@zyphr-dev/node-sdk 0.1.43 → 0.1.44

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zyphr-dev/node-sdk",
-  "version": "0.1.43",
+  "version": "0.1.44",
   "description": "Official Zyphr SDK for Node.js, React, and React Native",
   "type": "module",
   "main": "./dist/index.cjs",

package/src/.openapi-generator/FILES

@@ -2,6 +2,7 @@
 .npmignore
 README.md
 package.json
+src/apis/AuthApplicationApi.ts
 src/apis/AuthEmailOTPApi.ts
 src/apis/AuthEmailTemplatesApi.ts
 src/apis/AuthEmailVerificationApi.ts
@@ -50,6 +51,8 @@ src/models/AddWorkflowStepRequest.ts
 src/models/ApiError.ts
 src/models/ApiErrorError.ts
 src/models/ApiErrorMeta.ts
+src/models/ApplicationSelf.ts
+src/models/ApplicationSelfResponse.ts
 src/models/AuthEmailTemplate.ts
 src/models/AuthEmailTemplateDefault.ts
 src/models/AuthEmailTemplateDefaultResponse.ts
@@ -70,6 +73,7 @@ src/models/AuthEmailType.ts
 src/models/AuthLoginResponse.ts
 src/models/AuthLoginResult.ts
 src/models/AuthLoginResultMfaChallenge.ts
+src/models/AuthMethods.ts
 src/models/AuthResult.ts
 src/models/AuthResultResponse.ts
 src/models/AuthSession.ts
@@ -163,6 +167,7 @@ src/models/GenerateSubscriberTokenRequest.ts
 src/models/GenerateWaaSPortalToken201Response.ts
 src/models/GetDomain200Response.ts
 src/models/GetDomain200ResponseMeta.ts
+src/models/GetEndUserAuthMethods200Response.ts
 src/models/GetEndUserById200Response.ts
 src/models/GetEndUserClaims200Response.ts
 src/models/GetEndUserClaims200ResponseData.ts

package/src/client.ts

@@ -16,6 +16,7 @@
 import { Configuration } from './src/runtime.js';
 import type { Middleware, ResponseContext } from './src/runtime.js';
 import {
+  AuthApplicationApi,
   AuthEmailOTPApi,
   AuthEmailVerificationApi,
   AuthLoginApi,
@@ -52,13 +53,24 @@ import {
 import { parseErrorResponse } from './errors.js';
 
 export interface ZyphrOptions {
-  /** Your Zyphr API key (zy_live_* or zy_test_*) */
+  /**
+   * Your Project-scoped Zyphr API key (`zy_live_*` / `zy_test_*`), sent as
+   * `Authorization: Bearer`. Used for notification APIs (emails, push, webhooks).
+   */
   apiKey: string;
   /** Override the base API URL (defaults to https://api.zyphr.dev/v1) */
   baseUrl?: string;
-  /** Application public key (za_pub_*) for Auth-as-a-Service endpoints */
+  /**
+   * Application-scoped public key (`za_live_pub_*` / `za_test_pub_*`; legacy
+   * `za_pub_*` still accepted) for Auth-as-a-Service endpoints, sent as
+   * `X-Application-Key`. Distinct from the Project-scoped `apiKey` above.
+   */
   applicationKey?: string;
-  /** Application secret key (za_sec_*) for Auth-as-a-Service endpoints */
+  /**
+   * Application-scoped secret key (`za_live_sec_*` / `za_test_sec_*`; legacy
+   * `za_sec_*` still accepted) for server-side Auth-as-a-Service endpoints, sent
+   * as `X-Application-Secret`. Must stay server-side — never ship in a client bundle.
