@zindua/sdk 1.2.3 → 1.2.6

package/README.md

@@ -1,261 +1,534 @@
 # @zindua/sdk
 
-Official **server-side** SDK for [Zindua](https://zindua.run): one API for transactional **email** and **WhatsApp** (`POST /api/v1/send`).
+Official **server-side** SDK for [Zindua](https://zindua.run): send transactional **email** and **WhatsApp** messages with one API.
 
-| Resource | Link |
-|----------|------|
-| Website & docs | [zindua.run/developers](https://zindua.run/developers) |
-| HTTP / cURL (no SDK) | [zindua.run/developers#http](https://zindua.run/developers#http) |
-| Pricing & plans | [zindua.run/pricing](https://zindua.run/pricing) |
-| Dashboard | [zindua.run/login](https://zindua.run/login) |
+| | |
+|---|---|
+| Full API reference | [zindua.run/developers](https://zindua.run/developers) |
+| Dashboard (keys, templates, services) | [zindua.run/login](https://zindua.run/login) |
+| Pricing | [zindua.run/pricing](https://zindua.run/pricing) |
 
-Install: `npm install @zindua/sdk`
+```bash
+npm install @zindua/sdk
+```
+
+**Requirements:** Node.js 18+, run only on your **backend** (not in the browser).
+
+**Dependencies:** `@zindua/sdk` has **no runtime npm dependencies**. After `npm install`, you are done — no second package to add. The client uses Node’s built-in `fetch` (Node 18+).
 
 ---
 
-## Templates and languages
+## Quick start
+
+### 1. Create a Zindua project
 
-Create templates in the **dashboard** (one **slug** per template, e.g. `welcome`, `otp-verification`). Each template can include **email HTML** and **WhatsApp text** for the same slug.
+1. Sign in at [zindua.run/login](https://zindua.run/login).
+2. Open **Projects** → create a project (or use an existing one).
+3. Copy the API key (`znd_live_…` for production, `znd_test_…` for sandbox).
+4. In the project: connect **Service** (Gmail, SMTP, …) for email, and/or link **WhatsApp** for OTP.
+5. Create at least one **template** (e.g. slug `otp`, `welcome`). For several languages, add one version per language in Dashboard → Templates (and set the project **default language** in project settings).
 
-Send in a locale with the `lang` field (ISO code: `fr`, `en`, `sw`, …). If you omit `lang`, Zindua uses your project default.
+### 2. Install and configure
 
-| Plan | Templates per project | Languages per template (email + WhatsApp) |
-|------|----------------------|-------------------------------------------|
-| **Free** | 5 | 3 |
-| **Pro** | 50 | 10 |
-| **Team** | 1000 | 100 |
+```bash
+npm install @zindua/sdk
+```
 
-On **Free**, **email API** works when you connect a **Service** (Gmail, SMTP, etc.) on the project. **WhatsApp OTP** works on Free (quota applies). **Pro/Team** raise template and volume limits. See [pricing](https://zindua.run/pricing).
+```bash
+# .env — never commit real keys; never expose in frontend code
+ZINDUA_API_KEY=znd_live_xxxxxxxxxxxxxxxxxxxxxxxx
+```
 
 ```typescript
-// French version of the same template slug
+import { Zindua } from "@zindua/sdk";
+
+export const zindua = new Zindua({
+  apiKey: process.env.ZINDUA_API_KEY!,
+});
+```
+
+### 3. Send a message
+
+```typescript
+// Email (default channel)
 await zindua.send({
   to: "user@example.com",
   template: "welcome",
-  lang: "fr",
   variables: { name: "Alex" },
 });
 
-// WhatsApp: same slug, different channel + E.164 phone
+// WhatsApp — E.164 phone with + (channel is required for WhatsApp)
 await zindua.send({
   to: "+243812345678",
   channel: "whatsapp",
-  template: "otp-verification",
-  lang: "fr",
-  variables: { code: "4592", app: "MonApp" },
+  template: "otp",
+  variables: { code: "482910" },
 });
 ```
 
----
+### Channel and `to` must match
 
-## Requirements
+The SDK checks **before** calling the API (same rules as [zindua.run](https://zindua.run)). A phone number cannot be sent as email, and an email cannot be sent on WhatsApp.
 
