@faable/auth-sdk 2.7.61 → 2.7.63

package/dist/api/api-types.d.ts

@@ -81,7 +81,6 @@ export type PermissionCreate = components["schemas"]["PermissionCreate"];
 export type Role = components["schemas"]["Role"];
 export type RoleCreate = components["schemas"]["RoleCreate"];
 export type RoleMember = components["schemas"]["RoleMember"];
-export type RoleMemberCreate = components["schemas"]["RoleMemberCreate"];
 export type RoleMemberMetadata = components["schemas"]["RoleMemberMetadata"];
 export type RoleMetadata = components["schemas"]["RoleMetadata"];
 export type RoleMetadataCreate = components["schemas"]["RoleMetadataCreate"];
@@ -91,7 +90,6 @@ export type SessionMetadata = components["schemas"]["SessionMetadata"];
 export type Team = components["schemas"]["Team"];
 export type TeamCreate = components["schemas"]["TeamCreate"];
 export type TeamMember = components["schemas"]["TeamMember"];
-export type TeamMemberCreate = components["schemas"]["TeamMemberCreate"];
 export type TeamMemberMetadata = components["schemas"]["TeamMemberMetadata"];
 export type TeamMetadata = components["schemas"]["TeamMetadata"];
 export type TeamMetadataCreate = components["schemas"]["TeamMetadataCreate"];

package/dist/api/generated-client.d.ts

@@ -4088,8 +4088,13 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         active: boolean;
         config: {
             url: string;
-            secret: string;
+            previous_secret_expires_at?: string | undefined;
         };
+        status?: "healthy" | "failing" | undefined;
+        consecutive_failures?: number | undefined;
+        last_failure_at?: string | undefined;
+        last_success_at?: string | undefined;
+        secret?: string | undefined;
         account: string;
         metadata: {
             [key: string]: unknown;
@@ -4134,8 +4139,13 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         active: boolean;
         config: {
             url: string;
-            secret: string;
+            previous_secret_expires_at?: string | undefined;
         };
+        status?: "healthy" | "failing" | undefined;
+        consecutive_failures?: number | undefined;
+        last_failure_at?: string | undefined;
+        last_success_at?: string | undefined;
+        secret?: string | undefined;
         account: string;
         metadata: {
             [key: string]: unknown;
@@ -4181,8 +4191,13 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         active: boolean;
         config: {
             url: string;
-            secret: string;
+            previous_secret_expires_at?: string | undefined;
         };
+        status?: "healthy" | "failing" | undefined;
+        consecutive_failures?: number | undefined;
+        last_failure_at?: string | undefined;
+        last_success_at?: string | undefined;
+        secret?: string | undefined;
         account: string;
         metadata: {
             [key: string]: unknown;
@@ -4229,8 +4244,13 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             active: boolean;
             config: {
                 url: string;
-                secret: string;
+                previous_secret_expires_at?: string | undefined;
             };
+            status?: "healthy" | "failing" | undefined;
+            consecutive_failures?: number | undefined;
+            last_failure_at?: string | undefined;
+            last_success_at?: string | undefined;
+            secret?: string | undefined;
             account: string;
             metadata: {
                 [key: string]: unknown;
@@ -4259,8 +4279,13 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             active: boolean;
             config: {
                 url: string;
-                secret: string;
+                previous_secret_expires_at?: string | undefined;
             };
+            status?: "healthy" | "failing" | undefined;
+            consecutive_failures?: number | undefined;
+            last_failure_at?: string | undefined;
+            last_success_at?: string | undefined;
+            secret?: string | undefined;
             account: string;
             metadata: {
                 [key: string]: unknown;
@@ -4292,8 +4317,13 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             active: boolean;
             config: {
                 url: string;
-                secret: string;
+                previous_secret_expires_at?: string | undefined;
             };
+            status?: "healthy" | "failing" | undefined;
+            consecutive_failures?: number | undefined;
+            last_failure_at?: string | undefined;
+            last_success_at?: string | undefined;
+            secret?: string | undefined;
             account: string;
             metadata: {
                 [key: string]: unknown;
@@ -4302,6 +4332,75 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             updatedAt?: string | undefined;
         }>>;
     };
+    /**
+     * `POST /notificationsubscription/{notificationsubscription_id}/deliveries/{delivery_id}/redeliver` — operationId: `notificationsubscription/redeliver`
+     *
+     * Redeliver a webhook delivery
+     *
+     * Queues a past delivery (succeeded, failed or still retrying) to be sent again within the next few seconds, with the same event id (`x-faable-delivery`) and a fresh retry schedule (1 min, 5 min, 30 min, 2 h, 12 h on timeouts, network errors, 5xx and 429). The delivery id is `data.delivery_id` in the `webhook.<event>` Log rows. Deliveries are kept for 30 days after they finish.