+   */
   applicationSecret?: string;
 }
 
@@ -115,6 +127,8 @@ export class Zyphr {
     /** Server-side (secret-key) end-user directory: list/search/get/update/delete, invite, and the trusted claims store. */
     readonly userDirectory: AuthUserDirectoryApi;
     readonly webauthn: AuthWebAuthnApi;
+    /** Read the authenticating application's own non-sensitive metadata (id, name, environment, signing algorithm) via GET /auth/application. */
+    readonly application: AuthApplicationApi;
   };
 
   private readonly options: ZyphrOptions;
@@ -171,6 +185,7 @@ export class Zyphr {
       profile: new AuthUserProfileApi(config),
       userDirectory: new AuthUserDirectoryApi(config),
       webauthn: new AuthWebAuthnApi(config),
+      application: new AuthApplicationApi(config),
     };
   }
 

package/src/clientAuth.ts

@@ -4,8 +4,14 @@
  * `ZyphrClient` is a browser / React Native-safe entry point for Auth-as-a-Service.
  * Unlike the server `Zyphr` client (which requires a secret API key and, for auth,
  * an application SECRET key), `ZyphrClient` is constructed with ONLY the publishable
- * application key (`za_pub_*`) — the key that is safe to ship in a client bundle —
- * plus, once the user is authenticated, their end-user access token.
+ * application key (`za_live_pub_*` in live mode, `za_test_pub_*` in test mode) — the
+ * key that is safe to ship in a client bundle — plus, once the user is authenticated,
+ * their end-user access token.
+ *
+ * These Application-scoped credentials (`X-Application-Key` publishable key, and the
+ * server-only `X-Application-Secret`) are distinct from the Project-scoped notification
+ * keys (`zy_live_*` / `zy_test_*`, sent as `Authorization: Bearer`) used by the server
+ * `Zyphr` client for emails/push/webhooks.
  *
  * It deliberately exposes ONLY the end-user-scoped auth surface (login, registration,
  * sessions, magic links, OAuth, phone, email-OTP, profile, MFA, WebAuthn, password
@@ -17,7 +23,7 @@
  * ```ts
  * import { ZyphrClient } from '@zyphr-dev/node-sdk';
  *
- * const zyphr = new ZyphrClient({ applicationKey: 'za_pub_xxx' });
+ * const zyphr = new ZyphrClient({ applicationKey: 'za_live_pub_xxx' });
  *
  * const login = await zyphr.auth.login.loginEndUser({ ... });
  * zyphr.setAccessToken(login.data.tokens.access_token);
@@ -47,7 +53,10 @@ import {
 import { parseErrorResponse } from './errors.js';
 
 export interface ZyphrClientOptions {
-  /** Publishable application key (za_pub_*) — safe to embed in a client bundle. */
+  /**
+   * Publishable application key (`za_live_pub_*` / `za_test_pub_*`) — safe to
+   * embed in a client bundle. Legacy `za_pub_*` keys are also accepted.
+   */
   applicationKey: string;
   /** Override the base API URL (defaults to https://api.zyphr.dev/v1). */
   baseUrl?: string;
@@ -75,8 +84,31 @@ export class ZyphrClientCredentialError extends Error {
   }
 }
 
-/** Prefixes that must NEVER reach a client bundle. */
-const SECRET_KEY_PREFIXES = ['za_sec_', 'zy_live_', 'zy_test_'];
+// Key prefixes are mirrored from the platform source of truth,
+// packages/shared/src/constants/api.ts (APPLICATION_KEY_PREFIXES,
+// SECRET_KEY_PREFIXES). They are inlined here because this is a standalone
+// published package that cannot import @zyphr/shared at runtime — keep the two
+// in sync if the prefixes ever change.
+
+/**
+ * Publishable application-key prefixes accepted by the client-safe SDK.
+ * `za_live_pub_` / `za_test_pub_` are the current live/test prefixes; `za_pub_`
+ * is the deprecated legacy prefix, still accepted for backward compatibility.
