when true, the OP MUST include `iss` and `sid` parameters when calling the frontchannel_logout_uri."
           },
+          "backchannel_logout_uri": {
+            "type": "string",
+            "description": "OIDC Back-Channel Logout 1.0 — URL the OP POSTs a signed `logout_token` to when a session this client took part in ends."
+          },
+          "backchannel_logout_session_required": {
+            "type": "boolean",
+            "description": "OIDC Back-Channel Logout 1.0 — when true, the `logout_token` MUST include a `sid` claim."
+          },
           "web_origins": {
             "type": "array",
             "items": {
@@ -6502,6 +6528,12 @@
           "frontchannel_logout_session_required": {
             "type": "boolean"
           },
+          "backchannel_logout_uri": {
+            "type": "string"
+          },
+          "backchannel_logout_session_required": {
+            "type": "boolean"
+          },
           "web_origins": {
             "type": "array",
             "items": {
@@ -7080,6 +7112,16 @@
             "type": "string",
             "nullable": true
           },
+          "logout_confirm_required": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
           "login_flow": {
             "type": "string",
             "nullable": true
@@ -8135,6 +8177,10 @@
                       "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
                       "nullable": true
                     },
+                    "logout_confirm_required": {
+                      "type": "boolean",
+                      "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
+                    },
                     "createdAt": {
                       "type": "string",
                       "description": "AuthAccount creation date"
@@ -8836,6 +8882,10 @@
                       "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
                       "nullable": true
                     },
+                    "logout_confirm_required": {
+                      "type": "boolean",
+                      "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
+                    },
                     "createdAt": {
                       "type": "string",
                       "description": "AuthAccount creation date"
@@ -9773,6 +9823,10 @@
                       "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
                       "nullable": true
                     },
+                    "logout_confirm_required": {
+                      "type": "boolean",
+                      "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
+                    },
                     "createdAt": {
                       "type": "string",
                       "description": "AuthAccount creation date"
@@ -10354,6 +10408,16 @@
                     "type": "string",
                     "nullable": true
                   },
+                  "logout_confirm_required": {
+                    "anyOf": [
+                      {
+                        "type": "boolean"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
                   "login_flow": {
                     "type": "string",
                     "nullable": true
@@ -10844,6 +10908,10 @@
                       "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
                       "nullable": true
                     },
+                    "logout_confirm_required": {
+                      "type": "boolean",
+                      "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
+                    },
                     "createdAt": {
                       "type": "string",
                       "description": "AuthAccount creation date"
@@ -16629,6 +16697,13 @@
                     "frontchannel_logout_session_required": {
                       "type": "boolean"
                     },
+                    "backchannel_logout_uri": {
+                      "type": "string",
+                      "nullable": true
+                    },
+                    "backchannel_logout_session_required": {
+                      "type": "boolean"
+                    },
                     "login_methods": {
                       "type": "object",
                       "properties": {
@@ -17241,6 +17316,13 @@
                     "frontchannel_logout_session_required": {
                       "type": "boolean"
                     },
+                    "backchannel_logout_uri": {
+                      "type": "string",
+                      "nullable": true
+                    },
+                    "backchannel_logout_session_required": {
+                      "type": "boolean"
+                    },
                     "login_methods": {
                       "type": "object",
                       "properties": {
@@ -17876,6 +17958,13 @@
                   "frontchannel_logout_session_required": {
                     "type": "boolean"
                   },
+                  "backchannel_logout_uri": {
+                    "type": "string",
+                    "nullable": true
+                  },
+                  "backchannel_logout_session_required": {
+                    "type": "boolean"
+                  },
                   "login_methods": {
                     "anyOf": [
                       {
@@ -18334,6 +18423,13 @@
                     "frontchannel_logout_session_required": {
                       "type": "boolean"
                     },
+                    "backchannel_logout_uri": {
+                      "type": "string",
+                      "nullable": true
+                    },
+                    "backchannel_logout_session_required": {
+                      "type": "boolean"
+                    },
                     "login_methods": {
                       "type": "object",
                       "properties": {
@@ -18946,6 +19042,13 @@
                     "frontchannel_logout_session_required": {
                       "type": "boolean"
                     },
+                    "backchannel_logout_uri": {
+                      "type": "string",
+                      "nullable": true
+                    },
+                    "backchannel_logout_session_required": {
+                      "type": "boolean"
+                    },
                     "login_methods": {
                       "type": "object",
                       "properties": {
@@ -19559,6 +19662,13 @@
                     "frontchannel_logout_session_required": {
                       "type": "boolean"
                     },
+                    "backchannel_logout_uri": {
+                      "type": "string",
+                      "nullable": true
+                    },
+                    "backchannel_logout_session_required": {
+                      "type": "boolean"
+                    },
                     "login_methods": {
                       "type": "object",
                       "properties": {
@@ -57604,6 +57714,166 @@
         }
       }
     },
+    "/logout/confirm": {
+      "post": {
+        "operationId": "session/logoutConfirm",
+        "summary": "Confirm a parked RP-Initiated Logout",
+        "tags": [
+          "session"
+        ],
+        "description": "Finishes a `/logout` request that was parked pending confirmation (backlog §240) because it carried no verified `id_token_hint`. Single-use: the state cannot be replayed.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "state"
+                ],
+                "properties": {
+                  "state": {
+                    "type": "string",
+                    "description": "The `state` the confirmation screen was opened with."
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Default Response"
+          },
+          "400": {
+            "description": "`invalid_state` — The `state` is missing, expired, or does not describe a resumable step.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_state",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`state_mismatch` — The `state` belongs to another account, session, client or ceremony.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "state_mismatch"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/authorize": {
       "get": {
         "operationId": "authorize",
@@ -60898,6 +61168,14 @@
                     "type": "boolean",
                     "description": "OIDC Front-Channel Logout 1.0 — when true, the OP MUST include `iss` and `sid` parameters when calling the frontchannel_logout_uri."
                   },
+                  "backchannel_logout_uri": {
+                    "type": "string",
+                    "description": "OIDC Back-Channel Logout 1.0 — URL the OP POSTs a signed `logout_token` to when a session this client took part in ends."
+                  },
+                  "backchannel_logout_session_required": {
+                    "type": "boolean",
+                    "description": "OIDC Back-Channel Logout 1.0 — when true, the `logout_token` MUST include a `sid` claim."
+                  },
                   "web_origins": {
                     "type": "array",
                     "items": {
@@ -61010,6 +61288,12 @@
                     "frontchannel_logout_session_required": {
                       "type": "boolean"
                     },
+                    "backchannel_logout_uri": {
+                      "type": "string"
+                    },
+                    "backchannel_logout_session_required": {
+                      "type": "boolean"
+                    },
                     "web_origins": {
                       "type": "array",
                       "items": {