zavudev 0.19.0 → 0.20.0

data/rbi/zavudev/models/sender_create_params.rbi

@@ -46,8 +46,30 @@ module Zavudev
       sig { params(email_receiving_enabled: T::Boolean).void }
       attr_writer :email_receiving_enabled
 
-      # Phone number in E.164 format. Required for phone-based channels (SMS, WhatsApp).
-      # Omit for an email-only sender.
+      # Enable the one-way SMS channel (`sms_oneway`). Needs nothing else — no phone
+      # number, no credential — so it is the fastest way to get a sender that can send.
+      # Recipients cannot reply. Confirm with `sms_oneway` in the `channels` array on
+      # the response.
+      sig { returns(T.nilable(T::Boolean)) }
+      attr_reader :enable_sms_oneway
+
+      sig { params(enable_sms_oneway: T::Boolean).void }
+      attr_writer :enable_sms_oneway
+
+      # Let this sender place and answer phone calls. Requires `phoneNumber`; enabling
+      # it without one returns 400. Check the `channels` array on the response to
+      # confirm `voice` is on.
+      sig { returns(T.nilable(T::Boolean)) }
+      attr_reader :enable_voice
+
+      sig { params(enable_voice: T::Boolean).void }
+      attr_writer :enable_voice
+
+      # Phone number in E.164 format, and it must be a number your project already owns
+      # (see `GET /v1/phone-numbers`). The number is routed to the sender as part of
+      # this call, which is what turns the SMS channel on. Passing a number the project
+      # does not own, or one already attached to another sender, returns 400 rather than
+      # creating a sender that cannot send. Omit for an email-only sender.
       sig { returns(T.nilable(String)) }
       attr_reader :phone_number
 
