@zyphr-dev/node-sdk 0.1.37 → 0.1.38

package/dist/index.js

@@ -5092,6 +5092,47 @@ function InboxNotificationResponseToJSONTyped(value, ignoreDiscriminator = false
   };
 }
 
+// src/src/models/InviteEndUserRequest.ts
+var InviteEndUserRequestSendLinkEnum = {
+  MAGIC: "magic",
+  PASSWORD_RESET: "password_reset",
+  NONE: "none"
+};
+function instanceOfInviteEndUserRequest(value) {
+  if (!("email" in value) || value["email"] === void 0) return false;
+  return true;
+}
+function InviteEndUserRequestFromJSON(json) {
+  return InviteEndUserRequestFromJSONTyped(json, false);
+}
+function InviteEndUserRequestFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    "email": json["email"],
+    "name": json["name"] == null ? void 0 : json["name"],
+    "metadata": json["metadata"] == null ? void 0 : json["metadata"],
+    "sendLink": json["send_link"] == null ? void 0 : json["send_link"],
+    "redirectUrl": json["redirect_url"] == null ? void 0 : json["redirect_url"]
+  };
+}
+function InviteEndUserRequestToJSON(json) {
+  return InviteEndUserRequestToJSONTyped(json, false);
+}
+function InviteEndUserRequestToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    "email": value["email"],
+    "name": value["name"],
+    "metadata": value["metadata"],
+    "send_link": value["sendLink"],
+    "redirect_url": value["redirectUrl"]
+  };
+}
+
 // src/src/models/ListWaaSApplications200Response.ts
 function instanceOfListWaaSApplications200Response(value) {
   return true;
@@ -6471,6 +6512,37 @@ function OAuthProviderToJSONTyped(value, ignoreDiscriminator = false) {
   };
 }
 
+// src/src/models/OAuthProviderName.ts
+var OAuthProviderName = {
+  GOOGLE: "google",
+  APPLE: "apple",
+  FACEBOOK: "facebook",
+  GITHUB: "github",
+  MICROSOFT: "microsoft"
+};
+function instanceOfOAuthProviderName(value) {
+  for (const key in OAuthProviderName) {
+    if (Object.prototype.hasOwnProperty.call(OAuthProviderName, key)) {
+      if (OAuthProviderName[key] === value) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function OAuthProviderNameFromJSON(json) {
+  return OAuthProviderNameFromJSONTyped(json, false);
+}
+function OAuthProviderNameFromJSONTyped(json, ignoreDiscriminator) {
+  return json;
+}
+function OAuthProviderNameToJSON(value) {
+  return value;
+}
+function OAuthProviderNameToJSONTyped(value, ignoreDiscriminator) {
+  return value;
+}
+
 // src/src/models/OAuthProvidersResponseData.ts
 function instanceOfOAuthProvidersResponseData(value) {
   return true;
@@ -10054,6 +10126,33 @@ function SetDomainInboundRequestToJSONTyped(value, ignoreDiscriminator = false)
   };
 }
 
+// src/src/models/SetEndUserClaimsRequest.ts
+function instanceOfSetEndUserClaimsRequest(value) {
+  return true;
+}
+function SetEndUserClaimsRequestFromJSON(json) {
+  return SetEndUserClaimsRequestFromJSONTyped(json, false);
+}
+function SetEndUserClaimsRequestFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    "claims": json["claims"] == null ? void 0 : json["claims"]
+  };
+}
+function SetEndUserClaimsRequestToJSON(json) {
+  return SetEndUserClaimsRequestToJSONTyped(json, false);
+}
+function SetEndUserClaimsRequestToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    "claims": value["claims"]
+  };
+}
+
 // src/src/models/SetPreferencesRequestPreferencesInner.ts
 function instanceOfSetPreferencesRequestPreferencesInner(value) {
   return true;
@@ -10128,7 +10227,9 @@ function SignInAnonymouslyRequestFromJSONTyped(json, ignoreDiscriminator) {
   return {
     "deviceId": json["device_id"],
     "name": json["name"] == null ? void 0 : json["name"],
-    "metadata": json["metadata"] == null ? void 0 : json["metadata"]
+    "metadata": json["metadata"] == null ? void 0 : json["metadata"],
+    "organizationId": json["organization_id"] == null ? void 0 : json["organization_id"],
+    "organizationRole": json["organization_role"] == null ? void 0 : json["organization_role"]
   };
 }
 function SignInAnonymouslyRequestToJSON(json) {
@@ -10141,7 +10242,52 @@ function SignInAnonymouslyRequestToJSONTyped(value, ignoreDiscriminator = false)
   return {
     "device_id": value["deviceId"],
     "name": value["name"],
-    "metadata": value["metadata"]
+    "metadata": value["metadata"],
+    "organization_id": value["organizationId"],
+    "organization_role": value["organizationRole"]
+  };
+}
+
+// src/src/models/SignInWithGameCenterRequest.ts
+function instanceOfSignInWithGameCenterRequest(value) {
+  if (!("playerId" in value) || value["playerId"] === void 0) return false;
+  if (!("publicKeyUrl" in value) || value["publicKeyUrl"] === void 0) return false;
+  if (!("signature" in value) || value["signature"] === void 0) return false;
+  if (!("salt" in value) || value["salt"] === void 0) return false;
+  if (!("timestamp" in value) || value["timestamp"] === void 0) return false;
+  if (!("bundleId" in value) || value["bundleId"] === void 0) return false;
+  return true;
+}
+function SignInWithGameCenterRequestFromJSON(json) {
+  return SignInWithGameCenterRequestFromJSONTyped(json, false);
+}
+function SignInWithGameCenterRequestFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    "playerId": json["playerId"],
+    "publicKeyUrl": json["publicKeyUrl"],
+    "signature": json["signature"],
+    "salt": json["salt"],
+    "timestamp": json["timestamp"],
+    "bundleId": json["bundleId"]
+  };
+}
+function SignInWithGameCenterRequestToJSON(json) {
+  return SignInWithGameCenterRequestToJSONTyped(json, false);
+}
+function SignInWithGameCenterRequestToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    "playerId": value["playerId"],
+    "publicKeyUrl": value["publicKeyUrl"],
+    "signature": value["signature"],
+    "salt": value["salt"],
+    "timestamp": value["timestamp"],
+    "bundleId": value["bundleId"]
