@zyphr-dev/node-sdk 0.1.43 → 0.1.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zyphr-dev/node-sdk",
-  "version": "0.1.43",
+  "version": "0.1.45",
   "description": "Official Zyphr SDK for Node.js, React, and React Native",
   "type": "module",
   "main": "./dist/index.cjs",

package/src/.openapi-generator/FILES

@@ -2,6 +2,7 @@
 .npmignore
 README.md
 package.json
+src/apis/AuthApplicationApi.ts
 src/apis/AuthEmailOTPApi.ts
 src/apis/AuthEmailTemplatesApi.ts
 src/apis/AuthEmailVerificationApi.ts
@@ -50,6 +51,8 @@ src/models/AddWorkflowStepRequest.ts
 src/models/ApiError.ts
 src/models/ApiErrorError.ts
 src/models/ApiErrorMeta.ts
+src/models/ApplicationSelf.ts
+src/models/ApplicationSelfResponse.ts
 src/models/AuthEmailTemplate.ts
 src/models/AuthEmailTemplateDefault.ts
 src/models/AuthEmailTemplateDefaultResponse.ts
@@ -70,6 +73,7 @@ src/models/AuthEmailType.ts
 src/models/AuthLoginResponse.ts
 src/models/AuthLoginResult.ts
 src/models/AuthLoginResultMfaChallenge.ts
+src/models/AuthMethods.ts
 src/models/AuthResult.ts
 src/models/AuthResultResponse.ts
 src/models/AuthSession.ts
@@ -85,6 +89,7 @@ src/models/BulkUpsertAuthEmailTemplatesResponse.ts
 src/models/Category.ts
 src/models/CategoryListResponse.ts
 src/models/CategoryResponse.ts
+src/models/ChangePasswordRequest.ts
 src/models/CloseWaaSEndpointCircuit200Response.ts
 src/models/CloseWaaSEndpointCircuit200ResponseData.ts
 src/models/ConfirmEmailVerificationRequest.ts
@@ -163,6 +168,7 @@ src/models/GenerateSubscriberTokenRequest.ts
 src/models/GenerateWaaSPortalToken201Response.ts
 src/models/GetDomain200Response.ts
 src/models/GetDomain200ResponseMeta.ts
+src/models/GetEndUserAuthMethods200Response.ts
 src/models/GetEndUserById200Response.ts
 src/models/GetEndUserClaims200Response.ts
 src/models/GetEndUserClaims200ResponseData.ts
@@ -363,6 +369,7 @@ src/models/SetEndUserClaims200ResponseData.ts
 src/models/SetEndUserClaimsRequest.ts
 src/models/SetPreferencesRequest.ts
 src/models/SetPreferencesRequestPreferencesInner.ts
+src/models/SetSelfApplicationTestRecipientsRequest.ts
 src/models/SignInAnonymouslyRequest.ts
 src/models/SignInWithGameCenterRequest.ts
 src/models/SignInWithGooglePlayGamesRequest.ts
@@ -500,6 +507,7 @@ src/models/WebhookDeliveryListResponse.ts
 src/models/WebhookDeliveryResponse.ts
 src/models/WebhookDeliveryRetryResponse.ts
 src/models/WebhookDeliveryRetryResponseData.ts
+src/models/WebhookEventType.ts
 src/models/WebhookEventTypesResponse.ts
 src/models/WebhookEventTypesResponseData.ts
 src/models/WebhookIpsResponse.ts

package/src/client.ts

@@ -16,6 +16,7 @@
 import { Configuration } from './src/runtime.js';
 import type { Middleware, ResponseContext } from './src/runtime.js';
 import {
+  AuthApplicationApi,
   AuthEmailOTPApi,
   AuthEmailVerificationApi,
   AuthLoginApi,
@@ -52,13 +53,24 @@ import {
 import { parseErrorResponse } from './errors.js';
 
 export interface ZyphrOptions {
-  /** Your Zyphr API key (zy_live_* or zy_test_*) */
+  /**
+   * Your Project-scoped Zyphr API key (`zy_live_*` / `zy_test_*`), sent as
+   * `Authorization: Bearer`. Used for notification APIs (emails, push, webhooks).