+ */
+const PUBLISHABLE_KEY_PREFIXES = ['za_live_pub_', 'za_test_pub_', 'za_pub_'];
+
+/**
+ * Prefixes that must NEVER reach a client bundle: application SECRET keys
+ * (`za_live_sec_` / `za_test_sec_`, and legacy `za_sec_`) and Project-scoped
+ * notification API keys (`zy_live_*` / `zy_test_*`).
+ */
+const SECRET_KEY_PREFIXES = [
+  'za_live_sec_',
+  'za_test_sec_',
+  'za_sec_',
+  'zy_live_',
+  'zy_test_',
+];
 
 export class ZyphrClient {
   readonly auth: {
@@ -103,19 +135,20 @@ export class ZyphrClient {
 
   constructor(options: ZyphrClientOptions) {
     if (!options.applicationKey) {
-      throw new ZyphrClientCredentialError('applicationKey (za_pub_*) is required');
+      throw new ZyphrClientCredentialError('applicationKey (za_live_pub_* / za_test_pub_*) is required');
     }
     // Guardrail: reject secret-shaped credentials so a secret can't be shipped
-    // in a client bundle by mistake.
+    // in a client bundle by mistake. Checked before the publishable allow-list so
+    // a secret key produces the clearer "never a secret key" message.
     if (SECRET_KEY_PREFIXES.some((p) => options.applicationKey.startsWith(p))) {
       throw new ZyphrClientCredentialError(
-        'ZyphrClient must be constructed with a publishable application key (za_pub_*), ' +
-          'never a secret key. Secret keys must stay server-side.'
+        'ZyphrClient must be constructed with a publishable application key ' +
+          '(za_live_pub_* / za_test_pub_*), never a secret key. Secret keys must stay server-side.'
       );
     }
-    if (!options.applicationKey.startsWith('za_pub_')) {
+    if (!PUBLISHABLE_KEY_PREFIXES.some((p) => options.applicationKey.startsWith(p))) {
       throw new ZyphrClientCredentialError(
-        'applicationKey must be a publishable application key (za_pub_*).'
+        'applicationKey must be a publishable application key (za_live_pub_* / za_test_pub_*).'
       );
     }
 

package/src/src/apis/AuthApplicationApi.ts

@@ -0,0 +1,93 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Zyphr API
+ * Zyphr is a multi-channel notification platform that enables developers to send emails, push notifications, SMS, and in-app messages through a unified API.  ## Authentication  All API requests require authentication using an API key. Include your API key in the `X-API-Key` header:  ``` X-API-Key: zy_live_xxxxxxxxxxxx ```  API keys can be created in the Zyphr Dashboard. Use `zy_test_*` keys for testing and `zy_live_*` keys for production.  ## Rate Limiting  The API implements rate limiting to ensure fair usage. Rate limit information is included in response headers:  - `X-RateLimit-Limit`: Maximum requests per window - `X-RateLimit-Remaining`: Remaining requests in current window - `X-RateLimit-Reset`: Unix timestamp when the window resets  ## Account Sending Status  Every authenticated response carries the account\'s current sending state so you can surface it in your own tooling without a separate call:  - `X-Account-Sending-Status`: `active`, `throttled`, or `frozen` - `X-Account-Sending-Status-Reason`: human-readable reason (present only when the status is `throttled` or `frozen`)  This header is informational and non-blocking on non-send endpoints (reads, billing, and deliverability stay available). Send-capable endpoints additionally enforce the state: a frozen account receives `403 account_frozen` and a throttled account receives `429 account_throttled`, both with the reason in the error message.  ## Errors  All errors follow a consistent format:  ```json {   \"error\": {     \"code\": \"error_code\",     \"message\": \"Human readable message\",     \"details\": {}   },   \"meta\": {     \"request_id\": \"req_xxxx\"   } } ```
+ *
+ * The version of the OpenAPI document: 1.0.0
+ * Contact: support@zyphr.dev
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import * as runtime from '../runtime';
+import type {
+  ApiError,
+  ApplicationSelfResponse,
+} from '../models/index';
+import {
+    ApiErrorFromJSON,
+    ApiErrorToJSON,
+    ApplicationSelfResponseFromJSON,
+    ApplicationSelfResponseToJSON,
+} from '../models/index';
+
+/**
+ * AuthApplicationApi - interface
+ * 
+ * @export
+ * @interface AuthApplicationApiInterface
+ */
+export interface AuthApplicationApiInterface {
+    /**
+     * Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment\'s mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
+     * @summary Get the authenticating application
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthApplicationApiInterface
+     */
+    getSelfApplicationRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ApplicationSelfResponse>>;