-Before using the SDK, set up your Zindua project in the dashboard:
+| `channel` | Valid `to` | Rejected (not sent) |
+|-----------|------------|---------------------|
+| `email` (default) | `user@example.com` | `+243812345678` |
+| `whatsapp` | `+243812345678` | `user@example.com` |
 
-| Requirement | Required for | Where |
-|-------------|--------------|--------|
-| Zindua account | All | [Sign up / login](https://zindua.run/login) |
-| Project + API key (`znd_live_…` or `znd_test_…`) | All | Dashboard → **Projects** → your project |
-| Email **Service** connected (Gmail, Outlook, SendGrid, SMTP, …) | `channel: "email"` | Dashboard → **Service** |
-| WhatsApp connected (QR) | `channel: "whatsapp"` | Dashboard → **WhatsApp** |
-| Template slug (e.g. `welcome`, `otp-verification`) | All | Dashboard → **Templates** |
-| **Service** on Free or **Pro/Team** plan | Email via API when Service is connected (Free) or full quotas (paid) | Dashboard → **Service** / **Billing** |
+```typescript
+// ❌ Phone with default channel email — rejected locally (INVALID_EMAIL)
+await zindua.send({ to: "+243812345678", template: "otp", variables: { code: "1" } });
 
-**Runtime**
+// ❌ Email with WhatsApp channel — rejected locally (INVALID_PHONE)
+await zindua.send({
+  to: "user@example.com",
+  channel: "whatsapp",
+  template: "otp",
+  variables: { code: "1" },
+});
 
-- **Node.js 18+** (uses native `fetch`)
-- **Server only** — do not bundle this package for the browser (see [Mobile & SPA](#mobile--spa))
+// ✅ User chose email for OTP
+await zindua.send({
+  to: "user@example.com",
+  channel: "email",
+  template: "otp",
+  variables: { code: "482910" },
+});
+
+// ✅ User chose WhatsApp for OTP
+await zindua.send({
+  to: "+243812345678",
+  channel: "whatsapp",
+  template: "otp",
+  variables: { code: "482910" },
+});
+```
 
 ---
 
-## Install
+## Languages (multilingual projects)
 
-```bash
-npm install @zindua/sdk
-```
+When you create a project, you choose a **default language** (Dashboard → project settings). Each template can have **several language versions** (French, English, Swahili, …) with its own subject and body.
 
-```bash
-yarn add @zindua/sdk
+When you call `send()`, pass **`lang` only if you want a specific version**. If you omit it, Zindua uses the **project default**. If the language you ask for does not exist on that template, Zindua uses the template’s **default language** and sets `langFallback: true` in the response.
+
+| What you send | What Zindua uses |
+|---------------|------------------|
+| No `lang` | Project default (e.g. `fr`) |
+| `lang: "en"` and English exists on the template | English version |
+| `lang: "de"` but only `fr` / `en` exist | Default language for that template + `langFallback: true` |
+
+```typescript
+// Default language of the project
+await zindua.send({
+  to: "user@example.com",
+  template: "otp",
+  variables: { code: "482910" },
+});
+
+// Explicit language (email or WhatsApp — same `lang` for both channels)
+const result = await zindua.send({
+  to: "+243812345678",
+  channel: "whatsapp",
+  template: "otp",
+  lang: "fr",
+  variables: { code: "482910" },
+});
+
+console.log(result.langUsed); // e.g. "fr" — language actually rendered
+console.log(result.langFallback); // true if `lang` was missing and fallback was used
 ```
 
-```bash
-pnpm add @zindua/sdk
+OTP with the user’s locale (optional):
+
+```typescript
+await zindua.send({
+  to: contact,
+  channel,
+  template: "otp",
+  lang: userLocale, // e.g. "fr", "en" — omit if you want project default
+  variables: { code },
+});
 ```
 
+Allowed codes: short ISO 639-1 style (`fr`, `en`, `sw`, `en-us`). Invalid format is rejected by the SDK before the HTTP call.
+
 ---
 