+   */
   apiKey: string;
   /** Override the base API URL (defaults to https://api.zyphr.dev/v1) */
   baseUrl?: string;
-  /** Application public key (za_pub_*) for Auth-as-a-Service endpoints */
+  /**
+   * Application-scoped public key (`za_live_pub_*` / `za_test_pub_*`; legacy
+   * `za_pub_*` still accepted) for Auth-as-a-Service endpoints, sent as
+   * `X-Application-Key`. Distinct from the Project-scoped `apiKey` above.
+   */
   applicationKey?: string;
-  /** Application secret key (za_sec_*) for Auth-as-a-Service endpoints */
+  /**
+   * Application-scoped secret key (`za_live_sec_*` / `za_test_sec_*`; legacy
+   * `za_sec_*` still accepted) for server-side Auth-as-a-Service endpoints, sent
+   * as `X-Application-Secret`. Must stay server-side — never ship in a client bundle.
+   */
   applicationSecret?: string;
 }
 
@@ -115,6 +127,8 @@ export class Zyphr {
     /** Server-side (secret-key) end-user directory: list/search/get/update/delete, invite, and the trusted claims store. */
     readonly userDirectory: AuthUserDirectoryApi;
     readonly webauthn: AuthWebAuthnApi;
+    /** Read the authenticating application's own non-sensitive metadata (id, name, environment, signing algorithm) via GET /auth/application. */
+    readonly application: AuthApplicationApi;
   };
 
   private readonly options: ZyphrOptions;
@@ -171,6 +185,7 @@ export class Zyphr {
       profile: new AuthUserProfileApi(config),
       userDirectory: new AuthUserDirectoryApi(config),
       webauthn: new AuthWebAuthnApi(config),
+      application: new AuthApplicationApi(config),
     };
   }
 

package/src/clientAuth.ts

@@ -4,8 +4,14 @@
  * `ZyphrClient` is a browser / React Native-safe entry point for Auth-as-a-Service.
  * Unlike the server `Zyphr` client (which requires a secret API key and, for auth,
  * an application SECRET key), `ZyphrClient` is constructed with ONLY the publishable
- * application key (`za_pub_*`) — the key that is safe to ship in a client bundle —
- * plus, once the user is authenticated, their end-user access token.
+ * application key (`za_live_pub_*` in live mode, `za_test_pub_*` in test mode) — the
+ * key that is safe to ship in a client bundle — plus, once the user is authenticated,
+ * their end-user access token.
+ *
+ * These Application-scoped credentials (`X-Application-Key` publishable key, and the
+ * server-only `X-Application-Secret`) are distinct from the Project-scoped notification
+ * keys (`zy_live_*` / `zy_test_*`, sent as `Authorization: Bearer`) used by the server
+ * `Zyphr` client for emails/push/webhooks.
  *
  * It deliberately exposes ONLY the end-user-scoped auth surface (login, registration,
  * sessions, magic links, OAuth, phone, email-OTP, profile, MFA, WebAuthn, password
@@ -17,7 +23,7 @@
  * ```ts
  * import { ZyphrClient } from '@zyphr-dev/node-sdk';
  *
- * const zyphr = new ZyphrClient({ applicationKey: 'za_pub_xxx' });
+ * const zyphr = new ZyphrClient({ applicationKey: 'za_live_pub_xxx' });
  *
  * const login = await zyphr.auth.login.loginEndUser({ ... });
  * zyphr.setAccessToken(login.data.tokens.access_token);
@@ -47,7 +53,10 @@ import {
 import { parseErrorResponse } from './errors.js';
 
 export interface ZyphrClientOptions {
-  /** Publishable application key (za_pub_*) — safe to embed in a client bundle. */
+  /**
+   * Publishable application key (`za_live_pub_*` / `za_test_pub_*`) — safe to
+   * embed in a client bundle. Legacy `za_pub_*` keys are also accepted.
