@zyphr-dev/node-sdk 0.1.43 → 0.1.45

package/dist/index.js

@@ -850,6 +850,84 @@ function ApiErrorToJSONTyped(value, ignoreDiscriminator = false) {
   };
 }
 
+// src/src/models/ApplicationSelf.ts
+var ApplicationSelfEnvironmentEnum = {
+  TEST: "test",
+  LIVE: "live"
+};
+var ApplicationSelfSigningAlgorithmEnum = {
+  HS256: "HS256",
+  RS256: "RS256",
+  ES256: "ES256"
+};
+function instanceOfApplicationSelf(value) {
+  if (!("id" in value) || value["id"] === void 0) return false;
+  if (!("name" in value) || value["name"] === void 0) return false;
+  if (!("environment" in value) || value["environment"] === void 0) return false;
+  if (!("signingAlgorithm" in value) || value["signingAlgorithm"] === void 0) return false;
+  if (!("testRecipients" in value) || value["testRecipients"] === void 0) return false;
+  return true;
+}
+function ApplicationSelfFromJSON(json) {
+  return ApplicationSelfFromJSONTyped(json, false);
+}
+function ApplicationSelfFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    "id": json["id"],
+    "name": json["name"],
+    "environment": json["environment"],
+    "signingAlgorithm": json["signing_algorithm"],
+    "testRecipients": json["test_recipients"]
+  };
+}
+function ApplicationSelfToJSON(json) {
+  return ApplicationSelfToJSONTyped(json, false);
+}
+function ApplicationSelfToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    "id": value["id"],
+    "name": value["name"],
+    "environment": value["environment"],
+    "signing_algorithm": value["signingAlgorithm"],
+    "test_recipients": value["testRecipients"]
+  };
+}
+
+// src/src/models/ApplicationSelfResponse.ts
+function instanceOfApplicationSelfResponse(value) {
+  return true;
+}
+function ApplicationSelfResponseFromJSON(json) {
+  return ApplicationSelfResponseFromJSONTyped(json, false);
+}
+function ApplicationSelfResponseFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    "data": json["data"] == null ? void 0 : ApplicationSelfFromJSON(json["data"]),
+    "meta": json["meta"] == null ? void 0 : RequestMetaFromJSON(json["meta"])
+  };
+}
+function ApplicationSelfResponseToJSON(json) {
+  return ApplicationSelfResponseToJSONTyped(json, false);
+}
+function ApplicationSelfResponseToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    "data": ApplicationSelfToJSON(value["data"]),
+    "meta": RequestMetaToJSON(value["meta"])
+  };
+}
+
 // src/src/models/AuthEmailType.ts
 var AuthEmailType = {
   MAGIC_LINK: "magic_link",
@@ -1598,6 +1676,49 @@ function AuthLoginResponseToJSONTyped(value, ignoreDiscriminator = false) {
   };
 }
 
+// src/src/models/AuthMethods.ts
+function instanceOfAuthMethods(value) {
+  if (!("hasPassword" in value) || value["hasPassword"] === void 0) return false;
+  if (!("oauthProviders" in value) || value["oauthProviders"] === void 0) return false;
+  if (!("mfaEnabled" in value) || value["mfaEnabled"] === void 0) return false;
+  if (!("emailVerified" in value) || value["emailVerified"] === void 0) return false;
+  if (!("phoneVerified" in value) || value["phoneVerified"] === void 0) return false;
+  if (!("passkeys" in value) || value["passkeys"] === void 0) return false;
+  return true;
+}
+function AuthMethodsFromJSON(json) {
+  return AuthMethodsFromJSONTyped(json, false);
+}
+function AuthMethodsFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    "hasPassword": json["has_password"],
+    "oauthProviders": json["oauth_providers"],
+    "mfaEnabled": json["mfa_enabled"],
+    "emailVerified": json["email_verified"],
+    "phoneVerified": json["phone_verified"],
+    "passkeys": json["passkeys"]
+  };
+}
+function AuthMethodsToJSON(json) {
+  return AuthMethodsToJSONTyped(json, false);
+}
+function AuthMethodsToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    "has_password": value["hasPassword"],
+    "oauth_providers": value["oauthProviders"],