+     *
+     * @throws {FaableApiError} `not_a_webhook` (400) — The operation only applies to `webhook` subscriptions.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `delivery_not_found` (404) — No webhook delivery with that id for this subscription.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `delivery_in_progress` (409) — The delivery is being attempted right now; retry the redeliver in a minute.
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    notificationsubscriptionRedeliver(notificationsubscription_id: string, delivery_id: string): Promise<void>;
+    /**
+     * `POST /notificationsubscription/{notificationsubscription_id}/rotate-secret` — operationId: `notificationsubscription/rotateSecret`
+     *
+     * Rotate a webhook's signing secret
+     *
+     * Replaces the signing secret with a new one (generated, or the one in the body) and keeps the previous one valid for 24 hours. During that overlap every delivery carries two signatures, `x-faable-signature: sha256=<new>,sha256=<previous>`, so receivers can switch to the new secret at their own pace: accept a delivery when any of the signatures matches. The new secret is returned only in this response. Rotating again during an overlap drops the oldest secret.
+     *
+     * @throws {FaableApiError} `not_a_webhook` (400) — The operation only applies to `webhook` subscriptions.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    notificationsubscriptionRotateSecret(notificationsubscription_id: string, data: OpBody<"notificationsubscription/rotateSecret">): Promise<{
+        id: string;
+        secret: string;
+        previous_secret_expires_at: string;
+    }>;
+    /**
+     * `POST /notificationsubscription/{notificationsubscription_id}/test` — operationId: `notificationsubscription/test`
+     *
+     * Send a test event to a webhook
+     *
+     * Sends a signed `ping` event to the subscription URL right now and returns the outcome. The request is signed exactly like a real delivery (`x-faable-signature`, `x-faable-timestamp`, `x-faable-delivery`), with `payload: { subscription_id }`. It is not retried and is recorded in the Log as `webhook.ping`. A successful test sets a `failing` subscription back to `healthy`. Works on inactive subscriptions too.
+     *
+     * @throws {FaableApiError} `not_a_webhook` (400) — The operation only applies to `webhook` subscriptions.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    notificationsubscriptionTest(notificationsubscription_id: string): Promise<{
+        ok: boolean;
+        event_id: string;
+        status?: number | undefined;
+        duration_ms: number;
+        error?: string | undefined;
+    }>;
     /**
      * `POST /notificationsubscription/{notificationsubscription_id}` — operationId: `notificationsubscription/update`
      *
@@ -4340,8 +4439,13 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         active: boolean;
         config: {
             url: string;
-            secret: string;
+            previous_secret_expires_at?: string | undefined;
         };
+        status?: "healthy" | "failing" | undefined;
+        consecutive_failures?: number | undefined;
+        last_failure_at?: string | undefined;
+        last_success_at?: string | undefined;
+        secret?: string | undefined;
         account: string;
         metadata: {
             [key: string]: unknown;
@@ -4583,32 +4687,6 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             updatedAt?: string | undefined;
         }>>;
     };
-    /**
-     * `POST /rolemember` — operationId: `rolemember/create`
-     *
-     * Create Rolemember
-     *
-     * @throws {FaableApiError} `already_exists` (400) — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
-     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
-     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
-     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
-     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
-     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
-     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
-     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
-     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
-     */
-    rolememberCreate(data: OpBody<"rolemember/create">): Promise<{
-        id: string;
-        role: unknown;
-        user: unknown;
-        account: string;
-        metadata: {
-            [key: string]: unknown;
-        };
-        createdAt: string;
-        updatedAt?: string | undefined;
-    }>;
     /**
      * `DELETE /rolemember/{rolemember_id}` — operationId: `rolemember/delete`
      *
@@ -4894,6 +4972,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
      * Adds one or more Users of this tenant as members of the given Team, with the same roles. Users already in the team are skipped; `already_member` only when all of them are. A user or team that is not in this tenant is a 404. Returns the TeamMember record of the first user in `users`.
      *
      * @throws {FaableApiError} `already_member` (400) — The user is already a member of the team.
+     * @throws {FaableApiError} `invalid_role` (400) — The role belongs to another account.
      * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
      * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
      * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
@@ -5040,6 +5119,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
      * Invites a user by email. `mode='auto'` (default) adds the user directly when the email already corresponds to a user in this tenant and falls back to a ticketed invite + email otherwise. `mode='invite'` always issues a ticket + email even when the user exists. Re-inviting the same email to the same team invalidates the previous pending invite.
      *
      * @throws {FaableApiError} `invite_used` (400) — The invite was already accepted.