+   */
   applicationKey: string;
   /** Override the base API URL (defaults to https://api.zyphr.dev/v1). */
   baseUrl?: string;
@@ -75,8 +84,31 @@ export class ZyphrClientCredentialError extends Error {
   }
 }
 
-/** Prefixes that must NEVER reach a client bundle. */
-const SECRET_KEY_PREFIXES = ['za_sec_', 'zy_live_', 'zy_test_'];
+// Key prefixes are mirrored from the platform source of truth,
+// packages/shared/src/constants/api.ts (APPLICATION_KEY_PREFIXES,
+// SECRET_KEY_PREFIXES). They are inlined here because this is a standalone
+// published package that cannot import @zyphr/shared at runtime — keep the two
+// in sync if the prefixes ever change.
+
+/**
+ * Publishable application-key prefixes accepted by the client-safe SDK.
+ * `za_live_pub_` / `za_test_pub_` are the current live/test prefixes; `za_pub_`
+ * is the deprecated legacy prefix, still accepted for backward compatibility.
+ */
+const PUBLISHABLE_KEY_PREFIXES = ['za_live_pub_', 'za_test_pub_', 'za_pub_'];
+
+/**
+ * Prefixes that must NEVER reach a client bundle: application SECRET keys
+ * (`za_live_sec_` / `za_test_sec_`, and legacy `za_sec_`) and Project-scoped
+ * notification API keys (`zy_live_*` / `zy_test_*`).
+ */
+const SECRET_KEY_PREFIXES = [
+  'za_live_sec_',
+  'za_test_sec_',
+  'za_sec_',
+  'zy_live_',
+  'zy_test_',
+];
 
 export class ZyphrClient {
   readonly auth: {
@@ -103,19 +135,20 @@ export class ZyphrClient {
 
   constructor(options: ZyphrClientOptions) {
     if (!options.applicationKey) {
-      throw new ZyphrClientCredentialError('applicationKey (za_pub_*) is required');
+      throw new ZyphrClientCredentialError('applicationKey (za_live_pub_* / za_test_pub_*) is required');
     }
     // Guardrail: reject secret-shaped credentials so a secret can't be shipped
-    // in a client bundle by mistake.
+    // in a client bundle by mistake. Checked before the publishable allow-list so
+    // a secret key produces the clearer "never a secret key" message.
     if (SECRET_KEY_PREFIXES.some((p) => options.applicationKey.startsWith(p))) {
       throw new ZyphrClientCredentialError(
-        'ZyphrClient must be constructed with a publishable application key (za_pub_*), ' +
-          'never a secret key. Secret keys must stay server-side.'
+        'ZyphrClient must be constructed with a publishable application key ' +
+          '(za_live_pub_* / za_test_pub_*), never a secret key. Secret keys must stay server-side.'
       );
     }
-    if (!options.applicationKey.startsWith('za_pub_')) {
+    if (!PUBLISHABLE_KEY_PREFIXES.some((p) => options.applicationKey.startsWith(p))) {
       throw new ZyphrClientCredentialError(
-        'applicationKey must be a publishable application key (za_pub_*).'
+        'applicationKey must be a publishable application key (za_live_pub_* / za_test_pub_*).'