+    "mfa_enabled": value["mfaEnabled"],
+    "email_verified": value["emailVerified"],
+    "phone_verified": value["phoneVerified"],
+    "passkeys": value["passkeys"]
+  };
+}
+
 // src/src/models/AuthResult.ts
 function instanceOfAuthResult(value) {
   return true;
@@ -2087,6 +2208,37 @@ function CategoryResponseToJSONTyped(value, ignoreDiscriminator = false) {
   };
 }
 
+// src/src/models/ChangePasswordRequest.ts
+function instanceOfChangePasswordRequest(value) {
+  if (!("currentPassword" in value) || value["currentPassword"] === void 0) return false;
+  if (!("newPassword" in value) || value["newPassword"] === void 0) return false;
+  return true;
+}
+function ChangePasswordRequestFromJSON(json) {
+  return ChangePasswordRequestFromJSONTyped(json, false);
+}
+function ChangePasswordRequestFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    "currentPassword": json["current_password"],
+    "newPassword": json["new_password"]
+  };
+}
+function ChangePasswordRequestToJSON(json) {
+  return ChangePasswordRequestToJSONTyped(json, false);
+}
+function ChangePasswordRequestToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    "current_password": value["currentPassword"],
+    "new_password": value["newPassword"]
+  };
+}
+
 // src/src/models/GetDomain200ResponseMeta.ts
 function instanceOfGetDomain200ResponseMeta(value) {
   return true;
@@ -5006,6 +5158,35 @@ function GetDomain200ResponseToJSONTyped(value, ignoreDiscriminator = false) {
   };
 }
 
+// src/src/models/GetEndUserAuthMethods200Response.ts
+function instanceOfGetEndUserAuthMethods200Response(value) {
+  return true;
+}
+function GetEndUserAuthMethods200ResponseFromJSON(json) {
+  return GetEndUserAuthMethods200ResponseFromJSONTyped(json, false);
+}
+function GetEndUserAuthMethods200ResponseFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    "data": json["data"] == null ? void 0 : AuthMethodsFromJSON(json["data"]),
+    "meta": json["meta"] == null ? void 0 : GetDomain200ResponseMetaFromJSON(json["meta"])
+  };
+}
+function GetEndUserAuthMethods200ResponseToJSON(json) {
+  return GetEndUserAuthMethods200ResponseToJSONTyped(json, false);
+}
+function GetEndUserAuthMethods200ResponseToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    "data": AuthMethodsToJSON(value["data"]),
+    "meta": GetDomain200ResponseMetaToJSON(value["meta"])
+  };
+}
+
 // src/src/models/GetEndUserById200Response.ts
 function instanceOfGetEndUserById200Response(value) {
   return true;
@@ -11812,6 +11993,34 @@ function SetPreferencesRequestToJSONTyped(value, ignoreDiscriminator = false) {
   };
 }
 
+// src/src/models/SetSelfApplicationTestRecipientsRequest.ts
+function instanceOfSetSelfApplicationTestRecipientsRequest(value) {
+  if (!("testRecipients" in value) || value["testRecipients"] === void 0) return false;
+  return true;
+}
+function SetSelfApplicationTestRecipientsRequestFromJSON(json) {
+  return SetSelfApplicationTestRecipientsRequestFromJSONTyped(json, false);
+}
+function SetSelfApplicationTestRecipientsRequestFromJSONTyped(json, ignoreDiscriminator) {
+  if (json == null) {
+    return json;
+  }
+  return {
+    "testRecipients": json["test_recipients"]
+  };
+}
+function SetSelfApplicationTestRecipientsRequestToJSON(json) {
+  return SetSelfApplicationTestRecipientsRequestToJSONTyped(json, false);
+}
+function SetSelfApplicationTestRecipientsRequestToJSONTyped(value, ignoreDiscriminator = false) {
+  if (value == null) {
+    return value;
+  }
+  return {
+    "test_recipients": value["testRecipients"]
+  };
+}
+
 // src/src/models/SignInAnonymouslyRequest.ts
 function instanceOfSignInAnonymouslyRequest(value) {
   if (!("deviceId" in value) || value["deviceId"] === void 0) return false;
@@ -15644,6 +15853,60 @@ function WebhookDeleteResponseToJSONTyped(value, ignoreDiscriminator = false) {
   };
 }
 
+// src/src/models/WebhookEventType.ts