   };
 }
 
@@ -11800,6 +11946,41 @@ function UpdateCategoryRequestToJSONTyped(value, ignoreDiscriminator = false) {
   };
 }
 
+// src/src/models/UpdateEndUserByApplicationRequest.ts
+function instanceOfUpdateEndUserByApplicationRequest(value) {
+  return true;
+}
+function UpdateEndUserByApplicationRequestFromJSON(json) {
+  return UpdateEndUserByApplicationRequestFromJSONTyped(json, false);
+}
+function UpdateEndUserByApplicationRequestFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    "email": json["email"] == null ? void 0 : json["email"],
+    "name": json["name"] == null ? void 0 : json["name"],
+    "avatarUrl": json["avatar_url"] == null ? void 0 : json["avatar_url"],
+    "metadata": json["metadata"] == null ? void 0 : json["metadata"],
+    "status": json["status"] == null ? void 0 : json["status"]
+  };
+}
+function UpdateEndUserByApplicationRequestToJSON(json) {
+  return UpdateEndUserByApplicationRequestToJSONTyped(json, false);
+}
+function UpdateEndUserByApplicationRequestToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    "email": value["email"],
+    "name": value["name"],
+    "avatar_url": value["avatarUrl"],
+    "metadata": value["metadata"],
+    "status": value["status"]
+  };
+}
+
 // src/src/models/UpdateEndUserRequest.ts
 function instanceOfUpdateEndUserRequest(value) {
   return true;
@@ -16685,7 +16866,7 @@ var AuthRegistrationApi = class extends BaseAPI {
     return await response.value();
   }
   /**
-   * Issue an end-user identity to a device without email, password, OAuth, or any other credential. Idempotent per (application, environment, device_id): repeated calls with the same device_id return the same user but a fresh token pair. Prior sessions for the user remain valid until natural expiry.  Anonymous users do not count toward MAU quota until their first authenticated request after sign-in (excluding /v1/auth/refresh).  Convert an anonymous user to a full account via POST /v1/auth/users/convert. 
+   * Issue an end-user identity to a device without email, password, OAuth, or any other credential. Idempotent per (application, environment, device_id): repeated calls with the same device_id return the same user but a fresh token pair. Prior sessions for the user remain valid until natural expiry.  Anonymous users do not count toward MAU quota until their first authenticated request after sign-in (excluding /v1/auth/refresh).  Convert an anonymous user to a full account via POST /v1/auth/users/convert.  Pass an optional `organization_id` to create the anonymous user directly in an organization; the returned access token then carries `org_id` (and `orgs`), matching the org-scoped register/login flow. 
    * Sign in anonymously
    */
   async signInAnonymouslyRaw(requestParameters, initOverrides) {
@@ -16711,13 +16892,47 @@ var AuthRegistrationApi = class extends BaseAPI {
     return new JSONApiResponse(response, (jsonValue) => AuthResultResponseFromJSON(jsonValue));
   }
   /**
-   * Issue an end-user identity to a device without email, password, OAuth, or any other credential. Idempotent per (application, environment, device_id): repeated calls with the same device_id return the same user but a fresh token pair. Prior sessions for the user remain valid until natural expiry.  Anonymous users do not count toward MAU quota until their first authenticated request after sign-in (excluding /v1/auth/refresh).  Convert an anonymous user to a full account via POST /v1/auth/users/convert. 
+   * Issue an end-user identity to a device without email, password, OAuth, or any other credential. Idempotent per (application, environment, device_id): repeated calls with the same device_id return the same user but a fresh token pair. Prior sessions for the user remain valid until natural expiry.  Anonymous users do not count toward MAU quota until their first authenticated request after sign-in (excluding /v1/auth/refresh).  Convert an anonymous user to a full account via POST /v1/auth/users/convert.  Pass an optional `organization_id` to create the anonymous user directly in an organization; the returned access token then carries `org_id` (and `orgs`), matching the org-scoped register/login flow. 
    * Sign in anonymously
    */
   async signInAnonymously(signInAnonymouslyRequest, initOverrides) {
     const response = await this.signInAnonymouslyRaw({ signInAnonymouslyRequest }, initOverrides);
     return await response.value();
   }
+  /**
+   * Exchange an Apple Game Center identity-verification assertion for a Zyphr end-user session. Zyphr independently re-verifies the assertion server-side (Apple certificate chain, RSA-SHA256 signature, timestamp freshness, single-use replay guard, and bundle-id binding) before provisioning-or-looking-up the user and minting tokens. The user is keyed on the modern scoped `playerId` (gamePlayerID).  ## Producing the assertion (Integration)  The assertion is produced **on-device by the iOS app** — there is no server-side way to mint it. The app calls GameKit\'s `GKLocalPlayer.fetchItems(forIdentityVerificationSignature:)`, which returns `publicKeyURL`, `signature`, `salt`, and `timestamp`; combine those with the local player\'s `gamePlayerID` and the app\'s bundle identifier and submit them here.  Two integration shapes are supported:   - **client-direct** — the iOS app holds the Zyphr application public     key and calls this endpoint itself.   - **backend-relayed** — the app forwards the fetched assertion fields     to the customer\'s own backend, which relays them to this endpoint;     the app never holds Zyphr keys. (This is the common shape for games.)  On any verification failure the response is a single opaque `401` `invalid_assertion` — the specific control that failed is never disclosed. 
