@faable/auth-sdk 2.7.75 → 2.7.77

package/dist/api/types.d.ts

@@ -1383,7 +1383,7 @@ export interface paths {
         put?: never;
         /**
          * Accept a team invite for a signed-in user
-         * @description Accepts the invite whose secret is `token` on behalf of `user_id`, an existing user of this tenant. The user's email must be verified and equal to the invited one (`invite_email_mismatch` otherwise, with the invited address masked in `details`). Never creates a user. Use it from the page you gave as the invite's `accept_url`.
+         * @description Accepts the invite — by the `token` of its link, or by `invite_id` — on behalf of `user_id`, an existing user of this tenant. The user's email must be verified and equal to the invited one (`invite_email_mismatch` otherwise, with the invited address masked in `details`). Never creates a user. Use `token` from the page you gave as the invite's `accept_url`, and `invite_id` from a pending-invitation notice in your app.
          */
         post: operations["team/acceptInvite"];
         delete?: never;
@@ -1392,6 +1392,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/user/{user_id}/team-invites": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List a user's pending team invites
+         * @description Pending (not accepted, revoked, declined or expired) invites to any team of this tenant addressed to the user's email. Only when that email is verified; otherwise `email_verified: false` and an empty list.
+         */
+        get: operations["team/listInvitesForUser"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/team/invite/decline": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Decline a team invite for a signed-in user
+         * @description The invited user says no: the invite is spent (its link stops working) and `team.invite.revoked` is emitted with reason `declined`. Same checks as accepting.
+         */
+        post: operations["team/declineInvite"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api": {
         parameters: {
             query?: never;
@@ -4557,7 +4597,7 @@ export interface paths {
         put?: never;
         /**
          * Self-service signup
-         * @description Creates a new user and database credential (email + password) in a single call against the tenant database connection. Public and account-scoped (no management token). Gated per-connection by `disable_signup`. The user is created with `email_verified: false`; the account notification settings (`verify_email_auto_send`, `welcome_email_enabled`) drive any follow-up emails. Does not establish a session — the client logs in afterwards.
+         * @description Creates a new user and database credential in a single call against the tenant database connection. The identifier follows the connection `login_identifier` (email, username, or either); the password is optional, and a user created without one sets it through the password reset email. Public and account-scoped (no management token). Gated per-connection by `disable_signup`. The user is created with `email_verified: false`; the account notification settings (`verify_email_auto_send`, `welcome_email_enabled`) drive any follow-up emails. Does not establish a session — the client logs in afterwards.
          */
         post: operations["signup"];
         delete?: never;
@@ -6910,6 +6950,8 @@ export interface components {
          *     - `m2m_quota_exceeded` (402): The project used the machine-to-machine tokens its plan includes this month. Free is capped; Hobby and Pro are billed per token instead.
          *     - `signup_disabled` (403): Self-service sign-up is disabled on this connection.
          *     - `email_taken` (409): Another user in this account already uses that email.
+         *     - `username_taken` (409): Another user of this database connection already uses that username.
+         *     - `invalid_username` (400): The username is empty, or contains an `@` or whitespace. `message` says which.
          *     - `invalid_email` (400): The email address is not valid.
          *     - `invalid_name` (400): The name contains a link. `message` says which field.
          *     - `same_email` (400): The new email is the same as the current one.
@@ -6998,7 +7040,7 @@ export interface components {
          *     - `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.
          * @enum {string}
          */
-        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
+        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "email_sender_domain_not_allowed" | "plan_required" | "invalid_canonical_host" | "canonical_host_breaks_passkeys" | "not_logged_in" | "session_already_revoked" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "m2m_quota_exceeded" | "signup_disabled" | "email_taken" | "username_taken" | "invalid_username" | "invalid_email" | "invalid_name" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "no_database_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invalid_invite_url" | "invite_email_mismatch" | "invite_email_unverified" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "team_id_unavailable" | "use_team_member_route" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found" | "invalid_webhook_event" | "invalid_webhook_url" | "not_a_webhook" | "delivery_not_found" | "delivery_in_progress";
         /** @description Every error response has this shape. Branch on `error_code`, never on `message`: the message is written for a person and may change. */
         ErrorResponse: {
             /** @description The HTTP status, repeated. */
@@ -19178,6 +19220,8 @@ export interface operations {
                      *     ]
                      */
                     roles: string[];
+                    /** @description The person making the change, when your backend calls on their behalf with a machine token: it is who the tenant's log names. Must be a user of this tenant. */
+                    actor_user_id?: string;
                 };
             };
         };
@@ -19305,7 +19349,10 @@ export interface operations {
     };
     "team/removeMember": {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description The person removing (or leaving), when your backend calls on their behalf with a machine token: it is who the tenant's log names. Must be a user of this tenant. */
+                actor_user_id?: string;
+            };
             header?: never;
             path: {
                 team_id: string;
@@ -19912,8 +19959,10 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description The invite secret, as it arrived in the fragment of the `accept_url` link. */
-                    token: string;
+                    /** @description The invite secret, as it arrived in the fragment of the `accept_url` link. Give this or `invite_id`. */
+                    token?: string;
+                    /** @description The invite id, for accepting from your app without the link (a "pending invitation" notice; see `GET /user/{user_id}/team-invites`). Give this or `token`. */
+                    invite_id?: string;
                     /** @description The user accepting — the one signed in on your page. Must exist in this tenant and have the invited email, verified. */
                     user_id: string;
                 };
@@ -20031,6 +20080,267 @@ export interface operations {
             };
         };
     };
+    "team/listInvitesForUser": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description False when the user's email is not verified: nothing is listed then, since the address could be anybody's. */
+                        email_verified: boolean;
+                        data: {
+                            /** @description TeamInvite ID */
+                            id: string;
+                            /** @description Email address that was invited */