+var WebhookEventType = {
+  EMAIL_QUEUED: "email.queued",
+  EMAIL_SENT: "email.sent",
+  EMAIL_DELIVERED: "email.delivered",
+  EMAIL_BOUNCED: "email.bounced",
+  EMAIL_SOFT_BOUNCED: "email.soft_bounced",
+  EMAIL_COMPLAINED: "email.complained",
+  EMAIL_OPENED: "email.opened",
+  EMAIL_CLICKED: "email.clicked",
+  EMAIL_FAILED: "email.failed",
+  EMAIL_RECEIVED: "email.received",
+  PUSH_SENT: "push.sent",
+  PUSH_DELIVERED: "push.delivered",
+  PUSH_FAILED: "push.failed",
+  PUSH_EXPIRED: "push.expired",
+  USER_CREATED: "user.created",
+  USER_LOGIN: "user.login",
+  USER_LOGOUT: "user.logout",
+  USER_PASSWORD_CHANGED: "user.password_changed",
+  USER_PASSWORD_RESET_REQUESTED: "user.password_reset_requested",
+  USER_EMAIL_VERIFIED: "user.email_verified",
+  USER_PHONE_VERIFIED: "user.phone_verified",
+  USER_DELETED: "user.deleted",
+  USER_SESSION_REVOKED: "user.session_revoked",
+  USER_MFA_ENABLED: "user.mfa_enabled",
+  USER_MFA_DISABLED: "user.mfa_disabled",
+  USER_IMPERSONATED: "user.impersonated",
+  DOMAIN_VERIFIED: "domain.verified",
+  DOMAIN_VERIFICATION_FAILED: "domain.verification_failed"
+};
+function instanceOfWebhookEventType(value) {
+  for (const key in WebhookEventType) {
+    if (Object.prototype.hasOwnProperty.call(WebhookEventType, key)) {
+      if (WebhookEventType[key] === value) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function WebhookEventTypeFromJSON(json) {
+  return WebhookEventTypeFromJSONTyped(json, false);
+}
+function WebhookEventTypeFromJSONTyped(json, ignoreDiscriminator) {
+  return json;
+}
+function WebhookEventTypeToJSON(value) {
+  return value;
+}
+function WebhookEventTypeToJSONTyped(value, ignoreDiscriminator) {
+  return value;
+}
+
 // src/src/models/WebhookDelivery.ts
 var WebhookDeliveryStatusEnum = {
   PENDING: "pending",
@@ -15666,7 +15929,7 @@ function WebhookDeliveryFromJSONTyped(json, ignoreDiscriminator) {
     "id": json["id"] == null ? void 0 : json["id"],
     "msgId": json["msg_id"] == null ? void 0 : json["msg_id"],
     "eventId": json["event_id"] == null ? void 0 : json["event_id"],
-    "eventType": json["event_type"] == null ? void 0 : json["event_type"],
+    "eventType": json["event_type"] == null ? void 0 : WebhookEventTypeFromJSON(json["event_type"]),
     "status": json["status"] == null ? void 0 : json["status"],
     "attempts": json["attempts"] == null ? void 0 : json["attempts"],
     "maxAttempts": json["max_attempts"] == null ? void 0 : json["max_attempts"],
@@ -15692,7 +15955,7 @@ function WebhookDeliveryToJSONTyped(value, ignoreDiscriminator = false) {
     "id": value["id"],
     "msg_id": value["msgId"],
     "event_id": value["eventId"],
-    "event_type": value["eventType"],
+    "event_type": WebhookEventTypeToJSON(value["eventType"]),
     "status": value["status"],
     "attempts": value["attempts"],
     "max_attempts": value["maxAttempts"],
@@ -15730,7 +15993,7 @@ function WebhookDeliveryDetailFromJSONTyped(json, ignoreDiscriminator) {
     "id": json["id"] == null ? void 0 : json["id"],
     "msgId": json["msg_id"] == null ? void 0 : json["msg_id"],
     "eventId": json["event_id"] == null ? void 0 : json["event_id"],
-    "eventType": json["event_type"] == null ? void 0 : json["event_type"],
+    "eventType": json["event_type"] == null ? void 0 : WebhookEventTypeFromJSON(json["event_type"]),
     "status": json["status"] == null ? void 0 : json["status"],
     "attempts": json["attempts"] == null ? void 0 : json["attempts"],
     "maxAttempts": json["max_attempts"] == null ? void 0 : json["max_attempts"],
@@ -15760,7 +16023,7 @@ function WebhookDeliveryDetailToJSONTyped(value, ignoreDiscriminator = false) {
     "id": value["id"],
     "msg_id": value["msgId"],
     "event_id": value["eventId"],
-    "event_type": value["eventType"],
+    "event_type": WebhookEventTypeToJSON(value["eventType"]),