+   * Sign in with Apple Game Center
+   */
+  async signInWithGameCenterRaw(requestParameters, initOverrides) {
+    if (requestParameters["signInWithGameCenterRequest"] == null) {
+      throw new RequiredError(
+        "signInWithGameCenterRequest",
+        'Required parameter "signInWithGameCenterRequest" was null or undefined when calling signInWithGameCenter().'
+      );
+    }
+    const queryParameters = {};
+    const headerParameters = {};
+    headerParameters["Content-Type"] = "application/json";
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key");
+    }
+    const response = await this.request({
+      path: `/auth/game-center`,
+      method: "POST",
+      headers: headerParameters,
+      query: queryParameters,
+      body: SignInWithGameCenterRequestToJSON(requestParameters["signInWithGameCenterRequest"])
+    }, initOverrides);
+    return new JSONApiResponse(response, (jsonValue) => AuthResultResponseFromJSON(jsonValue));
+  }
+  /**
+   * Exchange an Apple Game Center identity-verification assertion for a Zyphr end-user session. Zyphr independently re-verifies the assertion server-side (Apple certificate chain, RSA-SHA256 signature, timestamp freshness, single-use replay guard, and bundle-id binding) before provisioning-or-looking-up the user and minting tokens. The user is keyed on the modern scoped `playerId` (gamePlayerID).  ## Producing the assertion (Integration)  The assertion is produced **on-device by the iOS app** — there is no server-side way to mint it. The app calls GameKit\'s `GKLocalPlayer.fetchItems(forIdentityVerificationSignature:)`, which returns `publicKeyURL`, `signature`, `salt`, and `timestamp`; combine those with the local player\'s `gamePlayerID` and the app\'s bundle identifier and submit them here.  Two integration shapes are supported:   - **client-direct** — the iOS app holds the Zyphr application public     key and calls this endpoint itself.   - **backend-relayed** — the app forwards the fetched assertion fields     to the customer\'s own backend, which relays them to this endpoint;     the app never holds Zyphr keys. (This is the common shape for games.)  On any verification failure the response is a single opaque `401` `invalid_assertion` — the specific control that failed is never disclosed. 
+   * Sign in with Apple Game Center
+   */
+  async signInWithGameCenter(signInWithGameCenterRequest, initOverrides) {
+    const response = await this.signInWithGameCenterRaw({ signInWithGameCenterRequest }, initOverrides);
+    return await response.value();
+  }
 };
 
 // src/src/apis/AuthSessionsApi.ts
@@ -16867,50 +17082,88 @@ var AuthSessionsApi = class extends BaseAPI {
   }
 };
 
-// src/src/apis/AuthUserProfileApi.ts
-var AuthUserProfileApi = class extends BaseAPI {
+// src/src/apis/AuthUserDirectoryApi.ts
+var AuthUserDirectoryApi = class extends BaseAPI {
   /**
-   * Delete the current end user account (GDPR right to erasure). This is a soft delete — the account is marked as deleted but data is retained for a period to allow for recovery or legal requirements. 
-   * Delete current end user account
+   * Secret-key-scoped admin soft-delete for an arbitrary end user in the authenticating application. Works in both test and live environments. Scoped to the application via the application_id filter — a caller can never delete a user belonging to another application.  Mirrors the self-service `DELETE /auth/users/me` flow: revokes all sessions, soft-deletes the row (status=\'deleted\'), and emits a `user.deleted` webhook with `method=\'application_admin\'`. The audit log row survives (no FK to end_users), so org-history queries still resolve. 
+   * Delete an end user (server-side admin)
    */
-  async deleteEndUserRaw(initOverrides) {
+  async deleteEndUserByApplicationRaw(requestParameters, initOverrides) {
+    if (requestParameters["userId"] == null) {
+      throw new RequiredError(
+        "userId",
+        'Required parameter "userId" was null or undefined when calling deleteEndUserByApplication().'
+      );
+    }
     const queryParameters = {};
     const headerParameters = {};
-    if (this.configuration && this.configuration.accessToken) {
-      const token = this.configuration.accessToken;
-      const tokenString = await token("EndUserToken", []);
-      if (tokenString) {
-        headerParameters["Authorization"] = `Bearer ${tokenString}`;
-      }
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret");
     }
     if (this.configuration && this.configuration.apiKey) {
       headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key");
     }
     const response = await this.request({
-      path: `/auth/users/me`,
+      path: `/auth/users/{user_id}`.replace(`{${"user_id"}}`, encodeURIComponent(String(requestParameters["userId"]))),
       method: "DELETE",
       headers: headerParameters,
       query: queryParameters
     }, initOverrides);
-    return new JSONApiResponse(response, (jsonValue) => EndUserDeleteResponseFromJSON(jsonValue));
+    return new VoidApiResponse(response);
   }
   /**
-   * Delete the current end user account (GDPR right to erasure). This is a soft delete — the account is marked as deleted but data is retained for a period to allow for recovery or legal requirements. 