       );
     }
 

package/src/src/apis/AuthApplicationApi.ts

@@ -0,0 +1,162 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Zyphr API
+ * Zyphr is a multi-channel notification platform that enables developers to send emails, push notifications, SMS, and in-app messages through a unified API.  ## Authentication  All API requests require authentication using an API key. Include your API key in the `X-API-Key` header:  ``` X-API-Key: zy_live_xxxxxxxxxxxx ```  API keys can be created in the Zyphr Dashboard. Use `zy_test_*` keys for testing and `zy_live_*` keys for production.  ## Rate Limiting  The API implements rate limiting to ensure fair usage. Rate limit information is included in response headers:  - `X-RateLimit-Limit`: Maximum requests per window - `X-RateLimit-Remaining`: Remaining requests in current window - `X-RateLimit-Reset`: Unix timestamp when the window resets  ## Account Sending Status  Every authenticated response carries the account\'s current sending state so you can surface it in your own tooling without a separate call:  - `X-Account-Sending-Status`: `active`, `throttled`, or `frozen` - `X-Account-Sending-Status-Reason`: human-readable reason (present only when the status is `throttled` or `frozen`)  This header is informational and non-blocking on non-send endpoints (reads, billing, and deliverability stay available). Send-capable endpoints additionally enforce the state: a frozen account receives `403 account_frozen` and a throttled account receives `429 account_throttled`, both with the reason in the error message.  ## Errors  All errors follow a consistent format:  ```json {   \"error\": {     \"code\": \"error_code\",     \"message\": \"Human readable message\",     \"details\": {}   },   \"meta\": {     \"request_id\": \"req_xxxx\"   } } ```
+ *
+ * The version of the OpenAPI document: 1.0.0
+ * Contact: support@zyphr.dev
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import * as runtime from '../runtime';
+import type {
+  ApiError,
+  ApplicationSelfResponse,
+  SetSelfApplicationTestRecipientsRequest,
+} from '../models/index';
+import {
+    ApiErrorFromJSON,
+    ApiErrorToJSON,
+    ApplicationSelfResponseFromJSON,
+    ApplicationSelfResponseToJSON,
+    SetSelfApplicationTestRecipientsRequestFromJSON,
+    SetSelfApplicationTestRecipientsRequestToJSON,
+} from '../models/index';
+
+export interface AuthApplicationApiSetSelfApplicationTestRecipientsOperationRequest {
+    setSelfApplicationTestRecipientsRequest: SetSelfApplicationTestRecipientsRequest;
+}
+
+/**
+ * AuthApplicationApi - interface
+ * 
+ * @export
+ * @interface AuthApplicationApiInterface
+ */
+export interface AuthApplicationApiInterface {
+    /**
+     * Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment\'s mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
+     * @summary Get the authenticating application
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthApplicationApiInterface
+     */
+    getSelfApplicationRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ApplicationSelfResponse>>;
+
+    /**
+     * Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment\'s mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
+     * Get the authenticating application
+     */
+    getSelfApplication(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ApplicationSelfResponse>;
+
+    /**
+     * Set `test_recipients` — the per-application auth-email allowlist — on the application whose credentials authenticated this request. When non-empty, this allowlist gates ALL auth emails (only listed addresses receive them); an EMPTY array clears it and disables the gate. Lets an integrator manage the allowlist from their own infrastructure config instead of the dashboard.  Application-SECRET scoped (server-side write): requires X-Application-Key AND X-Application-Secret. Mutates ONLY the authenticating application — it never takes an application id from the request, so there is no cross-tenant write path. The response mirrors GET /auth/application exactly (never returns secrets). 
+     * @summary Set the authenticating application\'s auth-email test allowlist
+     * @param {SetSelfApplicationTestRecipientsRequest} setSelfApplicationTestRecipientsRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthApplicationApiInterface
+     */
+    setSelfApplicationTestRecipientsRaw(requestParameters: AuthApplicationApiSetSelfApplicationTestRecipientsOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ApplicationSelfResponse>>;
+
+    /**
+     * Set `test_recipients` — the per-application auth-email allowlist — on the application whose credentials authenticated this request. When non-empty, this allowlist gates ALL auth emails (only listed addresses receive them); an EMPTY array clears it and disables the gate. Lets an integrator manage the allowlist from their own infrastructure config instead of the dashboard.  Application-SECRET scoped (server-side write): requires X-Application-Key AND X-Application-Secret. Mutates ONLY the authenticating application — it never takes an application id from the request, so there is no cross-tenant write path. The response mirrors GET /auth/application exactly (never returns secrets). 