-## Configure
+## Plans and channels
 
-### 1. API key
+| Plan | Email API | WhatsApp | Email / month | WhatsApp OTP / month |
+|------|-----------|----------|---------------|----------------------|
+| **Free** | Yes, if a **Service** is connected on the project | Yes | 25,000 | 200 |
+| **Pro** | Yes | Yes | 160,000 | 20,000 |
+| **Team** | Yes | Yes | High volume | Unlimited |
 
-Copy your project key from the dashboard. Format: `znd_live_` + 24 characters, or `znd_test_` for test mode.
+On **Free**, email works through **your** connected provider (Gmail, SMTP, etc.). **Pro** and **Team** raise template counts and monthly limits. Details: [pricing](https://zindua.run/pricing).
 
-```bash
-# .env (example — load with dotenv or your framework)
-ZINDUA_API_KEY=znd_live_xxxxxxxxxxxxxxxxxxxxxxxx
-```
+| | Free | Pro / Team |
+|---|------|------------|
+| Templates per project | 5 | 50+ |
+| Languages per template | 3 | 10+ |
 
-The SDK does **not** read `ZINDUA_API_KEY` automatically. Pass it to the constructor explicitly.
+Use `znd_test_…` keys to try the API without consuming live quota (sandbox behaviour).
 
-### 2. Base URL (optional)
+---
 
-| Variable | Default | Notes |
-|----------|---------|--------|
-| `ZINDUA_API_BASE_URL` | `https://zindua.run/api/v1` | Used when `baseUrl` is omitted in constructor |
-| Constructor `baseUrl` | env or default | Overrides env; must be **HTTPS** in production (`http://localhost` allowed for local dev) |
+## One project or several?
 
-### 3. Timeout (optional)
+| Setup | When it fits |
+|-------|----------------|
+| **One Zindua project, one API key** | One product, one sender, shared templates and quota. |
+| **Several Zindua projects, one key each** | Several clients or brands: separate templates, Gmail accounts, logs, and quotas. |
 
-| Option | Default | Max |
-|--------|---------|-----|
-| `timeoutMs` | `30000` | `120000` |
+### Several keys in one backend
 
-### Minimal setup
+```bash
+ZINDUA_KEY_CLIENT_A=znd_live_aaaaaaaaaaaaaaaaaaaaaaaa
+ZINDUA_KEY_CLIENT_B=znd_live_bbbbbbbbbbbbbbbbbbbbbbbb
+```
 
 ```typescript
 import { Zindua } from "@zindua/sdk";
 
-export const zindua = new Zindua({
-  apiKey: process.env.ZINDUA_API_KEY!,
-  // baseUrl: process.env.ZINDUA_API_BASE_URL, // optional
-  // timeoutMs: 30_000,
+const clients = {
+  clientA: new Zindua({ apiKey: process.env.ZINDUA_KEY_CLIENT_A! }),
+  clientB: new Zindua({ apiKey: process.env.ZINDUA_KEY_CLIENT_B! }),
+};
+
+await clients.clientA.send({
+  to: "user@example.com",
+  template: "otp",
+  variables: { code: "123456" },
 });
 ```
 
+Each key only accesses **its** Zindua project (templates, service, usage).
+
 ---
 
-## Usage
+## Several templates in one application
 
-### Send email
+You do **not** need a separate SDK client per template. One `Zindua` instance, change the **`template` slug** and **`variables`** per send:
 
 ```typescript
+// OTP
 await zindua.send({
   to: "user@example.com",
-  template: "welcome",
+  template: "otp",
+  variables: { code: "482910" },
+});
+
+// Welcome email — different slug, different variables
+await zindua.send({
+  to: "user@example.com",
+  template: "user-welcome",
   variables: { name: "Alex" },
 });
 ```
 
-### Send WhatsApp OTP
-
-Phone numbers must be **E.164** with a leading `+` (e.g. `+243812345678`).
+Keep slugs in one place so your code stays clear:
 
 ```typescript
+const Template = {
+  otp: "otp",
+  welcome: "user-welcome",
+  resetPassword: "password-reset",
+} as const;
+
 await zindua.send({
-  to: "+243812345678",
-  channel: "whatsapp",
-  template: "otp-verification",
-  variables: { code: "4592", app: "MyApp" },
+  to: email,
+  template: Template.welcome,
+  variables: { name },
 });
 ```
 