@@ -69,6 +91,35 @@ module Zavudev
       end
       attr_writer :webhook_events
 
+      # Which `X-Zavu-Signature` scheme this receiver is sent.
+      #
+      # - `v1`: `v1=HMAC_SHA256(secret, body)`. The scheme used before this was
+      #   configurable. Existing webhooks stay on it until you move them.
+      # - `v2`: `v2=HMAC_SHA256(secret, "{t}.{body}")`. The current scheme, and the
+      #   default for new senders. It signs the timestamp together with the body.
+      # - `v1+v2`: both signatures, sharing one `t`. The migration setting: a receiver
+      #   reading either one works, so you can deploy and confirm your new verifier
+      #   before switching over.
+      #
+      # Moving from `v1` straight to `v2` returns `400`. Set `v1+v2` first. See
+      # https://docs.zavu.dev/guides/receiving-messages/signature-migration
+      sig do
+        returns(
+          T.nilable(
+            Zavudev::SenderCreateParams::WebhookSignatureVersion::OrSymbol
+          )
+        )
+      end
+      attr_reader :webhook_signature_version
+
+      sig do
+        params(
+          webhook_signature_version:
+            Zavudev::SenderCreateParams::WebhookSignatureVersion::OrSymbol
+        ).void
+      end
+      attr_writer :webhook_signature_version
+
       # HTTPS URL for webhook events.
       sig { returns(T.nilable(String)) }
       attr_reader :webhook_url
@@ -83,9 +134,13 @@ module Zavudev
           email_domain_id: String,
           email_from_name: String,
           email_receiving_enabled: T::Boolean,
+          enable_sms_oneway: T::Boolean,
+          enable_voice: T::Boolean,
           phone_number: String,
           set_as_default: T::Boolean,
           webhook_events: T::Array[Zavudev::WebhookEvent::OrSymbol],
+          webhook_signature_version:
+            Zavudev::SenderCreateParams::WebhookSignatureVersion::OrSymbol,
           webhook_url: String,
           request_options: Zavudev::RequestOptions::OrHash
         ).returns(T.attached_class)
@@ -104,12 +159,37 @@ module Zavudev
         # Enable inbound email receiving on this sender. Requires a verified MX record on
         # the domain; ignored otherwise.
         email_receiving_enabled: nil,
-        # Phone number in E.164 format. Required for phone-based channels (SMS, WhatsApp).
-        # Omit for an email-only sender.
+        # Enable the one-way SMS channel (`sms_oneway`). Needs nothing else — no phone
+        # number, no credential — so it is the fastest way to get a sender that can send.
+        # Recipients cannot reply. Confirm with `sms_oneway` in the `channels` array on
+        # the response.
+        enable_sms_oneway: nil,
+        # Let this sender place and answer phone calls. Requires `phoneNumber`; enabling
+        # it without one returns 400. Check the `channels` array on the response to
+        # confirm `voice` is on.
+        enable_voice: nil,
+        # Phone number in E.164 format, and it must be a number your project already owns
+        # (see `GET /v1/phone-numbers`). The number is routed to the sender as part of
+        # this call, which is what turns the SMS channel on. Passing a number the project
+        # does not own, or one already attached to another sender, returns 400 rather than
+        # creating a sender that cannot send. Omit for an email-only sender.
         phone_number: nil,
         set_as_default: nil,
         # Events to subscribe to.
         webhook_events: nil,
+        # Which `X-Zavu-Signature` scheme this receiver is sent.
+        #
+        # - `v1`: `v1=HMAC_SHA256(secret, body)`. The scheme used before this was
+        #   configurable. Existing webhooks stay on it until you move them.
+        # - `v2`: `v2=HMAC_SHA256(secret, "{t}.{body}")`. The current scheme, and the
+        #   default for new senders. It signs the timestamp together with the body.
+        # - `v1+v2`: both signatures, sharing one `t`. The migration setting: a receiver
+        #   reading either one works, so you can deploy and confirm your new verifier
+        #   before switching over.
+        #
+        # Moving from `v1` straight to `v2` returns `400`. Set `v1+v2` first. See
+        # https://docs.zavu.dev/guides/receiving-messages/signature-migration
+        webhook_signature_version: nil,
         # HTTPS URL for webhook events.
         webhook_url: nil,
         request_options: {}
@@ -124,9 +204,13 @@ module Zavudev
             email_domain_id: String,
             email_from_name: String,
             email_receiving_enabled: T::Boolean,
+            enable_sms_oneway: T::Boolean,
+            enable_voice: T::Boolean,
             phone_number: String,
             set_as_default: T::Boolean,
             webhook_events: T::Array[Zavudev::WebhookEvent::OrSymbol],
+            webhook_signature_version:
+              Zavudev::SenderCreateParams::WebhookSignatureVersion::OrSymbol,
             webhook_url: String,
             request_options: Zavudev::RequestOptions
           }
@@ -134,6 +218,54 @@ module Zavudev
       end
       def to_hash
       end
+
+      # Which `X-Zavu-Signature` scheme this receiver is sent.
+      #
+      # - `v1`: `v1=HMAC_SHA256(secret, body)`. The scheme used before this was
+      #   configurable. Existing webhooks stay on it until you move them.
+      # - `v2`: `v2=HMAC_SHA256(secret, "{t}.{body}")`. The current scheme, and the
+      #   default for new senders. It signs the timestamp together with the body.
+      # - `v1+v2`: both signatures, sharing one `t`. The migration setting: a receiver
+      #   reading either one works, so you can deploy and confirm your new verifier
+      #   before switching over.
+      #
+      # Moving from `v1` straight to `v2` returns `400`. Set `v1+v2` first. See
+      # https://docs.zavu.dev/guides/receiving-messages/signature-migration
+      module WebhookSignatureVersion
+        extend Zavudev::Internal::Type::Enum
+
+        TaggedSymbol =
+          T.type_alias do
+            T.all(Symbol, Zavudev::SenderCreateParams::WebhookSignatureVersion)
+          end
+        OrSymbol = T.type_alias { T.any(Symbol, String) }
+
+        V1 =
+          T.let(
+            :v1,
+            Zavudev::SenderCreateParams::WebhookSignatureVersion::TaggedSymbol
+          )
+        V1_V2 =
+          T.let(
+            :"v1+v2",
+            Zavudev::SenderCreateParams::WebhookSignatureVersion::TaggedSymbol
+          )
+        V2 =
+          T.let(
+            :v2,
+            Zavudev::SenderCreateParams::WebhookSignatureVersion::TaggedSymbol
+          )
+
+        sig do
+          override.returns(
+            T::Array[
+              Zavudev::SenderCreateParams::WebhookSignatureVersion::TaggedSymbol
+            ]
+          )
+        end
+        def self.values
+        end
+      end
     end
   end
 end