+
+    /**
+     * Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment\'s mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
+     * Get the authenticating application
+     */
+    getSelfApplication(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ApplicationSelfResponse>;
+
+}
+
+/**
+ * 
+ */
+export class AuthApplicationApi extends runtime.BaseAPI implements AuthApplicationApiInterface {
+
+    /**
+     * Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment\'s mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
+     * Get the authenticating application
+     */
+    async getSelfApplicationRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ApplicationSelfResponse>> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+        }
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+        }
+
+        const response = await this.request({
+            path: `/auth/application`,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ApplicationSelfResponseFromJSON(jsonValue));
+    }
+
+    /**
+     * Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment\'s mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
+     * Get the authenticating application
+     */
+    async getSelfApplication(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ApplicationSelfResponse> {
+        const response = await this.getSelfApplicationRaw(initOverrides);
+        return await response.value();
+    }
+
+}

package/src/src/apis/AuthEmailTemplatesApi.ts

@@ -240,7 +240,7 @@ export interface AuthEmailTemplatesApiInterface {
     restoreAuthEmailTemplateVersion(type: AuthEmailType, version: number, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthEmailTemplateResponse>;
 
     /**
-     * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited. 
+     * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited.  When non-empty, `test_recipients` gates ALL auth emails this application sends (magic link, password reset, email verification, and email OTP) — not just these test renders. Only listed recipients receive auth email; any other recipient is silently blocked. Use it to make a non-production application safe from mass sends. An empty allowlist (the default) imposes no restriction and every recipient receives auth email normally. 
      * @summary Send a test render of a template
      * @param {AuthEmailType} type 
      * @param {AuthEmailTemplateTestRequest} authEmailTemplateTestRequest 
@@ -251,7 +251,7 @@ export interface AuthEmailTemplatesApiInterface {
     sendAuthEmailTemplateTestRaw(requestParameters: AuthEmailTemplatesApiSendAuthEmailTemplateTestRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthEmailTemplateTestResponse>>;
 
     /**
-     * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited. 
+     * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited.  When non-empty, `test_recipients` gates ALL auth emails this application sends (magic link, password reset, email verification, and email OTP) — not just these test renders. Only listed recipients receive auth email; any other recipient is silently blocked. Use it to make a non-production application safe from mass sends. An empty allowlist (the default) imposes no restriction and every recipient receives auth email normally. 
      * Send a test render of a template
      */
     sendAuthEmailTemplateTest(type: AuthEmailType, authEmailTemplateTestRequest: AuthEmailTemplateTestRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthEmailTemplateTestResponse>;
@@ -629,7 +629,7 @@ export class AuthEmailTemplatesApi extends runtime.BaseAPI implements AuthEmailT
     }
 
     /**
-     * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited. 
+     * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited.  When non-empty, `test_recipients` gates ALL auth emails this application sends (magic link, password reset, email verification, and email OTP) — not just these test renders. Only listed recipients receive auth email; any other recipient is silently blocked. Use it to make a non-production application safe from mass sends. An empty allowlist (the default) imposes no restriction and every recipient receives auth email normally. 
      * Send a test render of a template
      */
     async sendAuthEmailTemplateTestRaw(requestParameters: AuthEmailTemplatesApiSendAuthEmailTemplateTestRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthEmailTemplateTestResponse>> {
@@ -673,7 +673,7 @@ export class AuthEmailTemplatesApi extends runtime.BaseAPI implements AuthEmailT
     }
 
     /**
-     * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited. 