-### Optional fields (email only)
+Each template defines its own `{{variables}}` in the dashboard. The SDK does not merge templates: one `send()` call = one template slug.
+
+---
+
+## Framework examples
+
+Use the same pattern everywhere: **your server** holds the API key; the client app calls **your** API.
+
+### Next.js (App Router)
 
 ```typescript
-await zindua.send({
-  to: "user@example.com",
-  template: "invoice",
-  lang: "fr",
-  cc: "billing@example.com",
-  replyTo: "support@example.com",
-  variables: { amount: "99" },
+// lib/zindua.ts
+import { Zindua } from "@zindua/sdk";
+
+export const zindua = new Zindua({ apiKey: process.env.ZINDUA_API_KEY! });
+```
+
+```typescript
+// app/api/notify/route.ts
+import { zindua } from "@/lib/zindua";
+import { NextResponse } from "next/server";
+
+export async function POST(req: Request) {
+  const { channel, contact, code, lang } = await req.json();
+  if (channel !== "email" && channel !== "whatsapp") {
+    return NextResponse.json({ error: "channel must be email or whatsapp" }, { status: 400 });
+  }
+  // contact = email string OR +243… phone, depending on channel
+  const result = await zindua.send({
+    to: contact,
+    channel,
+    template: "otp",
+    ...(lang ? { lang } : {}),
+    variables: { code },
+  });
+  return NextResponse.json(result, { status: 202 });
+}
+```
+
+### Express
+
+```typescript
+import express from "express";
+import { Zindua } from "@zindua/sdk";
+
+const app = express();
+app.use(express.json());
+
+const zindua = new Zindua({ apiKey: process.env.ZINDUA_API_KEY! });
+
+app.post("/api/notify", async (req, res) => {
+  const { channel, contact, code } = req.body;
+  if (channel !== "email" && channel !== "whatsapp") {
+    return res.status(400).json({ error: "channel must be email or whatsapp" });
+  }
+  try {
+    const result = await zindua.send({
+      to: contact,
+      channel,
+      template: "otp",
+      variables: { code },
+    });
+    res.status(202).json(result);
+  } catch (err) {
+    res.status(500).json({ error: "Send failed" });
+  }
 });
 ```
 
-### Response
+### Fastify
 
 ```typescript
-const result = await zindua.send({ /* … */ });
-// {
-//   success: true,
-//   status: "queued",
-//   logId: "…",
-//   channel: "email",
-//   context: { project, apiKey: { mode, suffix }, plan, channels }
-// }
+import Fastify from "fastify";
+import { Zindua } from "@zindua/sdk";
+
+const zindua = new Zindua({ apiKey: process.env.ZINDUA_API_KEY! });
+const app = Fastify();
+
+app.post<{ Body: { channel: "email" | "whatsapp"; contact: string; code: string } }>(
+  "/notify",
+  async (req, reply) => {
+    const { channel, contact, code } = req.body;
+    if (channel !== "email" && channel !== "whatsapp") {
+      return reply.status(400).send({ error: "channel must be email or whatsapp" });
+    }
+    const result = await zindua.send({
+      to: contact,
+      channel,
+      template: "otp",
+      variables: { code },
+    });
+    return reply.status(202).send(result);
+  }
+);
 ```
 
-The API never returns your full API key. `context.apiKey.suffix` is the last 4 characters (match in Dashboard).
+### Hono
+
+```typescript
+import { Hono } from "hono";
+import { Zindua } from "@zindua/sdk";
+
+const zindua = new Zindua({ apiKey: process.env.ZINDUA_API_KEY! });
+const app = new Hono();
+
+app.post("/notify", async (c) => {
+  const { channel, contact, code } = await c.req.json();
+  if (channel !== "email" && channel !== "whatsapp") {
+    return c.json({ error: "channel must be email or whatsapp" }, 400);
+  }
+  const result = await zindua.send({
+    to: contact,
+    channel,
+    template: "otp",
+    variables: { code },
+  });
+  return c.json(result, 202);
+});
+```
+
+### Mobile apps (React Native, Flutter)
+
+Do **not** embed `@zindua/sdk` or `znd_live_…` in the app. Call your backend route above from the device.
 
