@zyphr-dev/node-sdk 0.1.43 → 0.1.44

package/dist/index.js

@@ -850,6 +850,81 @@ function ApiErrorToJSONTyped(value, ignoreDiscriminator = false) {
   };
 }
 
+// src/src/models/ApplicationSelf.ts
+var ApplicationSelfEnvironmentEnum = {
+  TEST: "test",
+  LIVE: "live"
+};
+var ApplicationSelfSigningAlgorithmEnum = {
+  HS256: "HS256",
+  RS256: "RS256",
+  ES256: "ES256"
+};
+function instanceOfApplicationSelf(value) {
+  if (!("id" in value) || value["id"] === void 0) return false;
+  if (!("name" in value) || value["name"] === void 0) return false;
+  if (!("environment" in value) || value["environment"] === void 0) return false;
+  if (!("signingAlgorithm" in value) || value["signingAlgorithm"] === void 0) return false;
+  return true;
+}
+function ApplicationSelfFromJSON(json) {
+  return ApplicationSelfFromJSONTyped(json, false);
+}
+function ApplicationSelfFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    "id": json["id"],
+    "name": json["name"],
+    "environment": json["environment"],
+    "signingAlgorithm": json["signing_algorithm"]
+  };
+}
+function ApplicationSelfToJSON(json) {
+  return ApplicationSelfToJSONTyped(json, false);
+}
+function ApplicationSelfToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    "id": value["id"],
+    "name": value["name"],
+    "environment": value["environment"],
+    "signing_algorithm": value["signingAlgorithm"]
+  };
+}
+
+// src/src/models/ApplicationSelfResponse.ts
+function instanceOfApplicationSelfResponse(value) {
+  return true;
+}
+function ApplicationSelfResponseFromJSON(json) {
+  return ApplicationSelfResponseFromJSONTyped(json, false);
+}
+function ApplicationSelfResponseFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    "data": json["data"] == null ? void 0 : ApplicationSelfFromJSON(json["data"]),
+    "meta": json["meta"] == null ? void 0 : RequestMetaFromJSON(json["meta"])
+  };
+}
+function ApplicationSelfResponseToJSON(json) {
+  return ApplicationSelfResponseToJSONTyped(json, false);
+}
+function ApplicationSelfResponseToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    "data": ApplicationSelfToJSON(value["data"]),
+    "meta": RequestMetaToJSON(value["meta"])
+  };
+}
+
 // src/src/models/AuthEmailType.ts
 var AuthEmailType = {
   MAGIC_LINK: "magic_link",
@@ -1598,6 +1673,49 @@ function AuthLoginResponseToJSONTyped(value, ignoreDiscriminator = false) {
   };
 }
 
+// src/src/models/AuthMethods.ts
+function instanceOfAuthMethods(value) {
+  if (!("hasPassword" in value) || value["hasPassword"] === void 0) return false;
+  if (!("oauthProviders" in value) || value["oauthProviders"] === void 0) return false;
+  if (!("mfaEnabled" in value) || value["mfaEnabled"] === void 0) return false;
+  if (!("emailVerified" in value) || value["emailVerified"] === void 0) return false;
+  if (!("phoneVerified" in value) || value["phoneVerified"] === void 0) return false;
+  if (!("passkeys" in value) || value["passkeys"] === void 0) return false;
+  return true;
+}
+function AuthMethodsFromJSON(json) {
+  return AuthMethodsFromJSONTyped(json, false);
+}
+function AuthMethodsFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    "hasPassword": json["has_password"],
+    "oauthProviders": json["oauth_providers"],
+    "mfaEnabled": json["mfa_enabled"],
+    "emailVerified": json["email_verified"],
+    "phoneVerified": json["phone_verified"],
+    "passkeys": json["passkeys"]
+  };
+}
+function AuthMethodsToJSON(json) {
+  return AuthMethodsToJSONTyped(json, false);
+}
+function AuthMethodsToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    "has_password": value["hasPassword"],
+    "oauth_providers": value["oauthProviders"],
+    "mfa_enabled": value["mfaEnabled"],
+    "email_verified": value["emailVerified"],
+    "phone_verified": value["phoneVerified"],
+    "passkeys": value["passkeys"]
+  };
+}
+
 // src/src/models/AuthResult.ts
 function instanceOfAuthResult(value) {
   return true;