+     * Set the authenticating application\'s auth-email test allowlist
+     */
+    setSelfApplicationTestRecipients(setSelfApplicationTestRecipientsRequest: SetSelfApplicationTestRecipientsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ApplicationSelfResponse>;
+
+}
+
+/**
+ * 
+ */
+export class AuthApplicationApi extends runtime.BaseAPI implements AuthApplicationApiInterface {
+
+    /**
+     * Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment\'s mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
+     * Get the authenticating application
+     */
+    async getSelfApplicationRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ApplicationSelfResponse>> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+        }
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+        }
+
+        const response = await this.request({
+            path: `/auth/application`,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ApplicationSelfResponseFromJSON(jsonValue));
+    }
+
+    /**
+     * Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment\'s mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
+     * Get the authenticating application
+     */
+    async getSelfApplication(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ApplicationSelfResponse> {
+        const response = await this.getSelfApplicationRaw(initOverrides);
+        return await response.value();
+    }
+
+    /**
+     * Set `test_recipients` — the per-application auth-email allowlist — on the application whose credentials authenticated this request. When non-empty, this allowlist gates ALL auth emails (only listed addresses receive them); an EMPTY array clears it and disables the gate. Lets an integrator manage the allowlist from their own infrastructure config instead of the dashboard.  Application-SECRET scoped (server-side write): requires X-Application-Key AND X-Application-Secret. Mutates ONLY the authenticating application — it never takes an application id from the request, so there is no cross-tenant write path. The response mirrors GET /auth/application exactly (never returns secrets). 
+     * Set the authenticating application\'s auth-email test allowlist
+     */
+    async setSelfApplicationTestRecipientsRaw(requestParameters: AuthApplicationApiSetSelfApplicationTestRecipientsOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ApplicationSelfResponse>> {
+        if (requestParameters['setSelfApplicationTestRecipientsRequest'] == null) {
+            throw new runtime.RequiredError(
+                'setSelfApplicationTestRecipientsRequest',
+                'Required parameter "setSelfApplicationTestRecipientsRequest" was null or undefined when calling setSelfApplicationTestRecipients().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+        }
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+        }
+
+        const response = await this.request({
+            path: `/auth/application`,
+            method: 'PATCH',
+            headers: headerParameters,
+            query: queryParameters,
+            body: SetSelfApplicationTestRecipientsRequestToJSON(requestParameters['setSelfApplicationTestRecipientsRequest']),
+        }, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => ApplicationSelfResponseFromJSON(jsonValue));
+    }
+
+    /**
+     * Set `test_recipients` — the per-application auth-email allowlist — on the application whose credentials authenticated this request. When non-empty, this allowlist gates ALL auth emails (only listed addresses receive them); an EMPTY array clears it and disables the gate. Lets an integrator manage the allowlist from their own infrastructure config instead of the dashboard.  Application-SECRET scoped (server-side write): requires X-Application-Key AND X-Application-Secret. Mutates ONLY the authenticating application — it never takes an application id from the request, so there is no cross-tenant write path. The response mirrors GET /auth/application exactly (never returns secrets). 
+     * Set the authenticating application\'s auth-email test allowlist
+     */
+    async setSelfApplicationTestRecipients(setSelfApplicationTestRecipientsRequest: SetSelfApplicationTestRecipientsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ApplicationSelfResponse> {
+        const response = await this.setSelfApplicationTestRecipientsRaw({ setSelfApplicationTestRecipientsRequest: setSelfApplicationTestRecipientsRequest }, initOverrides);
+        return await response.value();
+    }
+
+}

package/src/src/apis/AuthEmailTemplatesApi.ts

@@ -240,7 +240,7 @@ export interface AuthEmailTemplatesApiInterface {
     restoreAuthEmailTemplateVersion(type: AuthEmailType, version: number, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthEmailTemplateResponse>;
 
     /**
-     * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited. 
+     * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited.  When non-empty, `test_recipients` gates ALL auth emails this application sends (magic link, password reset, email verification, and email OTP) — not just these test renders. Only listed recipients receive auth email; any other recipient is silently blocked. Use it to make a non-production application safe from mass sends. An empty allowlist (the default) imposes no restriction and every recipient receives auth email normally. 
      * @summary Send a test render of a template
      * @param {AuthEmailType} type 
      * @param {AuthEmailTemplateTestRequest} authEmailTemplateTestRequest 
@@ -251,7 +251,7 @@ export interface AuthEmailTemplatesApiInterface {
     sendAuthEmailTemplateTestRaw(requestParameters: AuthEmailTemplatesApiSendAuthEmailTemplateTestRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthEmailTemplateTestResponse>>;
 
     /**
-     * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited. 
