@faable/auth-sdk 2.7.52 → 2.7.54

package/dist/FaableAuthApi.d.ts

@@ -58,6 +58,8 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             verify_email_auto_send: boolean;
         };
         email_reply_to?: string | null | undefined;
+        email_from_name?: string | null | undefined;
+        email_from_address?: string | null | undefined;
         welcome_email?: {
             cta_url?: string | null | undefined;
             body?: string | null | undefined;

package/dist/api/api-types.d.ts

@@ -1,4 +1,6 @@
 import type { components } from "./types.js";
+export type AccountEmailSenderBody = components["schemas"]["AccountEmailSenderBody"];
+export type AccountEmailSenderParams = components["schemas"]["AccountEmailSenderParams"];
 export type AccountNotificationSettings = components["schemas"]["AccountNotificationSettings"];
 export type AccountTransferBody = components["schemas"]["AccountTransferBody"];
 export type AccountTransferResponse = components["schemas"]["AccountTransferResponse"];

package/dist/api/generated-client.d.ts

@@ -57,6 +57,8 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             verify_email_auto_send: boolean;
         };
         email_reply_to?: string | null | undefined;
+        email_from_name?: string | null | undefined;
+        email_from_address?: string | null | undefined;
         welcome_email?: {
             cta_url?: string | null | undefined;
             body?: string | null | undefined;
@@ -132,6 +134,8 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             verify_email_auto_send: boolean;
         };
         email_reply_to?: string | null | undefined;
+        email_from_name?: string | null | undefined;
+        email_from_address?: string | null | undefined;
         welcome_email?: {
             cta_url?: string | null | undefined;
             body?: string | null | undefined;
@@ -191,6 +195,84 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
      * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
      */
     accountDelete(account_id: string): Promise<void>;
+    /**
+     * `POST /account/{account_id}/email_sender` — operationId: `account/email_sender`
+     *
+     * Set an Account's sender address
+     *
+     * Sets the From address of every email this Auth Account sends to its users. The address must be in a domain the platform signs email for. `null` returns to the platform default. Platform credentials only.
+     *
+     * @throws {FaableApiError} `email_sender_domain_not_allowed` (400) — The sender address is not in a domain this platform signs email for (AUTH_EMAIL_SENDER_DOMAINS).
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    accountEmailSender(account_id: string, data: OpBody<"account/email_sender">): Promise<{
+        id: string;
+        name: string;
+        domain: string;
+        slug: string;
+        logo_src?: string | null | undefined;
+        icon_src?: string | null | undefined;
+        callback_hostnames: string[];
+        token_signature: string;
+        token_signing_alg: "RS256";
+        default_connection?: unknown;
+        enabled_locales: string[];
+        tags?: string[] | undefined;
+        team?: string | null | undefined;
+        notification_settings: {
+            welcome_email_enabled: boolean;
+            verify_email_auto_send: boolean;
+        };
+        email_reply_to?: string | null | undefined;
+        email_from_name?: string | null | undefined;
+        email_from_address?: string | null | undefined;
+        welcome_email?: {
+            cta_url?: string | null | undefined;
+            body?: string | null | undefined;
+            social_links?: {
+                label: string;
+                url: string;
+            }[] | null | undefined;
+        } | null | undefined;
+        email_change_verification_mode?: "new_only" | "old_and_new" | undefined;
+        email_oauth_sync_policy?: "preserve_manual" | "always_sync" | undefined;
+        login_methods?: {
+            order?: string[] | undefined;
+            disabled_connections?: string[] | undefined;
+            passkey_login_enabled?: boolean | undefined;
+            identifier_first?: boolean | undefined;
+            remember_last_method?: boolean | undefined;
+            passkey_promotion?: "offer" | "off" | undefined;
+            passkey_promotion_snooze_days?: number | undefined;
+            passkey_promotion_max_prompts?: number | undefined;
+            remember_me?: "optional" | "off" | undefined;
+            remember_me_days?: number | undefined;
+        } | undefined;
+        login_flow?: string | null | undefined;
+        mfa_policy?: {
+            mode?: "required" | "optional" | "off" | undefined;
+            allowed_factors?: ("webauthn" | "totp")[] | undefined;
+            remember_device_days?: number | undefined;
+        } | undefined;
+        recovery_channels?: {
+            enabled?: ("email" | "sms" | "whatsapp" | "factor")[] | undefined;
+            default?: "email" | "sms" | "whatsapp" | "factor" | undefined;
+            visible?: ("email" | "sms" | "whatsapp" | "factor")[] | undefined;
+        } | undefined;
+        default_country_iso?: string | null | undefined;
+        webauthn_rp_id?: string | null | undefined;
+        logout_confirm_required?: boolean | undefined;
+        canonical_host?: string | null | undefined;
+        createdAt: string;
+        updatedAt?: string | undefined;
+    }>;
     /**
      * `GET /account/{account_id}` — operationId: `account/get`
      *
@@ -229,6 +311,8 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             verify_email_auto_send: boolean;
         };
         email_reply_to?: string | null | undefined;
+        email_from_name?: string | null | undefined;
+        email_from_address?: string | null | undefined;
         welcome_email?: {
             cta_url?: string | null | undefined;
             body?: string | null | undefined;
@@ -328,6 +412,8 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
                 verify_email_auto_send: boolean;
             };
             email_reply_to?: string | null | undefined;
+            email_from_name?: string | null | undefined;
+            email_from_address?: string | null | undefined;
             welcome_email?: {
                 cta_url?: string | null | undefined;
                 body?: string | null | undefined;
@@ -387,6 +473,8 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
                 verify_email_auto_send: boolean;
             };
             email_reply_to?: string | null | undefined;
+            email_from_name?: string | null | undefined;
+            email_from_address?: string | null | undefined;
             welcome_email?: {
                 cta_url?: string | null | undefined;
                 body?: string | null | undefined;
@@ -449,6 +537,8 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
                 verify_email_auto_send: boolean;
             };
             email_reply_to?: string | null | undefined;
+            email_from_name?: string | null | undefined;
+            email_from_address?: string | null | undefined;
             welcome_email?: {
                 cta_url?: string | null | undefined;
                 body?: string | null | undefined;
@@ -683,6 +773,8 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             verify_email_auto_send: boolean;
         };
         email_reply_to?: string | null | undefined;
+        email_from_name?: string | null | undefined;
+        email_from_address?: string | null | undefined;
         welcome_email?: {
             cta_url?: string | null | undefined;
             body?: string | null | undefined;