+     * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited.  When non-empty, `test_recipients` gates ALL auth emails this application sends (magic link, password reset, email verification, and email OTP) — not just these test renders. Only listed recipients receive auth email; any other recipient is silently blocked. Use it to make a non-production application safe from mass sends. An empty allowlist (the default) imposes no restriction and every recipient receives auth email normally. 
      * Send a test render of a template
      */
     async sendAuthEmailTemplateTest(type: AuthEmailType, authEmailTemplateTestRequest: AuthEmailTemplateTestRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthEmailTemplateTestResponse> {

package/src/src/apis/AuthUserDirectoryApi.ts

@@ -15,6 +15,7 @@
 
 import * as runtime from '../runtime';
 import type {
+  GetEndUserAuthMethods200Response,
   GetEndUserById200Response,
   GetEndUserClaims200Response,
   InviteEndUser200Response,
@@ -25,6 +26,8 @@ import type {
   UpdateEndUserByApplicationRequest,
 } from '../models/index';
 import {
+    GetEndUserAuthMethods200ResponseFromJSON,
+    GetEndUserAuthMethods200ResponseToJSON,
     GetEndUserById200ResponseFromJSON,
     GetEndUserById200ResponseToJSON,
     GetEndUserClaims200ResponseFromJSON,
@@ -47,6 +50,10 @@ export interface AuthUserDirectoryApiDeleteEndUserByApplicationRequest {
     userId: string;
 }
 
+export interface AuthUserDirectoryApiGetEndUserAuthMethodsRequest {
+    userId: string;
+}
+
 export interface AuthUserDirectoryApiGetEndUserByEmailRequest {
     email: string;
 }
@@ -103,6 +110,22 @@ export interface AuthUserDirectoryApiInterface {
      */
     deleteEndUserByApplication(userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
 
+    /**
+     * Secret-key-scoped, aggregate view of the sign-in methods configured for a single end user within the authenticating application. Reports whether the user has a password, which OAuth providers are linked, whether MFA is enabled, whether email/phone are verified, and how many passkeys are registered — everything a customer admin needs to build a \"sign-in methods\" screen. Scoped to the application — a caller can never read a user belonging to another application. 
+     * @summary Get an end user\'s sign-in methods (server-side admin)
+     * @param {string} userId 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthUserDirectoryApiInterface
+     */
+    getEndUserAuthMethodsRaw(requestParameters: AuthUserDirectoryApiGetEndUserAuthMethodsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<GetEndUserAuthMethods200Response>>;
+
+    /**
+     * Secret-key-scoped, aggregate view of the sign-in methods configured for a single end user within the authenticating application. Reports whether the user has a password, which OAuth providers are linked, whether MFA is enabled, whether email/phone are verified, and how many passkeys are registered — everything a customer admin needs to build a \"sign-in methods\" screen. Scoped to the application — a caller can never read a user belonging to another application. 
+     * Get an end user\'s sign-in methods (server-side admin)
+     */
+    getEndUserAuthMethods(userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetEndUserAuthMethods200Response>;
+
     /**
      * Secret-key-scoped lookup of a single end user by email address within the authenticating application. Scoped to the application — never resolves a user from another application. Does not return the password hash. 
      * @summary Look up an end user by email (server-side admin)
@@ -269,6 +292,49 @@ export class AuthUserDirectoryApi extends runtime.BaseAPI implements AuthUserDir
         await this.deleteEndUserByApplicationRaw({ userId: userId }, initOverrides);
     }
 
+    /**
+     * Secret-key-scoped, aggregate view of the sign-in methods configured for a single end user within the authenticating application. Reports whether the user has a password, which OAuth providers are linked, whether MFA is enabled, whether email/phone are verified, and how many passkeys are registered — everything a customer admin needs to build a \"sign-in methods\" screen. Scoped to the application — a caller can never read a user belonging to another application. 