data/rbi/zavudev/models/sender_update_params.rbi

@@ -53,6 +53,24 @@ module Zavudev
       sig { params(email_receiving_enabled: T::Boolean).void }
       attr_writer :email_receiving_enabled
 
+      # Turn the one-way SMS channel on or off. Enabling needs nothing else and takes
+      # effect immediately; disabling removes the channel from the sender. Confirm with
+      # the `channels` array on the response.
+      sig { returns(T.nilable(T::Boolean)) }
+      attr_reader :enable_sms_oneway
+
+      sig { params(enable_sms_oneway: T::Boolean).void }
+      attr_writer :enable_sms_oneway
+
+      # Turn the voice channel on or off. The sender must already have a phone number
+      # provisioned for calls; enabling it otherwise returns 400 instead of storing a
+      # flag that changes nothing. Confirm with the `channels` array on the response.
+      sig { returns(T.nilable(T::Boolean)) }
+      attr_reader :enable_voice
+
+      sig { params(enable_voice: T::Boolean).void }
+      attr_writer :enable_voice
+
       sig { returns(T.nilable(String)) }
       attr_reader :name
 
@@ -81,6 +99,35 @@ module Zavudev
       end
       attr_writer :webhook_events
 
+      # Which `X-Zavu-Signature` scheme this receiver is sent.
+      #
+      # - `v1`: `v1=HMAC_SHA256(secret, body)`. The scheme used before this was
+      #   configurable. Existing webhooks stay on it until you move them.
+      # - `v2`: `v2=HMAC_SHA256(secret, "{t}.{body}")`. The current scheme, and the
+      #   default for new senders. It signs the timestamp together with the body.
+      # - `v1+v2`: both signatures, sharing one `t`. The migration setting: a receiver
+      #   reading either one works, so you can deploy and confirm your new verifier
+      #   before switching over.
+      #
+      # Moving from `v1` straight to `v2` returns `400`. Set `v1+v2` first. See
+      # https://docs.zavu.dev/guides/receiving-messages/signature-migration
+      sig do
+        returns(
+          T.nilable(
+            Zavudev::SenderUpdateParams::WebhookSignatureVersion::OrSymbol
+          )
+        )
+      end
+      attr_reader :webhook_signature_version
+
+      sig do
+        params(
+          webhook_signature_version:
+            Zavudev::SenderUpdateParams::WebhookSignatureVersion::OrSymbol
+        ).void
+      end
+      attr_writer :webhook_signature_version
+
       # HTTPS URL for webhook events. Set to null to remove webhook.
       sig { returns(T.nilable(String)) }
       attr_accessor :webhook_url
@@ -93,10 +140,14 @@ module Zavudev
           email_domain_id: String,
           email_from_name: String,
           email_receiving_enabled: T::Boolean,
+          enable_sms_oneway: T::Boolean,
+          enable_voice: T::Boolean,
           name: String,
           set_as_default: T::Boolean,
           webhook_active: T::Boolean,
           webhook_events: T::Array[Zavudev::WebhookEvent::OrSymbol],
+          webhook_signature_version:
+            Zavudev::SenderUpdateParams::WebhookSignatureVersion::OrSymbol,
           webhook_url: T.nilable(String),
           request_options: Zavudev::RequestOptions::OrHash
         ).returns(T.attached_class)
@@ -117,12 +168,33 @@ module Zavudev
         email_from_name: nil,
         # Enable or disable inbound email receiving for this sender.
         email_receiving_enabled: nil,
+        # Turn the one-way SMS channel on or off. Enabling needs nothing else and takes
+        # effect immediately; disabling removes the channel from the sender. Confirm with
+        # the `channels` array on the response.
+        enable_sms_oneway: nil,
+        # Turn the voice channel on or off. The sender must already have a phone number
+        # provisioned for calls; enabling it otherwise returns 400 instead of storing a
+        # flag that changes nothing. Confirm with the `channels` array on the response.