@@ -5006,6 +5124,35 @@ function GetDomain200ResponseToJSONTyped(value, ignoreDiscriminator = false) {
   };
 }
 
+// src/src/models/GetEndUserAuthMethods200Response.ts
+function instanceOfGetEndUserAuthMethods200Response(value) {
+  return true;
+}
+function GetEndUserAuthMethods200ResponseFromJSON(json) {
+  return GetEndUserAuthMethods200ResponseFromJSONTyped(json, false);
+}
+function GetEndUserAuthMethods200ResponseFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    "data": json["data"] == null ? void 0 : AuthMethodsFromJSON(json["data"]),
+    "meta": json["meta"] == null ? void 0 : GetDomain200ResponseMetaFromJSON(json["meta"])
+  };
+}
+function GetEndUserAuthMethods200ResponseToJSON(json) {
+  return GetEndUserAuthMethods200ResponseToJSONTyped(json, false);
+}
+function GetEndUserAuthMethods200ResponseToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    "data": AuthMethodsToJSON(value["data"]),
+    "meta": GetDomain200ResponseMetaToJSON(value["meta"])
+  };
+}
+
 // src/src/models/GetEndUserById200Response.ts
 function instanceOfGetEndUserById200Response(value) {
   return true;
@@ -16558,6 +16705,39 @@ function WithdrawSubscriberConsentRequestToJSONTyped(value, ignoreDiscriminator
   };
 }
 
+// src/src/apis/AuthApplicationApi.ts
+var AuthApplicationApi = class extends BaseAPI {
+  /**
+   * Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment\'s mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
+   * Get the authenticating application
+   */
+  async getSelfApplicationRaw(initOverrides) {
+    const queryParameters = {};
+    const headerParameters = {};
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret");
+    }
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key");
+    }
+    const response = await this.request({
+      path: `/auth/application`,
+      method: "GET",
+      headers: headerParameters,
+      query: queryParameters
+    }, initOverrides);
+    return new JSONApiResponse(response, (jsonValue) => ApplicationSelfResponseFromJSON(jsonValue));
+  }
+  /**
+   * Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment\'s mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
+   * Get the authenticating application
+   */
+  async getSelfApplication(initOverrides) {
+    const response = await this.getSelfApplicationRaw(initOverrides);
+    return await response.value();
+  }
+};
+
 // src/src/apis/AuthEmailOTPApi.ts
 var AuthEmailOTPApi = class extends BaseAPI {
   /**
@@ -17021,7 +17201,7 @@ var AuthEmailTemplatesApi = class extends BaseAPI {
     return await response.value();
   }
   /**
-   * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited. 
+   * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited.  When non-empty, `test_recipients` gates ALL auth emails this application sends (magic link, password reset, email verification, and email OTP) — not just these test renders. Only listed recipients receive auth email; any other recipient is silently blocked. Use it to make a non-production application safe from mass sends. An empty allowlist (the default) imposes no restriction and every recipient receives auth email normally. 
    * Send a test render of a template
    */
   async sendAuthEmailTemplateTestRaw(requestParameters, initOverrides) {
@@ -17056,7 +17236,7 @@ var AuthEmailTemplatesApi = class extends BaseAPI {
     return new JSONApiResponse(response, (jsonValue) => AuthEmailTemplateTestResponseFromJSON(jsonValue));
   }
   /**
-   * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited. 
+   * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited.  When non-empty, `test_recipients` gates ALL auth emails this application sends (magic link, password reset, email verification, and email OTP) — not just these test renders. Only listed recipients receive auth email; any other recipient is silently blocked. Use it to make a non-production application safe from mass sends. An empty allowlist (the default) imposes no restriction and every recipient receives auth email normally. 