 ---
 
-## Several clients (multi-project)
+## Configuration options
 
-**Recommended:** one Zindua project per client → one `znd_live_…` per project.
+| Option | Default | Description |
+|--------|---------|-------------|
+| `apiKey` | — | **Required.** `znd_live_…` or `znd_test_…` from the dashboard. |
+| `baseUrl` | `https://zindua.run/api/v1` | Override only for local testing (`http://localhost:3000/api/v1`). |
+| `timeoutMs` | `30000` | Request timeout (max `120000`). |
 
-```bash
-# .env — server only
-ZINDUA_KEY_MELLIA=znd_live_xxxxxxxxxxxxxxxxxxxxxxxx
-ZINDUA_KEY_OVERLOOK=znd_live_yyyyyyyyyyyyyyyyyyyyyyyy
+```typescript
+const zindua = new Zindua({
+  apiKey: process.env.ZINDUA_API_KEY!,
+  baseUrl: process.env.ZINDUA_API_BASE_URL, // optional
+  timeoutMs: 45_000,
+});
 ```
 
-```typescript
-import { Zindua } from "@zindua/sdk";
+---
 
-const zinduaByTenant = {
-  mellia: new Zindua({ apiKey: process.env.ZINDUA_KEY_MELLIA! }),
-  overlook: new Zindua({ apiKey: process.env.ZINDUA_KEY_OVERLOOK! }),
-};
+## Send options
+
+| Field | Required | Description |
+|-------|----------|-------------|
+| `to` | Yes | **Email** if `channel` is `email` (default). **E.164 phone** (`+243…`) if `channel` is `whatsapp`. Mismatches are rejected by the SDK and by the API. |
+| `template` | Yes | Template slug from your dashboard. |
+| `channel` | No | `"email"` (default) or `"whatsapp"`. Must match the format of `to`. |
+| `lang` | No | Optional. `fr`, `en`, `sw`, … — if omitted, project default; if missing on template, fallback + `langFallback: true`. |
+| `variables` | No | `{{placeholders}}` in the template. |
+| `cc`, `bcc`, `replyTo` | No | Email only. |
+
+---
+
+## API key, recipient, and delivery — what is checked when
+
+| Situation | When you know | What to do |
+|-----------|---------------|------------|
+| Wrong or missing API key | Immediately (`401`, `INVALID_API_KEY` / `API_KEY_NOT_FOUND`) | Copy key from Dashboard → Projects |
+| Phone sent as email (or the opposite) | Immediately in the SDK (`INVALID_EMAIL` / `INVALID_PHONE`, HTTP status `0`) | Match `channel` and `to` (see above) |
+| Malformed email or phone | Immediately (SDK + API `400`) | Fix format: `user@domain.com`, `+243812345678` |
+| Typo in email (`user@gmial.com`) | **Not** blocked at send time | Request may succeed (`202`); provider may bounce later |
+| Email inbox does not exist | **Not** verified upfront | Check **Dashboard → Logs** with `logId`; configure **webhooks** (`email.delivered` / `email.failed`) |
+| Phone valid in E.164 but **no WhatsApp** on that number | **Not** verified upfront | WhatsApp send can fail after accept; status `failed` in logs |
+| Template slug wrong | API `404` `TEMPLATE_NOT_FOUND` | Create template or fix slug |
+| No Gmail/SMTP / WhatsApp not linked | API `422` | Connect **Service** or **WhatsApp** on the project |
 
-await zinduaByTenant[tenantId].send({
+**Important:** a successful `send()` returns `logId` and often `status: "queued"`. That means Zindua accepted the message and will deliver through **your** connected email service or WhatsApp session. It does not guarantee the address exists or that WhatsApp is installed on that number.
+
+```typescript
+const result = await zindua.send({
   to: "user@example.com",
   template: "otp",
-  variables: { code: "482910" },
+  variables: { code: "123456" },
 });
+
+// Save logId — check delivery in the dashboard or via webhooks
+console.log(result.logId, result.status, result.langUsed);
 ```
 