+                            email: string;
+                            /** @description Id of the team the invitee will be added to upon acceptance. */
+                            team: string;
+                            /** @description Id of the user that created the invitation, if known. */
+                            inviter?: string;
+                            /** @description Role ids that will be applied to the new TeamMember on acceptance. */
+                            roles: string[];
+                            /** @description `auto` adds the user directly if they already exist in the tenant and only falls back to a ticketed invite when the email is unknown. `invite` always issues a ticket + email regardless of whether the user exists. */
+                            mode: "auto" | "invite";
+                            /** @description URI to redirect the invitee to after a successful accept. */
+                            redirect_uri?: string;
+                            /** @description ISO 8601 timestamp at which the invite stops being valid. */
+                            expires_at: string;
+                            /** @description ISO 8601 timestamp at which the invite was accepted. Absent for pending invites. */
+                            consume_date?: string;
+                            /** @description Object is related with this account */
+                            account: string;
+                            /**
+                             * @description TeamInviteMetadata
+                             * @default {}
+                             */
+                            metadata: {
+                                [key: string]: unknown;
+                            };
+                            /** @description TeamInvite creation date */
+                            createdAt: string;
+                            /** @description TeamInvite updated date */
+                            updatedAt?: string;
+                        }[];
+                    };
+                };
+            };
+            /** @description `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
+    "team/declineInvite": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    invite_id: string;
+                    /** @description The user declining — must have the invited email, verified. */
+                    user_id: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "declined";
+                    };
+                };
+            };
+            /**
+             * @description `invalid_ticket` — The ticket does not exist or is not the kind this endpoint accepts.
+             *
+             *     `ticket_used` — The ticket was already consumed.
+             *
+             *     `ticket_expired` — The ticket is past its expiry.
+             *
+             *     `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invalid_ticket" | "ticket_used" | "ticket_expired" | "validation_error";
+                    };
+                };
+            };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `invite_email_mismatch` — The invite is for another email address than the accepting user's. `details.invited_email` shows it masked.
+             *
+             *     `invite_email_unverified` — The accepting user's email matches the invite but is not verified yet.
+             *
+             *     `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "invite_email_mismatch" | "invite_email_unverified" | "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
+            /**
+             * @description `not_found` — The resource does not exist in this account.
+             *
+             *     `account_not_found` — No Auth Account matches the request (domain, header or token).
+             */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "not_found" | "account_not_found";
+                    };
+                };
+            };
+            /** @description `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "too_many_requests";
+                    };
+                };
+            };
+            /** @description `internal_error` — Unexpected server error. Retry later; the request id is logged. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "internal_error";
+                    };
+                };
+            };
+        };
+    };
     "api/list": {
         parameters: {
             query?: {
@@ -30160,10 +30470,12 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description Email login identifier. */
-                    email: string;
-                    /** @description Plaintext password (validated against the connection policy, hashed on write). */
-                    password: string;
+                    /** @description Email login identifier. Required unless the connection signs in by username, and whenever `password` is omitted. */
+                    email?: string;
+                    /** @description Username login identifier, stored as typed (case-sensitive). Required on a connection whose `login_identifier` is `username`; rejected on an `email` one. No `@` or whitespace. */
+                    username?: string;
+                    /** @description Plaintext password (validated against the connection policy, hashed on write). Omit it to create the user without one: they set it through the password reset email. */
+                    password?: string;
                     name?: string;
                     given_name?: string;
                     family_name?: string;
@@ -30184,7 +30496,11 @@ export interface operations {
                 content?: never;
             };
             /**
-             * @description `invalid_connection` — The connection does not exist, is disabled, or is not of the type this flow needs.
+             * @description `bad_request` — The request is malformed. `message` says what is wrong.
+             *
+             *     `invalid_connection` — The connection does not exist, is disabled, or is not of the type this flow needs.
+             *
+             *     `invalid_username` — The username is empty, or contains an `@` or whitespace. `message` says which.
              *
              *     `password_too_weak` — The password does not meet the connection policy. `message` lists each unmet rule.
              *
@@ -30197,7 +30513,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "invalid_connection" | "password_too_weak" | "validation_error";
+                        error_code?: "bad_request" | "invalid_connection" | "invalid_username" | "password_too_weak" | "validation_error";
                     };
                 };
             };
@@ -30229,7 +30545,11 @@ export interface operations {
                     };
                 };
             };
-            /** @description `email_taken` — Another user in this account already uses that email. */
+            /**
+             * @description `email_taken` — Another user in this account already uses that email.
+             *
+             *     `username_taken` — Another user of this database connection already uses that username.
+             */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -30237,7 +30557,7 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["ErrorResponse"] & {
                         /** @enum {string} */
-                        error_code?: "email_taken";
+                        error_code?: "email_taken" | "username_taken";
                     };
                 };
             };

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.7.75";
+export const version = "2.7.77";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "4ba33ed";
+export const commit = "dacc281";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.7.75",
+  "version": "2.7.77",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",