    * Send a test render of a template
    */
   async sendAuthEmailTemplateTest(type, authEmailTemplateTestRequest, initOverrides) {
@@ -18987,6 +19167,41 @@ var AuthUserDirectoryApi = class extends BaseAPI {
   async deleteEndUserByApplication(userId, initOverrides) {
     await this.deleteEndUserByApplicationRaw({ userId }, initOverrides);
   }
+  /**
+   * Secret-key-scoped, aggregate view of the sign-in methods configured for a single end user within the authenticating application. Reports whether the user has a password, which OAuth providers are linked, whether MFA is enabled, whether email/phone are verified, and how many passkeys are registered — everything a customer admin needs to build a \"sign-in methods\" screen. Scoped to the application — a caller can never read a user belonging to another application. 
+   * Get an end user\'s sign-in methods (server-side admin)
+   */
+  async getEndUserAuthMethodsRaw(requestParameters, initOverrides) {
+    if (requestParameters["userId"] == null) {
+      throw new RequiredError(
+        "userId",
+        'Required parameter "userId" was null or undefined when calling getEndUserAuthMethods().'
+      );
+    }
+    const queryParameters = {};
+    const headerParameters = {};
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret");
+    }
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key");
+    }
+    const response = await this.request({
+      path: `/auth/users/{user_id}/auth-methods`.replace(`{${"user_id"}}`, encodeURIComponent(String(requestParameters["userId"]))),
+      method: "GET",
+      headers: headerParameters,
+      query: queryParameters
+    }, initOverrides);
+    return new JSONApiResponse(response, (jsonValue) => GetEndUserAuthMethods200ResponseFromJSON(jsonValue));
+  }
+  /**
+   * Secret-key-scoped, aggregate view of the sign-in methods configured for a single end user within the authenticating application. Reports whether the user has a password, which OAuth providers are linked, whether MFA is enabled, whether email/phone are verified, and how many passkeys are registered — everything a customer admin needs to build a \"sign-in methods\" screen. Scoped to the application — a caller can never read a user belonging to another application. 
+   * Get an end user\'s sign-in methods (server-side admin)
+   */
+  async getEndUserAuthMethods(userId, initOverrides) {
+    const response = await this.getEndUserAuthMethodsRaw({ userId }, initOverrides);
+    return await response.value();
+  }
   /**
    * Secret-key-scoped lookup of a single end user by email address within the authenticating application. Scoped to the application — never resolves a user from another application. Does not return the password hash. 
    * Look up an end user by email (server-side admin)
@@ -25845,7 +26060,8 @@ var Zyphr = class {
       emailOtp: new AuthEmailOTPApi(config),
       profile: new AuthUserProfileApi(config),
       userDirectory: new AuthUserDirectoryApi(config),
-      webauthn: new AuthWebAuthnApi(config)
+      webauthn: new AuthWebAuthnApi(config),
+      application: new AuthApplicationApi(config)
     };
   }
   /**
@@ -25892,7 +26108,14 @@ var ZyphrClientCredentialError = class extends Error {
     this.name = "ZyphrClientCredentialError";
   }
 };
-var SECRET_KEY_PREFIXES = ["za_sec_", "zy_live_", "zy_test_"];
+var PUBLISHABLE_KEY_PREFIXES = ["za_live_pub_", "za_test_pub_", "za_pub_"];
+var SECRET_KEY_PREFIXES = [
+  "za_live_sec_",
+  "za_test_sec_",
+  "za_sec_",
+  "zy_live_",
+  "zy_test_"
+];
 var ZyphrClient = class {
   auth;
   /** Device registration for push (takes an OS-acquired token). */
@@ -25901,16 +26124,16 @@ var ZyphrClient = class {
   accessToken;
   constructor(options) {
     if (!options.applicationKey) {
-      throw new ZyphrClientCredentialError("applicationKey (za_pub_*) is required");
+      throw new ZyphrClientCredentialError("applicationKey (za_live_pub_* / za_test_pub_*) is required");
     }
     if (SECRET_KEY_PREFIXES.some((p) => options.applicationKey.startsWith(p))) {
       throw new ZyphrClientCredentialError(
-        "ZyphrClient must be constructed with a publishable application key (za_pub_*), never a secret key. Secret keys must stay server-side."