package/dist/api/generated-client.js

@@ -73,6 +73,27 @@ export class GeneratedFaableAuthApi extends FaableApi {
         requireId("account_id", account_id);
         return this.fetcher.delete(`/account/${account_id}`);
     }
+    /**
+     * `POST /account/{account_id}/email_sender` — operationId: `account/email_sender`
+     *
+     * Set an Account's sender address
+     *
+     * Sets the From address of every email this Auth Account sends to its users. The address must be in a domain the platform signs email for. `null` returns to the platform default. Platform credentials only.
+     *
+     * @throws {FaableApiError} `email_sender_domain_not_allowed` (400) — The sender address is not in a domain this platform signs email for (AUTH_EMAIL_SENDER_DOMAINS).
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    accountEmailSender(account_id, data) {
+        requireId("account_id", account_id);
+        return this.fetcher.post(`/account/${account_id}/email_sender`, data);
+    }
     /**
      * `GET /account/{account_id}` — operationId: `account/get`
      *

package/dist/api/types.d.ts

@@ -304,6 +304,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/account/{account_id}/email_sender": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Set an Account's sender address
+         * @description Sets the From address of every email this Auth Account sends to its users. The address must be in a domain the platform signs email for. `null` returns to the platform default. Platform credentials only.
+         */
+        post: operations["account/email_sender"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/connection": {
         parameters: {
             query?: never;
@@ -4444,6 +4464,10 @@ export interface components {
              * @description Reply-To on every email this tenant sends to its users. Absent = no Reply-To, so a reply goes to the From address — which is a `no-reply@` mailbox nobody reads. Set it to your own support address if you want your users to be able to answer.
              */
             email_reply_to?: string | null;
+            /** @description Display name on every email this tenant sends to its users. Absent = the account `name`. */
+            email_from_name?: string | null;
+            /** @description Sender address of every email this tenant sends to its users. Absent = the platform default. Set by Faable only. */
+            email_from_address?: string | null;
             welcome_email?: {
                 /**
                  * Format: uri
@@ -6423,6 +6447,13 @@ export interface components {
             tenants_left_in_source?: number;
             tenants_in_target?: number;
         };
+        AccountEmailSenderParams: {
+            account_id: string;
+        };
+        AccountEmailSenderBody: {
+            /** Format: email */
+            address: string | null;
+        };
         /** @description AuthAccountUpdate */
         AuthAccountUpdate: {
             name?: string;
@@ -6446,6 +6477,7 @@ export interface components {
             };
             /** Format: email */
             email_reply_to?: string | null;
+            email_from_name?: string | null;
             welcome_email?: {
                 /**
                  * Format: uri
@@ -6617,6 +6649,7 @@ export interface components {
          *     - `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.
          *     - `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.
          *     - `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.
+         *     - `email_sender_domain_not_allowed` (400): The sender address is not in a domain this platform signs email for (AUTH_EMAIL_SENDER_DOMAINS).
          *     - `plan_required` (402): The setting requires a higher plan. `message` says which.
          *     - `invalid_canonical_host` (400): `canonical_host` must be this account's own platform host or one of its verified custom domains.
          *     - `canonical_host_breaks_passkeys` (400): `canonical_host` is outside the account's current WebAuthn RP ID — every passkey already enrolled would stop working. Set `webauthn_rp_id` in the same request to a suffix that covers both.
@@ -6710,7 +6743,7 @@ export interface components {
          *     - `revision_not_found` (404): The revision is not in the flow history.
          * @enum {string}
          */
-        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found";
+        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found";
         /** @description Every error response has this shape. Branch on `error_code`, never on `message`: the message is written for a person and may change. */
         ErrorResponse: {
             /** @description The HTTP status, repeated. */
@@ -6791,6 +6824,10 @@ export interface operations {
                          * @description Reply-To on every email this tenant sends to its users. Absent = no Reply-To, so a reply goes to the From address — which is a `no-reply@` mailbox nobody reads. Set it to your own support address if you want your users to be able to answer.
                          */
                         email_reply_to?: string | null;
+                        /** @description Display name on every email this tenant sends to its users. Absent = the account `name`. */
+                        email_from_name?: string | null;
+                        /** @description Sender address of every email this tenant sends to its users. Absent = the platform default. Set by Faable only. */
+                        email_from_address?: string | null;
                         welcome_email?: {
                             /**
                              * Format: uri
@@ -7140,6 +7177,10 @@ export interface operations {
                          * @description Reply-To on every email this tenant sends to its users. Absent = no Reply-To, so a reply goes to the From address — which is a `no-reply@` mailbox nobody reads. Set it to your own support address if you want your users to be able to answer.