-| Approach | When to use |
-|----------|-------------|
-| **2+ Zindua projects** | Different clients, senders, templates, or quotas |
-| **1 Zindua project** | Same sender and templates for everyone (one key) |
+Optional in **your** app (before calling Zindua): stricter email regex, confirmation field, or a phone library — the SDK already enforces platform format and channel rules.
+
+---
 
-More detail: [zindua.run/developers#multi-project](https://zindua.run/developers#multi-project) and repo `config/API-SECURITY-MULTI-PROJECT-FR.md`.
+## Successful response
+
+```typescript
+const result = await zindua.send({ /* … */ });
+```
+
+| Field | Meaning |
+|-------|---------|
+| `success` | `true` |
+| `status` | `queued`, `processing`, or `sent` (test keys often return `sent` immediately). |
+| `logId` | Id for support / logs in the dashboard. |
+| `channel` | `email` or `whatsapp` |
+| `langUsed` | Language version used for this send |
+| `langFallback` | `true` if requested `lang` was missing and a fallback version was used |
+| `context` | Workspace snapshot (see below). |
+
+### `context` object
+
+The API returns metadata so you can log or debug without exposing secrets:
+
+```json
+{
+  "context": {
+    "project": { "name": "My App", "slug": "my-app" },
+    "apiKey": { "mode": "live", "suffix": "ejho" },
+    "plan": { "slug": "free", "name": "Free", "emailQuota": 25000, "emailsUsed": 12 },
+    "channels": { "email": true, "whatsapp": false }
+  }
+}
+```
+
+- **`context.apiKey.suffix`** — last 4 characters of the key (match in the dashboard).
+- **`context.plan`** — current plan and usage for the workspace linked to this key.
+- **`context.channels`** — whether email / WhatsApp is ready for this project.
+
+The full API key is **never** returned in responses.
 
 ---
 
 ## Errors
 
+Wrap sends in `try/catch` and handle `ZinduaError`:
+
 ```typescript
 import { Zindua, ZinduaError } from "@zindua/sdk";
 
 try {
-  await zindua.send({ to: "+243…", channel: "whatsapp", template: "otp-verification" });
+  await zindua.send({ to: "user@example.com", template: "otp", variables: { code: "1" } });
 } catch (e) {
   if (e instanceof ZinduaError) {
-    console.error(e.status, e.code, e.message);
-    // Platform codes may include: WHATSAPP_NOT_CONNECTED, RATE_LIMIT_EXCEEDED, …
+    console.log(e.status);  // HTTP status
+    console.log(e.code);    // machine-readable code
+    console.log(e.message); // human-readable
+    console.log(e.details); // optional: hint, context, retryAfterSec, …
   }
-  throw e;
 }
 ```
 