+        enable_voice: nil,
         name: nil,
         set_as_default: nil,
         # Whether the webhook is active.
         webhook_active: nil,
         # Events to subscribe to.
         webhook_events: nil,
+        # Which `X-Zavu-Signature` scheme this receiver is sent.
+        #
+        # - `v1`: `v1=HMAC_SHA256(secret, body)`. The scheme used before this was
+        #   configurable. Existing webhooks stay on it until you move them.
+        # - `v2`: `v2=HMAC_SHA256(secret, "{t}.{body}")`. The current scheme, and the
+        #   default for new senders. It signs the timestamp together with the body.
+        # - `v1+v2`: both signatures, sharing one `t`. The migration setting: a receiver
+        #   reading either one works, so you can deploy and confirm your new verifier
+        #   before switching over.
+        #
+        # Moving from `v1` straight to `v2` returns `400`. Set `v1+v2` first. See
+        # https://docs.zavu.dev/guides/receiving-messages/signature-migration
+        webhook_signature_version: nil,
         # HTTPS URL for webhook events. Set to null to remove webhook.
         webhook_url: nil,
         request_options: {}
@@ -138,10 +210,14 @@ module Zavudev
             email_domain_id: String,
             email_from_name: String,
             email_receiving_enabled: T::Boolean,
+            enable_sms_oneway: T::Boolean,
+            enable_voice: T::Boolean,
             name: String,
             set_as_default: T::Boolean,
             webhook_active: T::Boolean,
             webhook_events: T::Array[Zavudev::WebhookEvent::OrSymbol],
+            webhook_signature_version:
+              Zavudev::SenderUpdateParams::WebhookSignatureVersion::OrSymbol,
             webhook_url: T.nilable(String),
             request_options: Zavudev::RequestOptions
           }
@@ -149,6 +225,54 @@ module Zavudev
       end
       def to_hash
       end
+
+      # Which `X-Zavu-Signature` scheme this receiver is sent.
+      #
+      # - `v1`: `v1=HMAC_SHA256(secret, body)`. The scheme used before this was
+      #   configurable. Existing webhooks stay on it until you move them.
+      # - `v2`: `v2=HMAC_SHA256(secret, "{t}.{body}")`. The current scheme, and the
+      #   default for new senders. It signs the timestamp together with the body.
+      # - `v1+v2`: both signatures, sharing one `t`. The migration setting: a receiver
+      #   reading either one works, so you can deploy and confirm your new verifier
+      #   before switching over.
+      #
+      # Moving from `v1` straight to `v2` returns `400`. Set `v1+v2` first. See
+      # https://docs.zavu.dev/guides/receiving-messages/signature-migration
+      module WebhookSignatureVersion
+        extend Zavudev::Internal::Type::Enum
+
+        TaggedSymbol =
+          T.type_alias do
+            T.all(Symbol, Zavudev::SenderUpdateParams::WebhookSignatureVersion)
+          end
+        OrSymbol = T.type_alias { T.any(Symbol, String) }
+
+        V1 =
+          T.let(
+            :v1,
+            Zavudev::SenderUpdateParams::WebhookSignatureVersion::TaggedSymbol
+          )
+        V1_V2 =
+          T.let(
+            :"v1+v2",
+            Zavudev::SenderUpdateParams::WebhookSignatureVersion::TaggedSymbol
+          )
+        V2 =
+          T.let(
+            :v2,
+            Zavudev::SenderUpdateParams::WebhookSignatureVersion::TaggedSymbol
+          )
+
+        sig do
+          override.returns(
+            T::Array[
+              Zavudev::SenderUpdateParams::WebhookSignatureVersion::TaggedSymbol
+            ]
+          )
+        end
+        def self.values
+        end
+      end
     end
   end
 end

data/rbi/zavudev/models/sender_webhook.rbi

@@ -16,6 +16,21 @@ module Zavudev
       sig { returns(T::Array[Zavudev::WebhookEvent::TaggedSymbol]) }
       attr_accessor :events
 