                          */
                         email_reply_to?: string | null;
+                        /** @description Display name on every email this tenant sends to its users. Absent = the account `name`. */
+                        email_from_name?: string | null;
+                        /** @description Sender address of every email this tenant sends to its users. Absent = the platform default. Set by Faable only. */
+                        email_from_address?: string | null;
                         welcome_email?: {
                             /**
                              * Format: uri
@@ -7377,6 +7418,10 @@ export interface operations {
                          * @description Reply-To on every email this tenant sends to its users. Absent = no Reply-To, so a reply goes to the From address — which is a `no-reply@` mailbox nobody reads. Set it to your own support address if you want your users to be able to answer.
                          */
                         email_reply_to?: string | null;
+                        /** @description Display name on every email this tenant sends to its users. Absent = the account `name`. */
+                        email_from_name?: string | null;
+                        /** @description Sender address of every email this tenant sends to its users. Absent = the platform default. Set by Faable only. */
+                        email_from_address?: string | null;
                         welcome_email?: {
                             /**
                              * Format: uri
@@ -7583,6 +7628,7 @@ export interface operations {
                     };
                     /** Format: email */
                     email_reply_to?: string | null;
+                    email_from_name?: string | null;
                     welcome_email?: {
                         /**
                          * Format: uri
@@ -7686,6 +7732,10 @@ export interface operations {
                          * @description Reply-To on every email this tenant sends to its users. Absent = no Reply-To, so a reply goes to the From address — which is a `no-reply@` mailbox nobody reads. Set it to your own support address if you want your users to be able to answer.
                          */
                         email_reply_to?: string | null;
+                        /** @description Display name on every email this tenant sends to its users. Absent = the account `name`. */
+                        email_from_name?: string | null;
+                        /** @description Sender address of every email this tenant sends to its users. Absent = the platform default. Set by Faable only. */
+                        email_from_address?: string | null;
                         welcome_email?: {
                             /**
                              * Format: uri
@@ -8883,6 +8933,235 @@ export interface operations {
             };
         };
     };
+    "account/email_sender": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                account_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** Format: email */
+                    address: string | null;
+                };
+            };
+        };
+        responses: {
+            /** @description AuthAccount */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description AuthAccount ID */
+                        id: string;
+                        name: string;
+                        domain: string;
+                        slug: string;
+                        logo_src?: string | null;
+                        icon_src?: string | null;
+                        callback_hostnames: string[];
+                        /** @description Shared HMAC secret. Used when token_signing_alg is an HS* algorithm; ignored for RS*\/ES*\/PS*. */
+                        token_signature: string;
+                        /** @description JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented. */
+                        token_signing_alg: "RS256";
+                        default_connection?: components["schemas"]["Connection"] | string | unknown;
+                        enabled_locales: string[];
+                        /** @description Free-form labels on the account. The dashboard stores the environment as an `env:<name>` tag (e.g. `env:production`, `env:staging`, `env:test`). */
+                        tags?: string[];
+                        team?: string | null;
+                        notification_settings: {
+                            /**
+                             * @description Send the built-in welcome email on user.created
+                             * @default false
+                             */
+                            welcome_email_enabled: boolean;
+                            /**
+                             * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                             * @default false
+                             */
+                            verify_email_auto_send: boolean;
+                        };
+                        /**
+                         * Format: email
+                         * @description Reply-To on every email this tenant sends to its users. Absent = no Reply-To, so a reply goes to the From address — which is a `no-reply@` mailbox nobody reads. Set it to your own support address if you want your users to be able to answer.
+                         */
+                        email_reply_to?: string | null;
+                        /** @description Display name on every email this tenant sends to its users. Absent = the account `name`. */
+                        email_from_name?: string | null;
+                        /** @description Sender address of every email this tenant sends to its users. Absent = the platform default. Set by Faable only. */
+                        email_from_address?: string | null;
+                        welcome_email?: {
+                            /**