-   * Delete current end user account
+   * Secret-key-scoped admin soft-delete for an arbitrary end user in the authenticating application. Works in both test and live environments. Scoped to the application via the application_id filter — a caller can never delete a user belonging to another application.  Mirrors the self-service `DELETE /auth/users/me` flow: revokes all sessions, soft-deletes the row (status=\'deleted\'), and emits a `user.deleted` webhook with `method=\'application_admin\'`. The audit log row survives (no FK to end_users), so org-history queries still resolve. 
+   * Delete an end user (server-side admin)
    */
-  async deleteEndUser(initOverrides) {
-    const response = await this.deleteEndUserRaw(initOverrides);
-    return await response.value();
+  async deleteEndUserByApplication(userId, initOverrides) {
+    await this.deleteEndUserByApplicationRaw({ userId }, initOverrides);
   }
   /**
-   * App-credentialed soft-delete for an end user, scoped to the test environment only. Live-mode credentials receive 403 — this is the intentional safety guard against a misconfigured CI runner nuking production users.  Mirrors the self-service `DELETE /auth/users/me` flow: revokes all sessions, soft-deletes the row (status=\'deleted\'), and emits a `user.deleted` webhook with `method=\'application_admin\'`. The audit log row survives (no FK to end_users), so org-history queries still resolve.  Intended for smoke / test-fixture cleanup. Production deletes should continue to use `DELETE /auth/users/me` from the end-user\'s own session or the dashboard. 
-   * Delete an end user (test environment only)
+   * Secret-key-scoped lookup of a single end user by email address within the authenticating application. Scoped to the application — never resolves a user from another application. Does not return the password hash. 
+   * Look up an end user by email (server-side admin)
    */
-  async deleteEndUserByApplicationRaw(requestParameters, initOverrides) {
+  async getEndUserByEmailRaw(requestParameters, initOverrides) {
+    if (requestParameters["email"] == null) {
+      throw new RequiredError(
+        "email",
+        'Required parameter "email" was null or undefined when calling getEndUserByEmail().'
+      );
+    }
+    const queryParameters = {};
+    if (requestParameters["email"] != null) {
+      queryParameters["email"] = requestParameters["email"];
+    }
+    const headerParameters = {};
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret");
+    }
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key");
+    }
+    const response = await this.request({
+      path: `/auth/users/by-email`,
+      method: "GET",
+      headers: headerParameters,
+      query: queryParameters
+    }, initOverrides);
+    return new VoidApiResponse(response);
+  }
+  /**
+   * Secret-key-scoped lookup of a single end user by email address within the authenticating application. Scoped to the application — never resolves a user from another application. Does not return the password hash. 
+   * Look up an end user by email (server-side admin)
+   */
+  async getEndUserByEmail(email, initOverrides) {
+    await this.getEndUserByEmailRaw({ email }, initOverrides);
+  }
+  /**
+   * Secret-key-scoped fetch of a single end user by id within the authenticating application. Scoped to the application — a caller can never read a user belonging to another application. 
+   * Get an end user by id (server-side admin)
+   */
+  async getEndUserByIdRaw(requestParameters, initOverrides) {
     if (requestParameters["userId"] == null) {
       throw new RequiredError(
         "userId",
-        'Required parameter "userId" was null or undefined when calling deleteEndUserByApplication().'
+        'Required parameter "userId" was null or undefined when calling getEndUserById().'
       );
     }
     const queryParameters = {};
@@ -16923,18 +17176,253 @@ var AuthUserProfileApi = class extends BaseAPI {
     }
     const response = await this.request({
       path: `/auth/users/{user_id}`.replace(`{${"user_id"}}`, encodeURIComponent(String(requestParameters["userId"]))),
-      method: "DELETE",
+      method: "GET",
       headers: headerParameters,
       query: queryParameters
     }, initOverrides);
     return new VoidApiResponse(response);
   }
   /**
-   * App-credentialed soft-delete for an end user, scoped to the test environment only. Live-mode credentials receive 403 — this is the intentional safety guard against a misconfigured CI runner nuking production users.  Mirrors the self-service `DELETE /auth/users/me` flow: revokes all sessions, soft-deletes the row (status=\'deleted\'), and emits a `user.deleted` webhook with `method=\'application_admin\'`. The audit log row survives (no FK to end_users), so org-history queries still resolve.  Intended for smoke / test-fixture cleanup. Production deletes should continue to use `DELETE /auth/users/me` from the end-user\'s own session or the dashboard. 
-   * Delete an end user (test environment only)
+   * Secret-key-scoped fetch of a single end user by id within the authenticating application. Scoped to the application — a caller can never read a user belonging to another application. 
+   * Get an end user by id (server-side admin)
    */
-  async deleteEndUserByApplication(userId, initOverrides) {
-    await this.deleteEndUserByApplicationRaw({ userId }, initOverrides);
+  async getEndUserById(userId, initOverrides) {
+    await this.getEndUserByIdRaw({ userId }, initOverrides);
+  }
+  /**
+   * Secret-key-scoped read of the authoritative custom_claims stored for an end user. These are the TRUSTED claims embedded into the user\'s JWTs on login/refresh — use them (not the client-writable `metadata` field) for authorization decisions. Returns an empty object when none are set. 
+   * Get an end user\'s stored custom claims (server-side admin)
+   */
+  async getEndUserClaimsRaw(requestParameters, initOverrides) {
+    if (requestParameters["userId"] == null) {
+      throw new RequiredError(
+        "userId",
+        'Required parameter "userId" was null or undefined when calling getEndUserClaims().'