     "status": value["status"],
     "attempts": value["attempts"],
     "max_attempts": value["maxAttempts"],
@@ -15910,7 +16173,7 @@ function WebhookEventTypesResponseDataFromJSONTyped(json, ignoreDiscriminator) {
     return json;
   }
   return {
-    "eventTypes": json["event_types"] == null ? void 0 : json["event_types"],
+    "eventTypes": json["event_types"] == null ? void 0 : json["event_types"].map(WebhookEventTypeFromJSON),
     "registry": json["registry"] == null ? void 0 : json["registry"],
     "categories": json["categories"] == null ? void 0 : json["categories"],
     "apiVersion": json["api_version"] == null ? void 0 : json["api_version"]
@@ -15924,7 +16187,7 @@ function WebhookEventTypesResponseDataToJSONTyped(value, ignoreDiscriminator = f
     return value;
   }
   return {
-    "event_types": value["eventTypes"],
+    "event_types": value["eventTypes"] == null ? void 0 : value["eventTypes"].map(WebhookEventTypeToJSON),
     "registry": value["registry"],
     "categories": value["categories"],
     "api_version": value["apiVersion"]
@@ -16325,7 +16588,7 @@ function WebhookTestEventResponseDataFromJSONTyped(json, ignoreDiscriminator) {
   }
   return {
     "deliveryId": json["delivery_id"] == null ? void 0 : json["delivery_id"],
-    "eventType": json["event_type"] == null ? void 0 : json["event_type"],
+    "eventType": json["event_type"] == null ? void 0 : WebhookEventTypeFromJSON(json["event_type"]),
     "payload": json["payload"] == null ? void 0 : json["payload"],
     "status": json["status"] == null ? void 0 : json["status"]
   };
@@ -16339,7 +16602,7 @@ function WebhookTestEventResponseDataToJSONTyped(value, ignoreDiscriminator = fa
   }
   return {
     "delivery_id": value["deliveryId"],
-    "event_type": value["eventType"],
+    "event_type": WebhookEventTypeToJSON(value["eventType"]),
     "payload": value["payload"],
     "status": value["status"]
   };
@@ -16558,6 +16821,76 @@ function WithdrawSubscriberConsentRequestToJSONTyped(value, ignoreDiscriminator
   };
 }
 
+// src/src/apis/AuthApplicationApi.ts
+var AuthApplicationApi = class extends BaseAPI {
+  /**
+   * Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment\'s mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
+   * Get the authenticating application
+   */
+  async getSelfApplicationRaw(initOverrides) {
+    const queryParameters = {};
+    const headerParameters = {};
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret");
+    }
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key");
+    }
+    const response = await this.request({
+      path: `/auth/application`,
+      method: "GET",
+      headers: headerParameters,
+      query: queryParameters
+    }, initOverrides);
+    return new JSONApiResponse(response, (jsonValue) => ApplicationSelfResponseFromJSON(jsonValue));
+  }
+  /**
+   * Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment\'s mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
+   * Get the authenticating application
+   */
+  async getSelfApplication(initOverrides) {
+    const response = await this.getSelfApplicationRaw(initOverrides);
+    return await response.value();
+  }
+  /**
+   * Set `test_recipients` — the per-application auth-email allowlist — on the application whose credentials authenticated this request. When non-empty, this allowlist gates ALL auth emails (only listed addresses receive them); an EMPTY array clears it and disables the gate. Lets an integrator manage the allowlist from their own infrastructure config instead of the dashboard.  Application-SECRET scoped (server-side write): requires X-Application-Key AND X-Application-Secret. Mutates ONLY the authenticating application — it never takes an application id from the request, so there is no cross-tenant write path. The response mirrors GET /auth/application exactly (never returns secrets). 