+        "ZyphrClient must be constructed with a publishable application key (za_live_pub_* / za_test_pub_*), never a secret key. Secret keys must stay server-side."
       );
     }
-    if (!options.applicationKey.startsWith("za_pub_")) {
+    if (!PUBLISHABLE_KEY_PREFIXES.some((p) => options.applicationKey.startsWith(p))) {
       throw new ZyphrClientCredentialError(
-        "applicationKey must be a publishable application key (za_pub_*)."
+        "applicationKey must be a publishable application key (za_live_pub_* / za_test_pub_*)."
       );
     }
     this.applicationKey = options.applicationKey;
@@ -26014,6 +26237,17 @@ export {
   ApiErrorMetaToJSONTyped,
   ApiErrorToJSON,
   ApiErrorToJSONTyped,
+  ApplicationSelfEnvironmentEnum,
+  ApplicationSelfFromJSON,
+  ApplicationSelfFromJSONTyped,
+  ApplicationSelfResponseFromJSON,
+  ApplicationSelfResponseFromJSONTyped,
+  ApplicationSelfResponseToJSON,
+  ApplicationSelfResponseToJSONTyped,
+  ApplicationSelfSigningAlgorithmEnum,
+  ApplicationSelfToJSON,
+  ApplicationSelfToJSONTyped,
+  AuthApplicationApi,
   AuthEmailOTPApi,
   AuthEmailTemplateDefaultFromJSON,
   AuthEmailTemplateDefaultFromJSONTyped,
@@ -26103,6 +26337,10 @@ export {
   AuthLoginResultToJSONTyped,
   AuthMFAApi,
   AuthMagicLinksApi,
+  AuthMethodsFromJSON,
+  AuthMethodsFromJSONTyped,
+  AuthMethodsToJSON,
+  AuthMethodsToJSONTyped,
   AuthOAuthApi,
   AuthOrganizationsApi,
   AuthPasswordResetApi,
@@ -26510,6 +26748,10 @@ export {
   GetDomain200ResponseMetaToJSONTyped,
   GetDomain200ResponseToJSON,
   GetDomain200ResponseToJSONTyped,
+  GetEndUserAuthMethods200ResponseFromJSON,
+  GetEndUserAuthMethods200ResponseFromJSONTyped,
+  GetEndUserAuthMethods200ResponseToJSON,
+  GetEndUserAuthMethods200ResponseToJSONTyped,
   GetEndUserById200ResponseFromJSON,
   GetEndUserById200ResponseFromJSONTyped,
   GetEndUserById200ResponseToJSON,
@@ -28092,6 +28334,8 @@ export {
   instanceOfApiError,
   instanceOfApiErrorError,
   instanceOfApiErrorMeta,
+  instanceOfApplicationSelf,
+  instanceOfApplicationSelfResponse,
   instanceOfAuthEmailTemplate,
   instanceOfAuthEmailTemplateDefault,
   instanceOfAuthEmailTemplateDefaultResponse,
@@ -28112,6 +28356,7 @@ export {
   instanceOfAuthLoginResponse,
   instanceOfAuthLoginResult,
   instanceOfAuthLoginResultMfaChallenge,
+  instanceOfAuthMethods,
   instanceOfAuthResult,
   instanceOfAuthResultResponse,
   instanceOfAuthSession,
@@ -28204,6 +28449,7 @@ export {
   instanceOfGenerateWaaSPortalToken201Response,
   instanceOfGetDomain200Response,
   instanceOfGetDomain200ResponseMeta,
+  instanceOfGetEndUserAuthMethods200Response,
   instanceOfGetEndUserById200Response,
   instanceOfGetEndUserClaims200Response,
   instanceOfGetEndUserClaims200ResponseData,