+      );
+    }
+    const queryParameters = {};
+    const headerParameters = {};
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret");
+    }
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key");
+    }
+    const response = await this.request({
+      path: `/auth/users/{user_id}/claims`.replace(`{${"user_id"}}`, encodeURIComponent(String(requestParameters["userId"]))),
+      method: "GET",
+      headers: headerParameters,
+      query: queryParameters
+    }, initOverrides);
+    return new VoidApiResponse(response);
+  }
+  /**
+   * Secret-key-scoped read of the authoritative custom_claims stored for an end user. These are the TRUSTED claims embedded into the user\'s JWTs on login/refresh — use them (not the client-writable `metadata` field) for authorization decisions. Returns an empty object when none are set. 
+   * Get an end user\'s stored custom claims (server-side admin)
+   */
+  async getEndUserClaims(userId, initOverrides) {
+    await this.getEndUserClaimsRaw({ userId }, initOverrides);
+  }
+  /**
+   * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+   * Pre-provision (invite) an end user (server-side admin)
+   */
+  async inviteEndUserRaw(requestParameters, initOverrides) {
+    if (requestParameters["inviteEndUserRequest"] == null) {
+      throw new RequiredError(
+        "inviteEndUserRequest",
+        'Required parameter "inviteEndUserRequest" was null or undefined when calling inviteEndUser().'
+      );
+    }
+    const queryParameters = {};
+    const headerParameters = {};
+    headerParameters["Content-Type"] = "application/json";
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret");
+    }
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key");
+    }
+    const response = await this.request({
+      path: `/auth/users/invite`,
+      method: "POST",
+      headers: headerParameters,
+      query: queryParameters,
+      body: InviteEndUserRequestToJSON(requestParameters["inviteEndUserRequest"])
+    }, initOverrides);
+    return new VoidApiResponse(response);
+  }
+  /**
+   * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+   * Pre-provision (invite) an end user (server-side admin)
+   */
+  async inviteEndUser(inviteEndUserRequest, initOverrides) {
+    await this.inviteEndUserRaw({ inviteEndUserRequest }, initOverrides);
+  }
+  /**
+   * Secret-key-scoped directory listing of end users in the authenticating application. Supports substring search over email, name, and phone, an optional environment filter (test/live), and pagination. Scoped to the application — never returns users from another application. 
+   * List / search end users (server-side admin)
+   */
+  async listEndUsersRaw(requestParameters, initOverrides) {
+    const queryParameters = {};
+    if (requestParameters["page"] != null) {
+      queryParameters["page"] = requestParameters["page"];
+    }
+    if (requestParameters["perPage"] != null) {
+      queryParameters["per_page"] = requestParameters["perPage"];
+    }
+    if (requestParameters["search"] != null) {
+      queryParameters["search"] = requestParameters["search"];
+    }
+    if (requestParameters["environment"] != null) {
+      queryParameters["environment"] = requestParameters["environment"];
+    }
+    const headerParameters = {};
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret");
+    }
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key");
+    }
+    const response = await this.request({
+      path: `/auth/users`,
+      method: "GET",
+      headers: headerParameters,
+      query: queryParameters
+    }, initOverrides);
+    return new VoidApiResponse(response);
+  }
+  /**
+   * Secret-key-scoped directory listing of end users in the authenticating application. Supports substring search over email, name, and phone, an optional environment filter (test/live), and pagination. Scoped to the application — never returns users from another application. 
+   * List / search end users (server-side admin)
+   */
+  async listEndUsers(page, perPage, search, environment, initOverrides) {
+    await this.listEndUsersRaw({ page, perPage, search, environment }, initOverrides);
+  }
+  /**
+   * Secret-key-scoped upsert of the authoritative custom_claims for an end user. Set server-side only — clients cannot write these, which is what makes them safe for authorization (e.g. an account-type/admin flag). Claims are embedded into the user\'s JWTs on the next login/refresh. Max 4KB; reserved JWT/Zyphr claim names are rejected.  To make a change take effect immediately on already-issued tokens (e.g. revoking admin), call POST /auth/sessions/revoke-all for the user after updating claims — that bumps the revocation epoch so outstanding access tokens stop verifying. 
+   * Set an end user\'s stored custom claims (server-side admin)
+   */
+  async setEndUserClaimsRaw(requestParameters, initOverrides) {
+    if (requestParameters["userId"] == null) {
+      throw new RequiredError(
+        "userId",
+        'Required parameter "userId" was null or undefined when calling setEndUserClaims().'
+      );
+    }
+    if (requestParameters["setEndUserClaimsRequest"] == null) {
+      throw new RequiredError(
+        "setEndUserClaimsRequest",
+        'Required parameter "setEndUserClaimsRequest" was null or undefined when calling setEndUserClaims().'
+      );
+    }
+    const queryParameters = {};
+    const headerParameters = {};
+    headerParameters["Content-Type"] = "application/json";
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret");
+    }
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key");
+    }
+    const response = await this.request({
+      path: `/auth/users/{user_id}/claims`.replace(`{${"user_id"}}`, encodeURIComponent(String(requestParameters["userId"]))),
+      method: "PUT",
+      headers: headerParameters,
+      query: queryParameters,
+      body: SetEndUserClaimsRequestToJSON(requestParameters["setEndUserClaimsRequest"])
+    }, initOverrides);
+    return new VoidApiResponse(response);
+  }
+  /**
+   * Secret-key-scoped upsert of the authoritative custom_claims for an end user. Set server-side only — clients cannot write these, which is what makes them safe for authorization (e.g. an account-type/admin flag). Claims are embedded into the user\'s JWTs on the next login/refresh. Max 4KB; reserved JWT/Zyphr claim names are rejected.  To make a change take effect immediately on already-issued tokens (e.g. revoking admin), call POST /auth/sessions/revoke-all for the user after updating claims — that bumps the revocation epoch so outstanding access tokens stop verifying. 