+      # Which `X-Zavu-Signature` scheme this receiver is sent.
+      #
+      # - `v1`: `v1=HMAC_SHA256(secret, body)`. The scheme used before this was
+      #   configurable. Existing webhooks stay on it until you move them.
+      # - `v2`: `v2=HMAC_SHA256(secret, "{t}.{body}")`. The current scheme, and the
+      #   default for new senders. It signs the timestamp together with the body.
+      # - `v1+v2`: both signatures, sharing one `t`. The migration setting: a receiver
+      #   reading either one works, so you can deploy and confirm your new verifier
+      #   before switching over.
+      #
+      # Moving from `v1` straight to `v2` returns `400`. Set `v1+v2` first. See
+      # https://docs.zavu.dev/guides/receiving-messages/signature-migration
+      sig { returns(Zavudev::SenderWebhook::SignatureVersion::TaggedSymbol) }
+      attr_accessor :signature_version
+
       # HTTPS URL that will receive webhook events.
       sig { returns(String) }
       attr_accessor :url
@@ -33,6 +48,7 @@ module Zavudev
         params(
           active: T::Boolean,
           events: T::Array[Zavudev::WebhookEvent::OrSymbol],
+          signature_version: Zavudev::SenderWebhook::SignatureVersion::OrSymbol,
           url: String,
           secret: String
         ).returns(T.attached_class)
@@ -42,6 +58,19 @@ module Zavudev
         active:,
         # List of events the webhook is subscribed to.
         events:,
+        # Which `X-Zavu-Signature` scheme this receiver is sent.
+        #
+        # - `v1`: `v1=HMAC_SHA256(secret, body)`. The scheme used before this was
+        #   configurable. Existing webhooks stay on it until you move them.
+        # - `v2`: `v2=HMAC_SHA256(secret, "{t}.{body}")`. The current scheme, and the
+        #   default for new senders. It signs the timestamp together with the body.
+        # - `v1+v2`: both signatures, sharing one `t`. The migration setting: a receiver
+        #   reading either one works, so you can deploy and confirm your new verifier
+        #   before switching over.
+        #
+        # Moving from `v1` straight to `v2` returns `400`. Set `v1+v2` first. See
+        # https://docs.zavu.dev/guides/receiving-messages/signature-migration
+        signature_version:,
         # HTTPS URL that will receive webhook events.
         url:,
         # Webhook secret for signature verification. Only returned on create or
@@ -55,6 +84,8 @@ module Zavudev
           {
             active: T::Boolean,
             events: T::Array[Zavudev::WebhookEvent::TaggedSymbol],
+            signature_version:
+              Zavudev::SenderWebhook::SignatureVersion::TaggedSymbol,
             url: String,
             secret: String
           }
@@ -62,6 +93,44 @@ module Zavudev
       end
       def to_hash
       end
+
+      # Which `X-Zavu-Signature` scheme this receiver is sent.
+      #
+      # - `v1`: `v1=HMAC_SHA256(secret, body)`. The scheme used before this was
+      #   configurable. Existing webhooks stay on it until you move them.
+      # - `v2`: `v2=HMAC_SHA256(secret, "{t}.{body}")`. The current scheme, and the
+      #   default for new senders. It signs the timestamp together with the body.
+      # - `v1+v2`: both signatures, sharing one `t`. The migration setting: a receiver
+      #   reading either one works, so you can deploy and confirm your new verifier
+      #   before switching over.
+      #
+      # Moving from `v1` straight to `v2` returns `400`. Set `v1+v2` first. See
+      # https://docs.zavu.dev/guides/receiving-messages/signature-migration
+      module SignatureVersion
+        extend Zavudev::Internal::Type::Enum
+
+        TaggedSymbol =
+          T.type_alias do
+            T.all(Symbol, Zavudev::SenderWebhook::SignatureVersion)
+          end
+        OrSymbol = T.type_alias { T.any(Symbol, String) }
+
+        V1 = T.let(:v1, Zavudev::SenderWebhook::SignatureVersion::TaggedSymbol)
+        V1_V2 =
+          T.let(
+            :"v1+v2",
+            Zavudev::SenderWebhook::SignatureVersion::TaggedSymbol
+          )
+        V2 = T.let(:v2, Zavudev::SenderWebhook::SignatureVersion::TaggedSymbol)
+
+        sig do
+          override.returns(
+            T::Array[Zavudev::SenderWebhook::SignatureVersion::TaggedSymbol]
+          )
+        end
+        def self.values
+        end
+      end
     end
   end
 end