-`ZinduaError` never includes your API key in the message.
+### Error codes
+
+| Code | HTTP | What it means | What to do |
+|------|------|---------------|------------|
+| `INVALID_API_KEY` | 401 | Missing or malformed key. | Use `Authorization: Bearer znd_live_…` (24 chars after prefix). |
+| `API_KEY_NOT_FOUND` | 401 | Key not linked to a project. | Copy the key from Dashboard → your project. |
+| `ORIGIN_NOT_ALLOWED` | 403 | Browser origin blocked. | Prefer server-side SDK; or add origin in Dashboard → Settings → Integrations. |
+| `MISSING_FIELDS` | 400 / 0 | `to` or `template` missing. | Send both. Status `0` = caught by the SDK before HTTP. |
+| `INVALID_EMAIL` | 400 / 0 | Bad email, or **phone used with channel email**. | Use `user@domain.com`, or set `channel: "whatsapp"` for `+243…`. |
+| `INVALID_PHONE` | 400 / 0 | Bad WhatsApp number, or **email used with channel whatsapp**. | Use `+243812345678`, or set `channel: "email"` for an address. |
+| `NO_SUBSCRIPTION` | 403 | Workspace has no active plan. | Open Dashboard → Billing or contact support. |
+| `EMAIL_NOT_AVAILABLE` | 403 | Email not allowed on current plan setup. | Connect a Service on the project (Free), or upgrade plan. |
+| `EMAIL_SERVICE_NOT_CONFIGURED` | 422 | No Gmail/SMTP connected. | Dashboard → project → **Service**. |
+| `QUOTA_EXCEEDED` | 429 | Monthly email limit reached. | Upgrade plan or wait for reset. |
+| `WHATSAPP_NOT_AVAILABLE` | 403 | WhatsApp not on plan. | Check [pricing](https://zindua.run/pricing). |
+| `WHATSAPP_NOT_CONNECTED` | 422 | WhatsApp not linked. | Dashboard → project → **WhatsApp** → scan QR. |
+| `WHATSAPP_PAUSED` | 422 | WhatsApp session paused. | Resume in the dashboard. |
+| `WHATSAPP_QUOTA_EXCEEDED` | 429 | Monthly WhatsApp limit reached. | Upgrade or wait. |
+| `RATE_LIMIT_EXCEEDED` | 429 | Sending too fast (WhatsApp). | Wait `retryAfterSec` from `e.details`, then retry. |
+| `TEMPLATE_NOT_FOUND` | 404 | Unknown template slug. | Create template or fix slug; check `availableTemplateSlugs` in details. |
+| `TEMPLATE_NO_CONTENT` | 404 | Template has no language version. | Add content in Dashboard → Templates. |
+| `TEMPLATE_NO_WHATSAPP_BODY` | 422 | No plain text for WhatsApp. | Add a text body for that language. |
+| `QUEUE_UNAVAILABLE` | 503 | Temporary delivery queue issue. | Retry shortly; contact support if it persists. |
+| `BROWSER_FORBIDDEN` | — | SDK used in browser. | Move the call to your backend. |
+| `REQUEST_TIMEOUT` | — | Request exceeded `timeoutMs`. | Increase timeout or retry. |
+
+Many errors include a **`context`** field (same shape as success) with `plan` and `project` to help you debug.
 
 ---
 
-## Security
-
-- **Server only** — throws in browser environments (`BROWSER_FORBIDDEN`).
-- **Bearer header only** — `Authorization: Bearer znd_live_…`. Keys in URL, JSON body, or `X-Api-Key` are rejected by the platform API.
-- **HTTPS** for `baseUrl` except `http://localhost` in development.
-- **No credentials in URL** — rejects `baseUrl` with embedded username/password.
-- **Input validation** — E.164 phones, email format, template slug, variable size limits (aligned with the platform API).
-- **Redirects disabled** — `fetch` uses `redirect: "error"`.
-- **CORS** — optional origin allowlist in Dashboard → Settings → Integrations (browser calls only).
-
----
-
-## Mobile & SPA
-
-Never put `znd_live_` keys in React Native, Flutter, or browser code. Call your own backend; your backend uses this SDK.
+## Best practices
 
-See [Developer docs → Quickstart](https://zindua.run/developers#setup).
+1. Store the API key in environment variables or a secrets manager.
+2. Call Zindua from your **API routes** only, not from React/Vue/mobile bundles.
+3. Use **`znd_test_…`** in staging; **`znd_live_…`** in production.
+4. Pin the SDK version in `package.json`, e.g. `"@zindua/sdk": "1.2.6"`.
+5. One Zindua project per client when quotas, senders, or templates must stay isolated.
 
 ---
 
-## HTTP without the SDK
-
-Any language can call the same endpoint:
+## Without the SDK (HTTP)
 
 ```bash
 curl -X POST https://zindua.run/api/v1/send \
@@ -264,34 +537,20 @@ curl -X POST https://zindua.run/api/v1/send \
   -d '{"to":"user@example.com","template":"welcome","variables":{"name":"Alex"}}'
 ```
 
-Full reference: [HTTP / cURL](https://zindua.run/developers#http).
+See [HTTP / cURL](https://zindua.run/developers#http).
 