+     * Get an end user\'s sign-in methods (server-side admin)
+     */
+    async getEndUserAuthMethodsRaw(requestParameters: AuthUserDirectoryApiGetEndUserAuthMethodsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<GetEndUserAuthMethods200Response>> {
+        if (requestParameters['userId'] == null) {
+            throw new runtime.RequiredError(
+                'userId',
+                'Required parameter "userId" was null or undefined when calling getEndUserAuthMethods().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+        }
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+        }
+
+        const response = await this.request({
+            path: `/auth/users/{user_id}/auth-methods`.replace(`{${"user_id"}}`, encodeURIComponent(String(requestParameters['userId']))),
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => GetEndUserAuthMethods200ResponseFromJSON(jsonValue));
+    }
+
+    /**
+     * Secret-key-scoped, aggregate view of the sign-in methods configured for a single end user within the authenticating application. Reports whether the user has a password, which OAuth providers are linked, whether MFA is enabled, whether email/phone are verified, and how many passkeys are registered — everything a customer admin needs to build a \"sign-in methods\" screen. Scoped to the application — a caller can never read a user belonging to another application. 
+     * Get an end user\'s sign-in methods (server-side admin)
+     */
+    async getEndUserAuthMethods(userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetEndUserAuthMethods200Response> {
+        const response = await this.getEndUserAuthMethodsRaw({ userId: userId }, initOverrides);
+        return await response.value();
+    }
+
     /**
      * Secret-key-scoped lookup of a single end user by email address within the authenticating application. Scoped to the application — never resolves a user from another application. Does not return the password hash. 
      * Look up an end user by email (server-side admin)

package/src/src/apis/index.ts

@@ -1,5 +1,6 @@
 /* tslint:disable */
 /* eslint-disable */
+export * from './AuthApplicationApi';
 export * from './AuthEmailOTPApi';
 export * from './AuthEmailTemplatesApi';
 export * from './AuthEmailVerificationApi';

package/src/src/models/ApplicationSelf.ts

@@ -0,0 +1,118 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Zyphr API
+ * Zyphr is a multi-channel notification platform that enables developers to send emails, push notifications, SMS, and in-app messages through a unified API.  ## Authentication  All API requests require authentication using an API key. Include your API key in the `X-API-Key` header:  ``` X-API-Key: zy_live_xxxxxxxxxxxx ```  API keys can be created in the Zyphr Dashboard. Use `zy_test_*` keys for testing and `zy_live_*` keys for production.  ## Rate Limiting  The API implements rate limiting to ensure fair usage. Rate limit information is included in response headers:  - `X-RateLimit-Limit`: Maximum requests per window - `X-RateLimit-Remaining`: Remaining requests in current window - `X-RateLimit-Reset`: Unix timestamp when the window resets  ## Account Sending Status  Every authenticated response carries the account\'s current sending state so you can surface it in your own tooling without a separate call:  - `X-Account-Sending-Status`: `active`, `throttled`, or `frozen` - `X-Account-Sending-Status-Reason`: human-readable reason (present only when the status is `throttled` or `frozen`)  This header is informational and non-blocking on non-send endpoints (reads, billing, and deliverability stay available). Send-capable endpoints additionally enforce the state: a frozen account receives `403 account_frozen` and a throttled account receives `429 account_throttled`, both with the reason in the error message.  ## Errors  All errors follow a consistent format:  ```json {   \"error\": {     \"code\": \"error_code\",     \"message\": \"Human readable message\",     \"details\": {}   },   \"meta\": {     \"request_id\": \"req_xxxx\"   } } ```
+ *
+ * The version of the OpenAPI document: 1.0.0
+ * Contact: support@zyphr.dev
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * Non-sensitive metadata about the authenticating application. Returned by
+ * GET /auth/application so an integrator can read their own application_id
+ * (the sole tenant discriminator embedded in end-user tokens) directly from
+ * the API. Never includes secrets, signing keys, or account-internal fields.