+   * Set the authenticating application\'s auth-email test allowlist
+   */
+  async setSelfApplicationTestRecipientsRaw(requestParameters, initOverrides) {
+    if (requestParameters["setSelfApplicationTestRecipientsRequest"] == null) {
+      throw new RequiredError(
+        "setSelfApplicationTestRecipientsRequest",
+        'Required parameter "setSelfApplicationTestRecipientsRequest" was null or undefined when calling setSelfApplicationTestRecipients().'
+      );
+    }
+    const queryParameters = {};
+    const headerParameters = {};
+    headerParameters["Content-Type"] = "application/json";
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret");
+    }
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key");
+    }
+    const response = await this.request({
+      path: `/auth/application`,
+      method: "PATCH",
+      headers: headerParameters,
+      query: queryParameters,
+      body: SetSelfApplicationTestRecipientsRequestToJSON(requestParameters["setSelfApplicationTestRecipientsRequest"])
+    }, initOverrides);
+    return new JSONApiResponse(response, (jsonValue) => ApplicationSelfResponseFromJSON(jsonValue));
+  }
+  /**
+   * Set `test_recipients` — the per-application auth-email allowlist — on the application whose credentials authenticated this request. When non-empty, this allowlist gates ALL auth emails (only listed addresses receive them); an EMPTY array clears it and disables the gate. Lets an integrator manage the allowlist from their own infrastructure config instead of the dashboard.  Application-SECRET scoped (server-side write): requires X-Application-Key AND X-Application-Secret. Mutates ONLY the authenticating application — it never takes an application id from the request, so there is no cross-tenant write path. The response mirrors GET /auth/application exactly (never returns secrets). 
+   * Set the authenticating application\'s auth-email test allowlist
+   */
+  async setSelfApplicationTestRecipients(setSelfApplicationTestRecipientsRequest, initOverrides) {
+    const response = await this.setSelfApplicationTestRecipientsRaw({ setSelfApplicationTestRecipientsRequest }, initOverrides);
+    return await response.value();
+  }
+};
+
 // src/src/apis/AuthEmailOTPApi.ts
 var AuthEmailOTPApi = class extends BaseAPI {
   /**
@@ -17021,7 +17354,7 @@ var AuthEmailTemplatesApi = class extends BaseAPI {
     return await response.value();
   }
   /**
-   * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited. 
+   * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited.  When non-empty, `test_recipients` gates ALL auth emails this application sends (magic link, password reset, email verification, and email OTP) — not just these test renders. Only listed recipients receive auth email; any other recipient is silently blocked. Use it to make a non-production application safe from mass sends. An empty allowlist (the default) imposes no restriction and every recipient receives auth email normally. 
    * Send a test render of a template
    */
   async sendAuthEmailTemplateTestRaw(requestParameters, initOverrides) {
@@ -17056,7 +17389,7 @@ var AuthEmailTemplatesApi = class extends BaseAPI {
     return new JSONApiResponse(response, (jsonValue) => AuthEmailTemplateTestResponseFromJSON(jsonValue));
   }
   /**
-   * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited. 
+   * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited.  When non-empty, `test_recipients` gates ALL auth emails this application sends (magic link, password reset, email verification, and email OTP) — not just these test renders. Only listed recipients receive auth email; any other recipient is silently blocked. Use it to make a non-production application safe from mass sends. An empty allowlist (the default) imposes no restriction and every recipient receives auth email normally. 
    * Send a test render of a template
    */
   async sendAuthEmailTemplateTest(type, authEmailTemplateTestRequest, initOverrides) {
@@ -18987,6 +19320,41 @@ var AuthUserDirectoryApi = class extends BaseAPI {
   async deleteEndUserByApplication(userId, initOverrides) {
     await this.deleteEndUserByApplicationRaw({ userId }, initOverrides);
   }
+  /**
+   * Secret-key-scoped, aggregate view of the sign-in methods configured for a single end user within the authenticating application. Reports whether the user has a password, which OAuth providers are linked, whether MFA is enabled, whether email/phone are verified, and how many passkeys are registered — everything a customer admin needs to build a \"sign-in methods\" screen. Scoped to the application — a caller can never read a user belonging to another application. 