 ---
 
-## API surface
+## API reference
 
 | Export | Description |
 |--------|-------------|
 | `Zindua` | Client class |
-| `ZinduaError` | Typed error |
+| `ZinduaError` | Error type (`status`, `code`, `message`, `details`) |
+| `ZinduaSendResult` | Success payload type |
+| `ZinduaSendContext` | Type of `result.context` |
 | `DEFAULT_API_BASE` | `https://zindua.run/api/v1` |
-| `LIMITS` | Validation limits (documented constants) |
-
----
-
-## Local development (monorepo)
-
-```bash
-cd packages/zindua-js
-npm run build
-npm test
-```
-
-From the app repo root:
-
-```bash
-npm install file:./packages/zindua-js
-```
+| `LIMITS` | Client-side validation limits |
 
 ---
 

package/dist/client.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Zindua = void 0;
 const errors_1 = require("./errors");
 const validate_1 = require("./validate");
-const SDK_VERSION = "1.2.3";
+const SDK_VERSION = "1.2.6";
 const USER_AGENT = `Zindua-JS/${SDK_VERSION}`;
 function buildPayload(options, channel) {
     const to = (0, validate_1.validateRecipient)(options.to, channel);

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-export type ZinduaErrorCode = "INVALID_API_KEY" | "INVALID_BASE_URL" | "BROWSER_FORBIDDEN" | "INVALID_OPTIONS" | "INVALID_RECIPIENT" | "INVALID_TEMPLATE" | "INVALID_CHANNEL" | "INVALID_LANG" | "INVALID_VARIABLES" | "REQUEST_TIMEOUT" | "INVALID_RESPONSE" | "API_ERROR";
+export type ZinduaErrorCode = "INVALID_API_KEY" | "INVALID_BASE_URL" | "BROWSER_FORBIDDEN" | "INVALID_OPTIONS" | "INVALID_EMAIL" | "INVALID_PHONE" | "MISSING_FIELDS" | "INVALID_TEMPLATE" | "INVALID_CHANNEL" | "INVALID_LANG" | "INVALID_VARIABLES" | "REQUEST_TIMEOUT" | "INVALID_RESPONSE" | "API_ERROR";
 /** Structured error — never includes the API key in the message. */
 export declare class ZinduaError extends Error {
     readonly status: number;

package/dist/validate.js

@@ -107,20 +107,26 @@ function validateRecipient(to, channel) {
     if (!recipient || recipient.length > exports.LIMITS.maxToLength) {
         throw new errors_1.ZinduaError("to is required and must be under 320 characters.", {
             status: 0,
-            code: "INVALID_RECIPIENT",
+            code: "MISSING_FIELDS",
         });
     }
     if (channel === "email") {
+        if (E164_RE.test(recipient)) {
+            throw new errors_1.ZinduaError('A phone number cannot be sent on channel "email". Use an email address (e.g. user@example.com) or set channel to "whatsapp".', { status: 0, code: "INVALID_EMAIL" });
+        }
         if (!EMAIL_RE.test(recipient)) {
             throw new errors_1.ZinduaError("Invalid email address for channel email.", {
                 status: 0,
-                code: "INVALID_RECIPIENT",
+                code: "INVALID_EMAIL",
             });
         }
         return recipient;
     }
+    if (EMAIL_RE.test(recipient)) {
+        throw new errors_1.ZinduaError('An email address cannot be sent on channel "whatsapp". Use E.164 with + (e.g. +243812345678) or set channel to "email".', { status: 0, code: "INVALID_PHONE" });
+    }
     if (!E164_RE.test(recipient)) {
-        throw new errors_1.ZinduaError("WhatsApp to must be E.164 with leading + (e.g. +243812345678).", { status: 0, code: "INVALID_RECIPIENT" });
+        throw new errors_1.ZinduaError("WhatsApp to must be E.164 with leading + (e.g. +243812345678).", { status: 0, code: "INVALID_PHONE" });
     }
     return recipient;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zindua/sdk",
-  "version": "1.2.3",
+  "version": "1.2.6",
   "description": "Official Zindua SDK for Node.js — transactional email and WhatsApp via POST /api/v1/send.",
   "author": "Zindua",
   "license": "MIT",