+     * @throws {FaableApiError} `invalid_role` (400) — The role belongs to another account.
      * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
      * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
      * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
@@ -5218,6 +5298,28 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             updatedAt?: string | undefined;
         }>>;
     };
+    /**
+     * `DELETE /team/{team_id}/member/{user_id}` — operationId: `team/removeMember`
+     *
+     * Remove a User from a Team
+     *
+     * Removes the User's membership of the given Team (the User itself is not deleted). Emits `team.member.removed` and leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_a_member` (404) — The user is not a member of the team.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    teamRemoveMember(team_id: string, user_id: string): Promise<{
+        id: string;
+        deleted: true;
+    }>;
     /**
      * `DELETE /team/{team_id}/invite/{ticket_id}` — operationId: `team/revokeInvite`
      *
@@ -5269,21 +5371,25 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         updatedAt?: string | undefined;
     }>;
     /**
-     * `POST /teammember` — operationId: `teammember/create`
+     * `POST /team/{team_id}/member/{user_id}` — operationId: `team/updateMember`
      *
-     * Create Teammember
+     * Change a Team member's roles
      *
-     * @throws {FaableApiError} `already_exists` (400) — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+     * Replaces the roles a User holds within the given Team. Every role must be a Role of this tenant. Emits `team.member.updated` when the roles actually change, and leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `invalid_role` (400) — The role belongs to another account.
      * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
      * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
      * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
      * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
      * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_a_member` (404) — The user is not a member of the team.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
      * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
      * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
      * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
      */
-    teammemberCreate(data: OpBody<"teammember/create">): Promise<{
+    teamUpdateMember(team_id: string, user_id: string, data: OpBody<"team/updateMember">): Promise<{
         id: string;
         user: unknown;
         team: unknown;

package/dist/api/generated-client.js

@@ -1444,6 +1444,75 @@ export class GeneratedFaableAuthApi extends FaableApi {
     notificationsubscriptionList(params) {
         return this.paginator({ url: `/notificationsubscription`, params });
     }
+    /**
+     * `POST /notificationsubscription/{notificationsubscription_id}/deliveries/{delivery_id}/redeliver` — operationId: `notificationsubscription/redeliver`
+     *
+     * Redeliver a webhook delivery
+     *
+     * Queues a past delivery (succeeded, failed or still retrying) to be sent again within the next few seconds, with the same event id (`x-faable-delivery`) and a fresh retry schedule (1 min, 5 min, 30 min, 2 h, 12 h on timeouts, network errors, 5xx and 429). The delivery id is `data.delivery_id` in the `webhook.<event>` Log rows. Deliveries are kept for 30 days after they finish.
+     *
+     * @throws {FaableApiError} `not_a_webhook` (400) — The operation only applies to `webhook` subscriptions.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `delivery_not_found` (404) — No webhook delivery with that id for this subscription.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `delivery_in_progress` (409) — The delivery is being attempted right now; retry the redeliver in a minute.
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    notificationsubscriptionRedeliver(notificationsubscription_id, delivery_id) {
+        requireId("notificationsubscription_id", notificationsubscription_id);
+        requireId("delivery_id", delivery_id);
+        return this.fetcher.post(`/notificationsubscription/${notificationsubscription_id}/deliveries/${delivery_id}/redeliver`, {});
+    }
+    /**
+     * `POST /notificationsubscription/{notificationsubscription_id}/rotate-secret` — operationId: `notificationsubscription/rotateSecret`
+     *
+     * Rotate a webhook's signing secret
+     *
+     * Replaces the signing secret with a new one (generated, or the one in the body) and keeps the previous one valid for 24 hours. During that overlap every delivery carries two signatures, `x-faable-signature: sha256=<new>,sha256=<previous>`, so receivers can switch to the new secret at their own pace: accept a delivery when any of the signatures matches. The new secret is returned only in this response. Rotating again during an overlap drops the oldest secret.
+     *
+     * @throws {FaableApiError} `not_a_webhook` (400) — The operation only applies to `webhook` subscriptions.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    notificationsubscriptionRotateSecret(notificationsubscription_id, data) {
+        requireId("notificationsubscription_id", notificationsubscription_id);
+        return this.fetcher.post(`/notificationsubscription/${notificationsubscription_id}/rotate-secret`, data);
+    }
+    /**
+     * `POST /notificationsubscription/{notificationsubscription_id}/test` — operationId: `notificationsubscription/test`
+     *
+     * Send a test event to a webhook
+     *
+     * Sends a signed `ping` event to the subscription URL right now and returns the outcome. The request is signed exactly like a real delivery (`x-faable-signature`, `x-faable-timestamp`, `x-faable-delivery`), with `payload: { subscription_id }`. It is not retried and is recorded in the Log as `webhook.ping`. A successful test sets a `failing` subscription back to `healthy`. Works on inactive subscriptions too.