+   * Get an end user\'s sign-in methods (server-side admin)
+   */
+  async getEndUserAuthMethodsRaw(requestParameters, initOverrides) {
+    if (requestParameters["userId"] == null) {
+      throw new RequiredError(
+        "userId",
+        'Required parameter "userId" was null or undefined when calling getEndUserAuthMethods().'
+      );
+    }
+    const queryParameters = {};
+    const headerParameters = {};
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret");
+    }
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key");
+    }
+    const response = await this.request({
+      path: `/auth/users/{user_id}/auth-methods`.replace(`{${"user_id"}}`, encodeURIComponent(String(requestParameters["userId"]))),
+      method: "GET",
+      headers: headerParameters,
+      query: queryParameters
+    }, initOverrides);
+    return new JSONApiResponse(response, (jsonValue) => GetEndUserAuthMethods200ResponseFromJSON(jsonValue));
+  }
+  /**
+   * Secret-key-scoped, aggregate view of the sign-in methods configured for a single end user within the authenticating application. Reports whether the user has a password, which OAuth providers are linked, whether MFA is enabled, whether email/phone are verified, and how many passkeys are registered — everything a customer admin needs to build a \"sign-in methods\" screen. Scoped to the application — a caller can never read a user belonging to another application. 
+   * Get an end user\'s sign-in methods (server-side admin)
+   */
+  async getEndUserAuthMethods(userId, initOverrides) {
+    const response = await this.getEndUserAuthMethodsRaw({ userId }, initOverrides);
+    return await response.value();
+  }
   /**
    * Secret-key-scoped lookup of a single end user by email address within the authenticating application. Scoped to the application — never resolves a user from another application. Does not return the password hash. 
    * Look up an end user by email (server-side admin)
@@ -19267,6 +19635,47 @@ var ListEndUsersEnvironmentEnum = {
 
 // src/src/apis/AuthUserProfileApi.ts
 var AuthUserProfileApi = class extends BaseAPI {
+  /**
+   * Change the currently authenticated end user\'s password from a logged-in session. The caller must prove possession of the CURRENT password (`current_password`); the user is identified from the end-user token, not the request body, so a user can only change their own password.  On success, all existing sessions are revoked and a fresh token pair is returned so the current session stays authenticated. Emits the `user.password_changed` webhook.
+   * Change password (authenticated session)
+   */
+  async changeEndUserPasswordRaw(requestParameters, initOverrides) {
+    if (requestParameters["changePasswordRequest"] == null) {
+      throw new RequiredError(
+        "changePasswordRequest",
+        'Required parameter "changePasswordRequest" was null or undefined when calling changeEndUserPassword().'
+      );
+    }
+    const queryParameters = {};
+    const headerParameters = {};
+    headerParameters["Content-Type"] = "application/json";
+    if (this.configuration && this.configuration.accessToken) {
+      const token = this.configuration.accessToken;
+      const tokenString = await token("EndUserToken", []);
+      if (tokenString) {
+        headerParameters["Authorization"] = `Bearer ${tokenString}`;
+      }
+    }
+    if (this.configuration && this.configuration.apiKey) {
+      headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key");
+    }
+    const response = await this.request({
+      path: `/auth/users/change-password`,
+      method: "POST",
+      headers: headerParameters,
+      query: queryParameters,
+      body: ChangePasswordRequestToJSON(requestParameters["changePasswordRequest"])
+    }, initOverrides);
+    return new JSONApiResponse(response, (jsonValue) => RefreshTokenResponseFromJSON(jsonValue));
+  }
+  /**
+   * Change the currently authenticated end user\'s password from a logged-in session. The caller must prove possession of the CURRENT password (`current_password`); the user is identified from the end-user token, not the request body, so a user can only change their own password.  On success, all existing sessions are revoked and a fresh token pair is returned so the current session stays authenticated. Emits the `user.password_changed` webhook.
+   * Change password (authenticated session)
+   */
+  async changeEndUserPassword(changePasswordRequest, initOverrides) {
+    const response = await this.changeEndUserPasswordRaw({ changePasswordRequest }, initOverrides);
+    return await response.value();
+  }
   /**
    * Delete the current end user account (GDPR right to erasure). This is a soft delete — the account is marked as deleted but data is retained for a period to allow for recovery or legal requirements. 