+   * Set an end user\'s stored custom claims (server-side admin)
+   */
+  async setEndUserClaims(userId, setEndUserClaimsRequest, initOverrides) {
+    await this.setEndUserClaimsRaw({ userId, setEndUserClaimsRequest }, initOverrides);
+  }
+  /**
+   * Secret-key-scoped update of an arbitrary end user in the authenticating application. Updatable fields: email, name, avatar_url, metadata, status. Scoped to the application — a caller can never modify a user belonging to another application. 
+   * Update an end user (server-side admin)
+   */
+  async updateEndUserByApplicationRaw(requestParameters, initOverrides) {
+    if (requestParameters["userId"] == null) {
+      throw new RequiredError(
+        "userId",
+        'Required parameter "userId" was null or undefined when calling updateEndUserByApplication().'
+      );
+    }
+    if (requestParameters["updateEndUserByApplicationRequest"] == null) {
+      throw new RequiredError(
+        "updateEndUserByApplicationRequest",
+        'Required parameter "updateEndUserByApplicationRequest" was null or undefined when calling updateEndUserByApplication().'
+      );
+    }
+    const queryParameters = {};
+    const headerParameters = {};
+    headerParameters["Content-Type"] = "application/json";
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret");
+    }
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key");
+    }
+    const response = await this.request({
+      path: `/auth/users/{user_id}`.replace(`{${"user_id"}}`, encodeURIComponent(String(requestParameters["userId"]))),
+      method: "PATCH",
+      headers: headerParameters,
+      query: queryParameters,
+      body: UpdateEndUserByApplicationRequestToJSON(requestParameters["updateEndUserByApplicationRequest"])
+    }, initOverrides);
+    return new VoidApiResponse(response);
+  }
+  /**
+   * Secret-key-scoped update of an arbitrary end user in the authenticating application. Updatable fields: email, name, avatar_url, metadata, status. Scoped to the application — a caller can never modify a user belonging to another application. 
+   * Update an end user (server-side admin)
+   */
+  async updateEndUserByApplication(userId, updateEndUserByApplicationRequest, initOverrides) {
+    await this.updateEndUserByApplicationRaw({ userId, updateEndUserByApplicationRequest }, initOverrides);
+  }
+};
+var ListEndUsersEnvironmentEnum = {
+  TEST: "test",
+  LIVE: "live"
+};
+
+// src/src/apis/AuthUserProfileApi.ts
+var AuthUserProfileApi = class extends BaseAPI {
+  /**
+   * Delete the current end user account (GDPR right to erasure). This is a soft delete — the account is marked as deleted but data is retained for a period to allow for recovery or legal requirements. 
+   * Delete current end user account
+   */
+  async deleteEndUserRaw(initOverrides) {
+    const queryParameters = {};
+    const headerParameters = {};
+    if (this.configuration && this.configuration.accessToken) {
+      const token = this.configuration.accessToken;
+      const tokenString = await token("EndUserToken", []);
+      if (tokenString) {
+        headerParameters["Authorization"] = `Bearer ${tokenString}`;
+      }
+    }
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key");
+    }
+    const response = await this.request({
+      path: `/auth/users/me`,
+      method: "DELETE",
+      headers: headerParameters,
+      query: queryParameters
+    }, initOverrides);
+    return new JSONApiResponse(response, (jsonValue) => EndUserDeleteResponseFromJSON(jsonValue));
+  }
+  /**
+   * Delete the current end user account (GDPR right to erasure). This is a soft delete — the account is marked as deleted but data is retained for a period to allow for recovery or legal requirements. 
+   * Delete current end user account
+   */
+  async deleteEndUser(initOverrides) {
+    const response = await this.deleteEndUserRaw(initOverrides);
+    return await response.value();
   }
   /**
    * Retrieve the profile of the currently authenticated end user.