+     *
+     * @throws {FaableApiError} `not_a_webhook` (400) — The operation only applies to `webhook` subscriptions.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    notificationsubscriptionTest(notificationsubscription_id) {
+        requireId("notificationsubscription_id", notificationsubscription_id);
+        return this.fetcher.post(`/notificationsubscription/${notificationsubscription_id}/test`, {});
+    }
     /**
      * `POST /notificationsubscription/{notificationsubscription_id}` — operationId: `notificationsubscription/update`
      *
@@ -1604,24 +1673,6 @@ export class GeneratedFaableAuthApi extends FaableApi {
         requireId("role_id", role_id);
         return this.paginator({ url: `/role/${role_id}/users`, params });
     }
-    /**
-     * `POST /rolemember` — operationId: `rolemember/create`
-     *
-     * Create Rolemember
-     *
-     * @throws {FaableApiError} `already_exists` (400) — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
-     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
-     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
-     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
-     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
-     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
-     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
-     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
-     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
-     */
-    rolememberCreate(data) {
-        return this.fetcher.post(`/rolemember`, data);
-    }
     /**
      * `DELETE /rolemember/{rolemember_id}` — operationId: `rolemember/delete`
      *
@@ -1754,6 +1805,7 @@ export class GeneratedFaableAuthApi extends FaableApi {
      * Adds one or more Users of this tenant as members of the given Team, with the same roles. Users already in the team are skipped; `already_member` only when all of them are. A user or team that is not in this tenant is a 404. Returns the TeamMember record of the first user in `users`.
      *
      * @throws {FaableApiError} `already_member` (400) — The user is already a member of the team.
+     * @throws {FaableApiError} `invalid_role` (400) — The role belongs to another account.
      * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
      * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
      * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
@@ -1857,6 +1909,7 @@ export class GeneratedFaableAuthApi extends FaableApi {
      * Invites a user by email. `mode='auto'` (default) adds the user directly when the email already corresponds to a user in this tenant and falls back to a ticketed invite + email otherwise. `mode='invite'` always issues a ticket + email even when the user exists. Re-inviting the same email to the same team invalidates the previous pending invite.
      *
      * @throws {FaableApiError} `invite_used` (400) — The invite was already accepted.
+     * @throws {FaableApiError} `invalid_role` (400) — The role belongs to another account.
      * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
      * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
      * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
@@ -1930,6 +1983,29 @@ export class GeneratedFaableAuthApi extends FaableApi {
         requireId("team_id", team_id);
         return this.paginator({ url: `/team/${team_id}/member`, params });
     }
+    /**
+     * `DELETE /team/{team_id}/member/{user_id}` — operationId: `team/removeMember`
+     *
+     * Remove a User from a Team
+     *
+     * Removes the User's membership of the given Team (the User itself is not deleted). Emits `team.member.removed` and leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_a_member` (404) — The user is not a member of the team.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    teamRemoveMember(team_id, user_id) {
+        requireId("team_id", team_id);
+        requireId("user_id", user_id);
+        return this.fetcher.delete(`/team/${team_id}/member/${user_id}`);
+    }
     /**
      * `DELETE /team/{team_id}/invite/{ticket_id}` — operationId: `team/revokeInvite`
      *
@@ -1974,22 +2050,28 @@ export class GeneratedFaableAuthApi extends FaableApi {
         return this.fetcher.post(`/team/${team_id}`, data);
     }
     /**
-     * `POST /teammember` — operationId: `teammember/create`
+     * `POST /team/{team_id}/member/{user_id}` — operationId: `team/updateMember`
      *
-     * Create Teammember
+     * Change a Team member's roles
      *
-     * @throws {FaableApiError} `already_exists` (400) — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.
+     * Replaces the roles a User holds within the given Team. Every role must be a Role of this tenant. Emits `team.member.updated` when the roles actually change, and leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `invalid_role` (400) — The role belongs to another account.
      * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
      * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
      * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
      * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
      * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_a_member` (404) — The user is not a member of the team.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
      * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
      * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
      * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
      */
-    teammemberCreate(data) {
-        return this.fetcher.post(`/teammember`, data);
+    teamUpdateMember(team_id, user_id, data) {
+        requireId("team_id", team_id);
+        requireId("user_id", user_id);
+        return this.fetcher.post(`/team/${team_id}/member/${user_id}`, data);
     }
     /**
      * `DELETE /teammember/{teammember_id}` — operationId: `teammember/delete`