    * Delete current end user account
@@ -25845,7 +26254,8 @@ var Zyphr = class {
       emailOtp: new AuthEmailOTPApi(config),
       profile: new AuthUserProfileApi(config),
       userDirectory: new AuthUserDirectoryApi(config),
-      webauthn: new AuthWebAuthnApi(config)
+      webauthn: new AuthWebAuthnApi(config),
+      application: new AuthApplicationApi(config)
     };
   }
   /**
@@ -25892,7 +26302,14 @@ var ZyphrClientCredentialError = class extends Error {
     this.name = "ZyphrClientCredentialError";
   }
 };
-var SECRET_KEY_PREFIXES = ["za_sec_", "zy_live_", "zy_test_"];
+var PUBLISHABLE_KEY_PREFIXES = ["za_live_pub_", "za_test_pub_", "za_pub_"];
+var SECRET_KEY_PREFIXES = [
+  "za_live_sec_",
+  "za_test_sec_",
+  "za_sec_",
+  "zy_live_",
+  "zy_test_"
+];
 var ZyphrClient = class {
   auth;
   /** Device registration for push (takes an OS-acquired token). */
@@ -25901,16 +26318,16 @@ var ZyphrClient = class {
   accessToken;
   constructor(options) {
     if (!options.applicationKey) {
-      throw new ZyphrClientCredentialError("applicationKey (za_pub_*) is required");
+      throw new ZyphrClientCredentialError("applicationKey (za_live_pub_* / za_test_pub_*) is required");
     }
     if (SECRET_KEY_PREFIXES.some((p) => options.applicationKey.startsWith(p))) {
       throw new ZyphrClientCredentialError(
-        "ZyphrClient must be constructed with a publishable application key (za_pub_*), never a secret key. Secret keys must stay server-side."
+        "ZyphrClient must be constructed with a publishable application key (za_live_pub_* / za_test_pub_*), never a secret key. Secret keys must stay server-side."
       );
     }
-    if (!options.applicationKey.startsWith("za_pub_")) {
+    if (!PUBLISHABLE_KEY_PREFIXES.some((p) => options.applicationKey.startsWith(p))) {
       throw new ZyphrClientCredentialError(
-        "applicationKey must be a publishable application key (za_pub_*)."
+        "applicationKey must be a publishable application key (za_live_pub_* / za_test_pub_*)."
       );
     }
     this.applicationKey = options.applicationKey;
@@ -26014,6 +26431,17 @@ export {
   ApiErrorMetaToJSONTyped,
   ApiErrorToJSON,
   ApiErrorToJSONTyped,
+  ApplicationSelfEnvironmentEnum,
+  ApplicationSelfFromJSON,
+  ApplicationSelfFromJSONTyped,
+  ApplicationSelfResponseFromJSON,
+  ApplicationSelfResponseFromJSONTyped,
+  ApplicationSelfResponseToJSON,
+  ApplicationSelfResponseToJSONTyped,
+  ApplicationSelfSigningAlgorithmEnum,
+  ApplicationSelfToJSON,
+  ApplicationSelfToJSONTyped,
+  AuthApplicationApi,
   AuthEmailOTPApi,
   AuthEmailTemplateDefaultFromJSON,
   AuthEmailTemplateDefaultFromJSONTyped,
@@ -26103,6 +26531,10 @@ export {
   AuthLoginResultToJSONTyped,
   AuthMFAApi,
   AuthMagicLinksApi,
+  AuthMethodsFromJSON,
+  AuthMethodsFromJSONTyped,
+  AuthMethodsToJSON,
+  AuthMethodsToJSONTyped,
   AuthOAuthApi,
   AuthOrganizationsApi,
   AuthPasswordResetApi,
@@ -26178,6 +26610,10 @@ export {
   CategoryResponseToJSONTyped,
   CategoryToJSON,
   CategoryToJSONTyped,
+  ChangePasswordRequestFromJSON,
+  ChangePasswordRequestFromJSONTyped,
+  ChangePasswordRequestToJSON,
+  ChangePasswordRequestToJSONTyped,
   CloseWaaSEndpointCircuit200ResponseDataFromJSON,