@@ -23105,34 +23593,34 @@ var ZyphrError = class extends Error {
   }
 };
 var ZyphrValidationError = class extends ZyphrError {
-  constructor(message, details) {
-    super({ message, status: 422, code: "validation_error", details });
+  constructor(message, details, code = "validation_error") {
+    super({ message, status: 422, code, details });
     this.name = "ZyphrValidationError";
   }
 };
 var ZyphrAuthenticationError = class extends ZyphrError {
-  constructor(message) {
-    super({ message, status: 401, code: "authentication_error" });
+  constructor(message, code = "authentication_error") {
+    super({ message, status: 401, code });
     this.name = "ZyphrAuthenticationError";
   }
 };
 var ZyphrRateLimitError = class extends ZyphrError {
   retryAfter;
-  constructor(message, retryAfter) {
-    super({ message, status: 429, code: "rate_limit_exceeded" });
+  constructor(message, retryAfter, code = "rate_limit_exceeded") {
+    super({ message, status: 429, code });
     this.name = "ZyphrRateLimitError";
     this.retryAfter = retryAfter;
   }
 };
 var ZyphrNotFoundError = class extends ZyphrError {
-  constructor(message) {
-    super({ message, status: 404, code: "not_found" });
+  constructor(message, code = "not_found") {
+    super({ message, status: 404, code });
     this.name = "ZyphrNotFoundError";
   }
 };
 var ZyphrPayloadTooLargeError = class extends ZyphrError {
-  constructor(message, details, requestId) {
-    super({ message, status: 413, code: "payload_too_large", details, requestId });
+  constructor(message, details, requestId, code = "payload_too_large") {
+    super({ message, status: 413, code, details, requestId });
     this.name = "ZyphrPayloadTooLargeError";
   }
   /** Maximum allowed request body size in bytes (server-enforced). */
@@ -23162,24 +23650,24 @@ async function parseErrorResponse(response) {
   const error = body.error ?? {};
   const meta = body.meta ?? {};
   const message = error.message ?? response.statusText ?? "Unknown error";
-  const code = error.code;
+  const code = error.code || void 0;
   const requestId = meta.request_id;
   const details = error.details;
   switch (response.status) {
     case 400:
     case 422:
-      return new ZyphrValidationError(message, details);
+      return new ZyphrValidationError(message, details, code);
     case 401:
     case 403:
-      return new ZyphrAuthenticationError(message);
+      return new ZyphrAuthenticationError(message, code);
     case 404:
-      return new ZyphrNotFoundError(message);
+      return new ZyphrNotFoundError(message, code);
     case 413:
-      return new ZyphrPayloadTooLargeError(message, details, requestId);
+      return new ZyphrPayloadTooLargeError(message, details, requestId, code);
     case 429: {
       const retryAfterHeader = response.headers.get("Retry-After");
       const retryAfter = retryAfterHeader ? parseInt(retryAfterHeader, 10) : void 0;
-      return new ZyphrRateLimitError(message, retryAfter);
+      return new ZyphrRateLimitError(message, retryAfter, code);
     }
     default:
       return new ZyphrError({ message, status: response.status, code, requestId, details });
@@ -23290,6 +23778,99 @@ var Zyphr = class {
   }
 };
 
+// src/clientAuth.ts
+var errorMiddleware2 = {
+  async post(context) {
+    if (context.response.status >= 200 && context.response.status < 300) {
+      return;
+    }
+    throw await parseErrorResponse(context.response);
+  }
+};
+var ZyphrClientCredentialError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ZyphrClientCredentialError";
+  }
+};
+var SECRET_KEY_PREFIXES = ["za_sec_", "zy_live_", "zy_test_"];
+var ZyphrClient = class {
+  auth;
+  /** Device registration for push (takes an OS-acquired token). */
+  devices;
+  applicationKey;
+  accessToken;
+  constructor(options) {
+    if (!options.applicationKey) {
+      throw new ZyphrClientCredentialError("applicationKey (za_pub_*) is required");
+    }
+    if (SECRET_KEY_PREFIXES.some((p) => options.applicationKey.startsWith(p))) {
+      throw new ZyphrClientCredentialError(
+        "ZyphrClient must be constructed with a publishable application key (za_pub_*), never a secret key. Secret keys must stay server-side."
+      );
+    }
+    if (!options.applicationKey.startsWith("za_pub_")) {
+      throw new ZyphrClientCredentialError(
+        "applicationKey must be a publishable application key (za_pub_*)."
+      );
+    }
+    this.applicationKey = options.applicationKey;
+    this.accessToken = options.accessToken;
+    const config = new Configuration({
+      basePath: options.baseUrl,
+      // The only credential this client sends automatically is the publishable
+      // application key. End-user Bearer tokens are attached per-request via
+      // authedRequest() so token rotation doesn't require rebuilding the client.
+      apiKey: (name) => name === "X-Application-Key" ? this.applicationKey : "",
+      middleware: [errorMiddleware2]
+    });
+    this.auth = {
+      login: new AuthLoginApi(config),
+      registration: new AuthRegistrationApi(config),
+      sessions: new AuthSessionsApi(config),
+      emailVerification: new AuthEmailVerificationApi(config),
+      passwordReset: new AuthPasswordResetApi(config),
+      mfa: new AuthMFAApi(config),
+      magicLinks: new AuthMagicLinksApi(config),
+      oauth: new AuthOAuthApi(config),
+      organizations: new AuthOrganizationsApi(config),
+      phone: new AuthPhoneApi(config),
+      emailOtp: new AuthEmailOTPApi(config),
+      profile: new AuthUserProfileApi(config),
+      webauthn: new AuthWebAuthnApi(config)
+    };
+    this.devices = new DevicesApi(config);
+  }
+  /** Store the end-user access token for subsequent authedRequest() calls. */
+  setAccessToken(accessToken) {
+    this.accessToken = accessToken;
+  }
+  /** True when an end-user access token is currently set. */
+  get isAuthenticated() {
+    return Boolean(this.accessToken);
+  }
+  /**
+   * Build request overrides that authenticate as the current end user: the
+   * stored Bearer token plus the publishable application key required by
+   * user-scoped endpoints. Pass an explicit token to override the stored one.