data/rbi/zavudev/models/senders/agent/agent_tool.rbi

@@ -51,6 +51,19 @@ module Zavudev
           sig { returns(String) }
           attr_accessor :webhook_url
 
+          # Signing secret for this tool's webhook. **Returned only when the tool is
+          # created**, never on a later read.
+          #
+          # Zavu generates one if you do not supply it, and signs every call to this tool
+          # with it: `X-Zavu-Signature: <hex>`, the HMAC-SHA256 of the request body. Verify
+          # it before trusting the call. Lost it? Rotate with
+          # `POST /v1/senders/{senderId}/agent/tools/{toolId}/webhook/secret`.
+          sig { returns(T.nilable(String)) }
+          attr_reader :webhook_secret
+
+          sig { params(webhook_secret: String).void }
+          attr_writer :webhook_secret
+
           sig do
             params(
               id: String,
@@ -61,7 +74,8 @@ module Zavudev
               name: String,
               parameters: Zavudev::Senders::Agent::ToolParameters::OrHash,
               updated_at: Time,
-              webhook_url: String
+              webhook_url: String,
+              webhook_secret: String
             ).returns(T.attached_class)
           end
           def self.new(
@@ -75,7 +89,15 @@ module Zavudev
             parameters:,
             updated_at:,
             # HTTPS URL to call when the tool is executed.
-            webhook_url:
+            webhook_url:,
+            # Signing secret for this tool's webhook. **Returned only when the tool is
+            # created**, never on a later read.
+            #
+            # Zavu generates one if you do not supply it, and signs every call to this tool
+            # with it: `X-Zavu-Signature: <hex>`, the HMAC-SHA256 of the request body. Verify
+            # it before trusting the call. Lost it? Rotate with
+            # `POST /v1/senders/{senderId}/agent/tools/{toolId}/webhook/secret`.
+            webhook_secret: nil
           )
           end
 
@@ -90,7 +112,8 @@ module Zavudev
                 name: String,
                 parameters: Zavudev::Senders::Agent::ToolParameters,
                 updated_at: Time,
-                webhook_url: String
+                webhook_url: String,
+                webhook_secret: String
               }
             )
           end

data/rbi/zavudev/models/senders/agent/tool_create_params.rbi

@@ -45,7 +45,9 @@ module Zavudev
           sig { params(enabled: T::Boolean).void }
           attr_writer :enabled
 
-          # Optional secret for webhook signature verification.
+          # Signing secret for the webhook. Optional: Zavu generates one when omitted and
+          # returns it on this response only. Supply your own if you already have a secret
+          # you want reused.
           sig { returns(T.nilable(String)) }
           attr_reader :webhook_secret
 
@@ -72,7 +74,9 @@ module Zavudev
             # Must be HTTPS.
             webhook_url:,
             enabled: nil,
-            # Optional secret for webhook signature verification.
+            # Signing secret for the webhook. Optional: Zavu generates one when omitted and
+            # returns it on this response only. Supply your own if you already have a secret
+            # you want reused.
             webhook_secret: nil,
             request_options: {}
           )