   CloseWaaSEndpointCircuit200ResponseDataFromJSONTyped,
   CloseWaaSEndpointCircuit200ResponseDataStateEnum,
@@ -26510,6 +26946,10 @@ export {
   GetDomain200ResponseMetaToJSONTyped,
   GetDomain200ResponseToJSON,
   GetDomain200ResponseToJSONTyped,
+  GetEndUserAuthMethods200ResponseFromJSON,
+  GetEndUserAuthMethods200ResponseFromJSONTyped,
+  GetEndUserAuthMethods200ResponseToJSON,
+  GetEndUserAuthMethods200ResponseToJSONTyped,
   GetEndUserById200ResponseFromJSON,
   GetEndUserById200ResponseFromJSONTyped,
   GetEndUserById200ResponseToJSON,
@@ -27354,6 +27794,10 @@ export {
   SetPreferencesRequestPreferencesInnerToJSONTyped,
   SetPreferencesRequestToJSON,
   SetPreferencesRequestToJSONTyped,
+  SetSelfApplicationTestRecipientsRequestFromJSON,
+  SetSelfApplicationTestRecipientsRequestFromJSONTyped,
+  SetSelfApplicationTestRecipientsRequestToJSON,
+  SetSelfApplicationTestRecipientsRequestToJSONTyped,
   SignInAnonymouslyRequestFromJSON,
   SignInAnonymouslyRequestFromJSONTyped,
   SignInAnonymouslyRequestToJSON,
@@ -27936,6 +28380,11 @@ export {
   WebhookDeliveryStatusEnum,
   WebhookDeliveryToJSON,
   WebhookDeliveryToJSONTyped,
+  WebhookEventType,
+  WebhookEventTypeFromJSON,
+  WebhookEventTypeFromJSONTyped,
+  WebhookEventTypeToJSON,
+  WebhookEventTypeToJSONTyped,
   WebhookEventTypesResponseDataFromJSON,
   WebhookEventTypesResponseDataFromJSONTyped,
   WebhookEventTypesResponseDataToJSON,
@@ -28092,6 +28541,8 @@ export {
   instanceOfApiError,
   instanceOfApiErrorError,
   instanceOfApiErrorMeta,
+  instanceOfApplicationSelf,
+  instanceOfApplicationSelfResponse,
   instanceOfAuthEmailTemplate,
   instanceOfAuthEmailTemplateDefault,
   instanceOfAuthEmailTemplateDefaultResponse,
@@ -28112,6 +28563,7 @@ export {
   instanceOfAuthLoginResponse,
   instanceOfAuthLoginResult,
   instanceOfAuthLoginResultMfaChallenge,
+  instanceOfAuthMethods,
   instanceOfAuthResult,
   instanceOfAuthResultResponse,
   instanceOfAuthSession,
@@ -28127,6 +28579,7 @@ export {
   instanceOfCategory,
   instanceOfCategoryListResponse,
   instanceOfCategoryResponse,
+  instanceOfChangePasswordRequest,
   instanceOfCloseWaaSEndpointCircuit200Response,
   instanceOfCloseWaaSEndpointCircuit200ResponseData,
   instanceOfConfirmEmailVerificationRequest,
@@ -28204,6 +28657,7 @@ export {
   instanceOfGenerateWaaSPortalToken201Response,
   instanceOfGetDomain200Response,
   instanceOfGetDomain200ResponseMeta,
+  instanceOfGetEndUserAuthMethods200Response,
   instanceOfGetEndUserById200Response,
   instanceOfGetEndUserClaims200Response,
   instanceOfGetEndUserClaims200ResponseData,
@@ -28404,6 +28858,7 @@ export {
   instanceOfSetEndUserClaimsRequest,
   instanceOfSetPreferencesRequest,
   instanceOfSetPreferencesRequestPreferencesInner,
+  instanceOfSetSelfApplicationTestRecipientsRequest,
   instanceOfSignInAnonymouslyRequest,
   instanceOfSignInWithGameCenterRequest,
   instanceOfSignInWithGooglePlayGamesRequest,
@@ -28541,6 +28996,7 @@ export {
   instanceOfWebhookDeliveryResponse,
   instanceOfWebhookDeliveryRetryResponse,
   instanceOfWebhookDeliveryRetryResponseData,
+  instanceOfWebhookEventType,
   instanceOfWebhookEventTypesResponse,
   instanceOfWebhookEventTypesResponseData,
   instanceOfWebhookIpsResponse,