+   *
+   * @example
+   * ```ts
+   * const me = await zyphr.auth.profile.getEndUser(zyphr.authedRequest());
+   * ```
+   */
+  authedRequest(accessToken) {
+    const token = accessToken ?? this.accessToken;
+    const headers = {
+      "X-Application-Key": this.applicationKey
+    };
+    if (token) {
+      headers.Authorization = `Bearer ${token}`;
+    }
+    return { headers };
+  }
+};
+
 // src/index.ts
 var SDK_VERSION = "0.1.0";
 export {
@@ -23436,6 +24017,7 @@ export {
   AuthTokensFromJSONTyped,
   AuthTokensToJSON,
   AuthTokensToJSONTyped,
+  AuthUserDirectoryApi,
   AuthUserFromJSON,
   AuthUserFromJSONTyped,
   AuthUserProfileApi,
@@ -23850,10 +24432,16 @@ export {
   InboxNotificationResponseFromJSONTyped,
   InboxNotificationResponseToJSON,
   InboxNotificationResponseToJSONTyped,
+  InviteEndUserRequestFromJSON,
+  InviteEndUserRequestFromJSONTyped,
+  InviteEndUserRequestSendLinkEnum,
+  InviteEndUserRequestToJSON,
+  InviteEndUserRequestToJSONTyped,
   JSONApiResponse,
   ListAllInboxStatusEnum,
   ListDevicesPlatformEnum,
   ListEmailsStatusEnum,
+  ListEndUsersEnvironmentEnum,
   ListInboundEmailsStatusEnum,
   ListPushStatusEnum,
   ListSlackMessagesStatusEnum,
@@ -24040,6 +24628,11 @@ export {
   OAuthProviderInfoFromJSONTyped,
   OAuthProviderInfoToJSON,
   OAuthProviderInfoToJSONTyped,
+  OAuthProviderName,
+  OAuthProviderNameFromJSON,
+  OAuthProviderNameFromJSONTyped,
+  OAuthProviderNameToJSON,
+  OAuthProviderNameToJSONTyped,
   OAuthProviderToJSON,
   OAuthProviderToJSONTyped,
   OAuthProvidersResponseDataFromJSON,
@@ -24469,6 +25062,10 @@ export {
   SetDomainInboundRequestFromJSONTyped,
   SetDomainInboundRequestToJSON,
   SetDomainInboundRequestToJSONTyped,
+  SetEndUserClaimsRequestFromJSON,
+  SetEndUserClaimsRequestFromJSONTyped,
+  SetEndUserClaimsRequestToJSON,
+  SetEndUserClaimsRequestToJSONTyped,
   SetPreferencesRequestFromJSON,
   SetPreferencesRequestFromJSONTyped,
   SetPreferencesRequestPreferencesInnerFromJSON,
@@ -24481,6 +25078,10 @@ export {
   SignInAnonymouslyRequestFromJSONTyped,
   SignInAnonymouslyRequestToJSON,
   SignInAnonymouslyRequestToJSONTyped,
+  SignInWithGameCenterRequestFromJSON,
+  SignInWithGameCenterRequestFromJSONTyped,
+  SignInWithGameCenterRequestToJSON,
+  SignInWithGameCenterRequestToJSONTyped,
   SlackApi,
   SlackMessageFromJSON,
   SlackMessageFromJSONTyped,
@@ -24714,6 +25315,10 @@ export {
   UpdateCategoryRequestFromJSONTyped,
   UpdateCategoryRequestToJSON,
   UpdateCategoryRequestToJSONTyped,
+  UpdateEndUserByApplicationRequestFromJSON,
+  UpdateEndUserByApplicationRequestFromJSONTyped,
+  UpdateEndUserByApplicationRequestToJSON,
+  UpdateEndUserByApplicationRequestToJSONTyped,
   UpdateEndUserRequestFromJSON,
   UpdateEndUserRequestFromJSONTyped,
   UpdateEndUserRequestToJSON,
@@ -25131,6 +25736,8 @@ export {
   WorkflowStepExecutionToJSONTyped,
   Zyphr,
   ZyphrAuthenticationError,
+  ZyphrClient,
+  ZyphrClientCredentialError,
   ZyphrError,
   ZyphrNotFoundError,
   ZyphrPayloadTooLargeError,
@@ -25265,6 +25872,7 @@ export {
   instanceOfInboxListMeta,
   instanceOfInboxListResponse,
   instanceOfInboxNotificationResponse,
+  instanceOfInviteEndUserRequest,
   instanceOfListWaaSApplications200Response,
   instanceOfListWaaSEndpointDeliveries200Response,
   instanceOfListWaaSEndpoints200Response,
@@ -25309,6 +25917,7 @@ export {
   instanceOfOAuthConnectionsResponseData,
   instanceOfOAuthProvider,
   instanceOfOAuthProviderInfo,
+  instanceOfOAuthProviderName,
   instanceOfOAuthProvidersResponse,
   instanceOfOAuthProvidersResponseData,
   instanceOfOAuthTokensRefreshResponse,
@@ -25412,9 +26021,11 @@ export {
   instanceOfSessionListResponseData,
   instanceOfSessionListResponseDataSessionInfo,
   instanceOfSetDomainInboundRequest,
+  instanceOfSetEndUserClaimsRequest,
   instanceOfSetPreferencesRequest,
   instanceOfSetPreferencesRequestPreferencesInner,
   instanceOfSignInAnonymouslyRequest,
+  instanceOfSignInWithGameCenterRequest,
   instanceOfSlackMessage,
   instanceOfSlackMessageListResponse,
   instanceOfSlackMessageListResponseMeta,
@@ -25470,6 +26081,7 @@ export {
   instanceOfUnsubscribeRequest,
   instanceOfUnsubscribeResponse,
   instanceOfUpdateCategoryRequest,
+  instanceOfUpdateEndUserByApplicationRequest,
   instanceOfUpdateEndUserRequest,
   instanceOfUpdateOrganizationMemberRoleRequest,
   instanceOfUpdateOrganizationRequest,