+     * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited.  When non-empty, `test_recipients` gates ALL auth emails this application sends (magic link, password reset, email verification, and email OTP) — not just these test renders. Only listed recipients receive auth email; any other recipient is silently blocked. Use it to make a non-production application safe from mass sends. An empty allowlist (the default) imposes no restriction and every recipient receives auth email normally. 
      * Send a test render of a template
      */
     sendAuthEmailTemplateTest(type: AuthEmailType, authEmailTemplateTestRequest: AuthEmailTemplateTestRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthEmailTemplateTestResponse>;
@@ -629,7 +629,7 @@ export class AuthEmailTemplatesApi extends runtime.BaseAPI implements AuthEmailT
     }
 
     /**
-     * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited. 
+     * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited.  When non-empty, `test_recipients` gates ALL auth emails this application sends (magic link, password reset, email verification, and email OTP) — not just these test renders. Only listed recipients receive auth email; any other recipient is silently blocked. Use it to make a non-production application safe from mass sends. An empty allowlist (the default) imposes no restriction and every recipient receives auth email normally. 
      * Send a test render of a template
      */
     async sendAuthEmailTemplateTestRaw(requestParameters: AuthEmailTemplatesApiSendAuthEmailTemplateTestRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthEmailTemplateTestResponse>> {
@@ -673,7 +673,7 @@ export class AuthEmailTemplatesApi extends runtime.BaseAPI implements AuthEmailT
     }
 
     /**
-     * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited. 
+     * Renders the template (override or default) using sample/provided variables and sends to the recipient. The recipient must be in the application `test_recipients` allowlist. Rate-limited.  When non-empty, `test_recipients` gates ALL auth emails this application sends (magic link, password reset, email verification, and email OTP) — not just these test renders. Only listed recipients receive auth email; any other recipient is silently blocked. Use it to make a non-production application safe from mass sends. An empty allowlist (the default) imposes no restriction and every recipient receives auth email normally. 
      * Send a test render of a template
      */
     async sendAuthEmailTemplateTest(type: AuthEmailType, authEmailTemplateTestRequest: AuthEmailTemplateTestRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthEmailTemplateTestResponse> {

package/src/src/apis/AuthUserDirectoryApi.ts

@@ -15,6 +15,7 @@
 
 import * as runtime from '../runtime';
 import type {
+  GetEndUserAuthMethods200Response,
   GetEndUserById200Response,
   GetEndUserClaims200Response,
   InviteEndUser200Response,
@@ -25,6 +26,8 @@ import type {
   UpdateEndUserByApplicationRequest,
 } from '../models/index';
 import {
+    GetEndUserAuthMethods200ResponseFromJSON,
+    GetEndUserAuthMethods200ResponseToJSON,
     GetEndUserById200ResponseFromJSON,
     GetEndUserById200ResponseToJSON,
     GetEndUserClaims200ResponseFromJSON,
@@ -47,6 +50,10 @@ export interface AuthUserDirectoryApiDeleteEndUserByApplicationRequest {
     userId: string;
 }
 
+export interface AuthUserDirectoryApiGetEndUserAuthMethodsRequest {
+    userId: string;
+}
+
 export interface AuthUserDirectoryApiGetEndUserByEmailRequest {
     email: string;
 }
@@ -103,6 +110,22 @@ export interface AuthUserDirectoryApiInterface {
      */
     deleteEndUserByApplication(userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
 
+    /**
+     * Secret-key-scoped, aggregate view of the sign-in methods configured for a single end user within the authenticating application. Reports whether the user has a password, which OAuth providers are linked, whether MFA is enabled, whether email/phone are verified, and how many passkeys are registered — everything a customer admin needs to build a \"sign-in methods\" screen. Scoped to the application — a caller can never read a user belonging to another application. 
+     * @summary Get an end user\'s sign-in methods (server-side admin)
+     * @param {string} userId 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthUserDirectoryApiInterface
+     */
+    getEndUserAuthMethodsRaw(requestParameters: AuthUserDirectoryApiGetEndUserAuthMethodsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<GetEndUserAuthMethods200Response>>;
+
+    /**
+     * Secret-key-scoped, aggregate view of the sign-in methods configured for a single end user within the authenticating application. Reports whether the user has a password, which OAuth providers are linked, whether MFA is enabled, whether email/phone are verified, and how many passkeys are registered — everything a customer admin needs to build a \"sign-in methods\" screen. Scoped to the application — a caller can never read a user belonging to another application. 