+ * 
+ * @export
+ * @interface ApplicationSelf
+ */
+export interface ApplicationSelf {
+    /**
+     * The application's unique id (application_id).
+     * @type {string}
+     * @memberof ApplicationSelf
+     */
+    id: string;
+    /**
+     * Human-readable application name.
+     * @type {string}
+     * @memberof ApplicationSelf
+     */
+    name: string;
+    /**
+     * The environment mode of the credentials used to authenticate this request. `null` when the environment cannot be determined (e.g. a legacy application-level key that predates environment-scoped keys) — not defaulted to a guessed value.
+     * @type {string}
+     * @memberof ApplicationSelf
+     */
+    environment: ApplicationSelfEnvironmentEnum | null;
+    /**
+     * JWT signing algorithm for this application's end-user tokens.
+     * @type {string}
+     * @memberof ApplicationSelf
+     */
+    signingAlgorithm: ApplicationSelfSigningAlgorithmEnum;
+}
+
+
+/**
+ * @export
+ */
+export const ApplicationSelfEnvironmentEnum = {
+    TEST: 'test',
+    LIVE: 'live'
+} as const;
+export type ApplicationSelfEnvironmentEnum = typeof ApplicationSelfEnvironmentEnum[keyof typeof ApplicationSelfEnvironmentEnum];
+
+/**
+ * @export
+ */
+export const ApplicationSelfSigningAlgorithmEnum = {
+    HS256: 'HS256',
+    RS256: 'RS256',
+    ES256: 'ES256'
+} as const;
+export type ApplicationSelfSigningAlgorithmEnum = typeof ApplicationSelfSigningAlgorithmEnum[keyof typeof ApplicationSelfSigningAlgorithmEnum];
+
+
+/**
+ * Check if a given object implements the ApplicationSelf interface.
+ */
+export function instanceOfApplicationSelf(value: object): value is ApplicationSelf {
+    if (!('id' in value) || value['id'] === undefined) return false;
+    if (!('name' in value) || value['name'] === undefined) return false;
+    if (!('environment' in value) || value['environment'] === undefined) return false;
+    if (!('signingAlgorithm' in value) || value['signingAlgorithm'] === undefined) return false;
+    return true;
+}
+
+export function ApplicationSelfFromJSON(json: any): ApplicationSelf {
+    return ApplicationSelfFromJSONTyped(json, false);
+}
+
+export function ApplicationSelfFromJSONTyped(json: any, ignoreDiscriminator: boolean): ApplicationSelf {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'id': json['id'],
+        'name': json['name'],
+        'environment': json['environment'],
+        'signingAlgorithm': json['signing_algorithm'],
+    };
+}
+
+export function ApplicationSelfToJSON(json: any): ApplicationSelf {
+    return ApplicationSelfToJSONTyped(json, false);
+}
+
+export function ApplicationSelfToJSONTyped(value?: ApplicationSelf | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'id': value['id'],
+        'name': value['name'],
+        'environment': value['environment'],
+        'signing_algorithm': value['signingAlgorithm'],
+    };
+}
+

package/src/src/models/ApplicationSelfResponse.ts

@@ -0,0 +1,88 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Zyphr API
+ * Zyphr is a multi-channel notification platform that enables developers to send emails, push notifications, SMS, and in-app messages through a unified API.  ## Authentication  All API requests require authentication using an API key. Include your API key in the `X-API-Key` header:  ``` X-API-Key: zy_live_xxxxxxxxxxxx ```  API keys can be created in the Zyphr Dashboard. Use `zy_test_*` keys for testing and `zy_live_*` keys for production.  ## Rate Limiting  The API implements rate limiting to ensure fair usage. Rate limit information is included in response headers:  - `X-RateLimit-Limit`: Maximum requests per window - `X-RateLimit-Remaining`: Remaining requests in current window - `X-RateLimit-Reset`: Unix timestamp when the window resets  ## Account Sending Status  Every authenticated response carries the account\'s current sending state so you can surface it in your own tooling without a separate call:  - `X-Account-Sending-Status`: `active`, `throttled`, or `frozen` - `X-Account-Sending-Status-Reason`: human-readable reason (present only when the status is `throttled` or `frozen`)  This header is informational and non-blocking on non-send endpoints (reads, billing, and deliverability stay available). Send-capable endpoints additionally enforce the state: a frozen account receives `403 account_frozen` and a throttled account receives `429 account_throttled`, both with the reason in the error message.  ## Errors  All errors follow a consistent format:  ```json {   \"error\": {     \"code\": \"error_code\",     \"message\": \"Human readable message\",     \"details\": {}   },   \"meta\": {     \"request_id\": \"req_xxxx\"   } } ```
+ *
+ * The version of the OpenAPI document: 1.0.0
+ * Contact: support@zyphr.dev
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { ApplicationSelf } from './ApplicationSelf';
+import {
+    ApplicationSelfFromJSON,
+    ApplicationSelfFromJSONTyped,
+    ApplicationSelfToJSON,
+    ApplicationSelfToJSONTyped,
+} from './ApplicationSelf';
+import type { RequestMeta } from './RequestMeta';
+import {
+    RequestMetaFromJSON,
+    RequestMetaFromJSONTyped,
+    RequestMetaToJSON,
+    RequestMetaToJSONTyped,
+} from './RequestMeta';
+
+/**
+ * 
+ * @export
+ * @interface ApplicationSelfResponse
+ */
+export interface ApplicationSelfResponse {
+    /**
+     * 
+     * @type {ApplicationSelf}
+     * @memberof ApplicationSelfResponse
+     */
+    data?: ApplicationSelf;
+    /**
+     * 
+     * @type {RequestMeta}
+     * @memberof ApplicationSelfResponse
+     */
+    meta?: RequestMeta;
+}
+
+/**
+ * Check if a given object implements the ApplicationSelfResponse interface.
+ */
+export function instanceOfApplicationSelfResponse(value: object): value is ApplicationSelfResponse {
+    return true;
+}
+
+export function ApplicationSelfResponseFromJSON(json: any): ApplicationSelfResponse {
+    return ApplicationSelfResponseFromJSONTyped(json, false);
+}
+
+export function ApplicationSelfResponseFromJSONTyped(json: any, ignoreDiscriminator: boolean): ApplicationSelfResponse {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'data': json['data'] == null ? undefined : ApplicationSelfFromJSON(json['data']),
+        'meta': json['meta'] == null ? undefined : RequestMetaFromJSON(json['meta']),
+    };
+}
+
+export function ApplicationSelfResponseToJSON(json: any): ApplicationSelfResponse {
+    return ApplicationSelfResponseToJSONTyped(json, false);
+}
+
+export function ApplicationSelfResponseToJSONTyped(value?: ApplicationSelfResponse | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'data': ApplicationSelfToJSON(value['data']),
+        'meta': RequestMetaToJSON(value['meta']),
+    };
+}
+

package/src/src/models/AuthEmailTemplateTestRequest.ts

@@ -20,7 +20,7 @@ import { mapValues } from '../runtime';
  */
 export interface AuthEmailTemplateTestRequest {
     /**
-     * Recipient email. Must be in the application's `test_recipients` allowlist.
+     * Recipient email. Must be in the application's `test_recipients` allowlist. When non-empty, `test_recipients` gates ALL auth emails the application sends (magic link, password reset, verification, OTP) — only listed recipients receive auth email — which keeps non-production applications safe from mass sends. An empty allowlist imposes no restriction.
      * @type {string}
      * @memberof AuthEmailTemplateTestRequest
      */