+                             * Format: uri
+                             * @description Where the welcome button sends the user. Defaults to `https://<first callback hostname>`. Point it at your app (not your marketing site) so a fresh user lands somewhere useful.
+                             */
+                            cta_url?: string | null;
+                            /** @description Replaces the default one-line body ("Your account on … is ready to go."). Plain text, sent verbatim in every enabled locale. */
+                            body?: string | null;
+                            /** @description Rendered as a "Follow <account>" block after the button — GitHub, LinkedIn, X, YouTube… Empty or absent hides the block. */
+                            social_links?: {
+                                label: string;
+                                /** Format: uri */
+                                url: string;
+                            }[] | null;
+                        } | null;
+                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+                        email_change_verification_mode?: "new_only" | "old_and_new";
+                        /**
+                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                         *
+                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                         */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
+                        /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
+                        login_methods?: {
+                            /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                            order?: string[];
+                            /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
+                            disabled_connections?: string[];
+                            /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                            passkey_login_enabled?: boolean;
+                            /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                            identifier_first?: boolean;
+                            /** @description Surface the method the returning user chose last time. Defaults to false. */
+                            remember_last_method?: boolean;
+                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
+                            passkey_promotion?: "off" | "offer";
+                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
+                            passkey_promotion_snooze_days?: number;
+                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
+                            passkey_promotion_max_prompts?: number;
+                            /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
+                            remember_me?: "off" | "optional";
+                            /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
+                            remember_me_days?: number;
+                        };
+                        /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
+                        login_flow?: string | null;
+                        /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
+                        mfa_policy?: {
+                            /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                            mode?: "off" | "optional" | "required";
+                            /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                            allowed_factors?: ("totp" | "webauthn")[];
+                            /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                            remember_device_days?: number;
+                        };
+                        /** @description Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`. */
+                        recovery_channels?: {
+                            /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
+                            enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
+                            /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
+                            default?: "email" | "sms" | "whatsapp" | "factor";
+                            /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
+                            visible?: ("email" | "sms" | "whatsapp" | "factor")[];
+                        };
+                        /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
+                        default_country_iso?: string | null;
+                        /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
+                        webauthn_rp_id?: string | null;
+                        /** @description When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF). */
+                        logout_confirm_required?: boolean;
+                        /** @description The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host. */
+                        canonical_host?: string | null;
+                        /** @description AuthAccount creation date */
+                        createdAt: string;
+                        /** @description AuthAccount updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+            /**
+             * @description `email_sender_domain_not_allowed` — The sender address is not in a domain this platform signs email for (AUTH_EMAIL_SENDER_DOMAINS).
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "email_sender_domain_not_allowed" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
     "connection/list": {
         parameters: {
             query?: {

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.7.52";
+export const version = "2.7.54";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "50e7998";
+export const commit = "d5258a3";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.7.52",
+  "version": "2.7.54",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",