+     * Get an end user\'s sign-in methods (server-side admin)
+     */
+    getEndUserAuthMethods(userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetEndUserAuthMethods200Response>;
+
     /**
      * Secret-key-scoped lookup of a single end user by email address within the authenticating application. Scoped to the application — never resolves a user from another application. Does not return the password hash. 
      * @summary Look up an end user by email (server-side admin)
@@ -269,6 +292,49 @@ export class AuthUserDirectoryApi extends runtime.BaseAPI implements AuthUserDir
         await this.deleteEndUserByApplicationRaw({ userId: userId }, initOverrides);
     }
 
+    /**
+     * Secret-key-scoped, aggregate view of the sign-in methods configured for a single end user within the authenticating application. Reports whether the user has a password, which OAuth providers are linked, whether MFA is enabled, whether email/phone are verified, and how many passkeys are registered — everything a customer admin needs to build a \"sign-in methods\" screen. Scoped to the application — a caller can never read a user belonging to another application. 
+     * Get an end user\'s sign-in methods (server-side admin)
+     */
+    async getEndUserAuthMethodsRaw(requestParameters: AuthUserDirectoryApiGetEndUserAuthMethodsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<GetEndUserAuthMethods200Response>> {
+        if (requestParameters['userId'] == null) {
+            throw new runtime.RequiredError(
+                'userId',
+                'Required parameter "userId" was null or undefined when calling getEndUserAuthMethods().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+        }
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+        }
+
+        const response = await this.request({
+            path: `/auth/users/{user_id}/auth-methods`.replace(`{${"user_id"}}`, encodeURIComponent(String(requestParameters['userId']))),
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => GetEndUserAuthMethods200ResponseFromJSON(jsonValue));
+    }
+
+    /**
+     * Secret-key-scoped, aggregate view of the sign-in methods configured for a single end user within the authenticating application. Reports whether the user has a password, which OAuth providers are linked, whether MFA is enabled, whether email/phone are verified, and how many passkeys are registered — everything a customer admin needs to build a \"sign-in methods\" screen. Scoped to the application — a caller can never read a user belonging to another application. 
+     * Get an end user\'s sign-in methods (server-side admin)
+     */
+    async getEndUserAuthMethods(userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetEndUserAuthMethods200Response> {
+        const response = await this.getEndUserAuthMethodsRaw({ userId: userId }, initOverrides);
+        return await response.value();
+    }
+
     /**
      * Secret-key-scoped lookup of a single end user by email address within the authenticating application. Scoped to the application — never resolves a user from another application. Does not return the password hash. 
      * Look up an end user by email (server-side admin)

package/src/src/apis/AuthUserProfileApi.ts

@@ -17,7 +17,9 @@ import * as runtime from '../runtime';
 import type {
   ApiError,
   AuthUserResponse,
+  ChangePasswordRequest,
   EndUserDeleteResponse,
+  RefreshTokenResponse,
   UpdateEndUserRequest,
 } from '../models/index';
 import {
@@ -25,12 +27,20 @@ import {
     ApiErrorToJSON,
     AuthUserResponseFromJSON,
     AuthUserResponseToJSON,
+    ChangePasswordRequestFromJSON,
+    ChangePasswordRequestToJSON,
     EndUserDeleteResponseFromJSON,
     EndUserDeleteResponseToJSON,
+    RefreshTokenResponseFromJSON,
+    RefreshTokenResponseToJSON,
     UpdateEndUserRequestFromJSON,
     UpdateEndUserRequestToJSON,
 } from '../models/index';
 
+export interface AuthUserProfileApiChangeEndUserPasswordRequest {
+    changePasswordRequest: ChangePasswordRequest;
+}
+
 export interface AuthUserProfileApiUpdateEndUserOperationRequest {
     updateEndUserRequest: UpdateEndUserRequest;
 }
@@ -42,6 +52,22 @@ export interface AuthUserProfileApiUpdateEndUserOperationRequest {
  * @interface AuthUserProfileApiInterface
  */
 export interface AuthUserProfileApiInterface {
+    /**
+     * Change the currently authenticated end user\'s password from a logged-in session. The caller must prove possession of the CURRENT password (`current_password`); the user is identified from the end-user token, not the request body, so a user can only change their own password.  On success, all existing sessions are revoked and a fresh token pair is returned so the current session stays authenticated. Emits the `user.password_changed` webhook.
+     * @summary Change password (authenticated session)
+     * @param {ChangePasswordRequest} changePasswordRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthUserProfileApiInterface
+     */
+    changeEndUserPasswordRaw(requestParameters: AuthUserProfileApiChangeEndUserPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<RefreshTokenResponse>>;
+
+    /**
+     * Change the currently authenticated end user\'s password from a logged-in session. The caller must prove possession of the CURRENT password (`current_password`); the user is identified from the end-user token, not the request body, so a user can only change their own password.  On success, all existing sessions are revoked and a fresh token pair is returned so the current session stays authenticated. Emits the `user.password_changed` webhook.
+     * Change password (authenticated session)
+     */
+    changeEndUserPassword(changePasswordRequest: ChangePasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<RefreshTokenResponse>;
+
     /**
      * Delete the current end user account (GDPR right to erasure). This is a soft delete — the account is marked as deleted but data is retained for a period to allow for recovery or legal requirements. 
      * @summary Delete current end user account
@@ -95,6 +121,56 @@ export interface AuthUserProfileApiInterface {
  */
 export class AuthUserProfileApi extends runtime.BaseAPI implements AuthUserProfileApiInterface {
 
+    /**
+     * Change the currently authenticated end user\'s password from a logged-in session. The caller must prove possession of the CURRENT password (`current_password`); the user is identified from the end-user token, not the request body, so a user can only change their own password.  On success, all existing sessions are revoked and a fresh token pair is returned so the current session stays authenticated. Emits the `user.password_changed` webhook.
+     * Change password (authenticated session)
+     */
+    async changeEndUserPasswordRaw(requestParameters: AuthUserProfileApiChangeEndUserPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<RefreshTokenResponse>> {
+        if (requestParameters['changePasswordRequest'] == null) {
+            throw new runtime.RequiredError(
+                'changePasswordRequest',
+                'Required parameter "changePasswordRequest" was null or undefined when calling changeEndUserPassword().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        headerParameters['Content-Type'] = 'application/json';
+
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("EndUserToken", []);
+
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+        }
+
+        const response = await this.request({
+            path: `/auth/users/change-password`,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: ChangePasswordRequestToJSON(requestParameters['changePasswordRequest']),
+        }, initOverrides);
+
+        return new runtime.JSONApiResponse(response, (jsonValue) => RefreshTokenResponseFromJSON(jsonValue));
+    }
+
+    /**
+     * Change the currently authenticated end user\'s password from a logged-in session. The caller must prove possession of the CURRENT password (`current_password`); the user is identified from the end-user token, not the request body, so a user can only change their own password.  On success, all existing sessions are revoked and a fresh token pair is returned so the current session stays authenticated. Emits the `user.password_changed` webhook.
+     * Change password (authenticated session)
+     */
+    async changeEndUserPassword(changePasswordRequest: ChangePasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<RefreshTokenResponse> {
+        const response = await this.changeEndUserPasswordRaw({ changePasswordRequest: changePasswordRequest }, initOverrides);
+        return await response.value();
+    }
+
     /**
      * Delete the current end user account (GDPR right to erasure). This is a soft delete — the account is marked as deleted but data is retained for a period to allow for recovery or legal requirements. 
      * Delete current end user account

package/src/src/apis/index.ts

@@ -1,5 +1,6 @@
 /* tslint:disable */
 /* eslint-disable */
+export * from './AuthApplicationApi';
 export * from './AuthEmailOTPApi';
 export * from './AuthEmailTemplatesApi';
 export * from './AuthEmailVerificationApi';