@zyphr-dev/node-sdk 0.1.45 → 0.1.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zyphr-dev/node-sdk",
-  "version": "0.1.45",
+  "version": "0.1.46",
   "description": "Official Zyphr SDK for Node.js, React, and React Native",
   "type": "module",
   "main": "./dist/index.cjs",

package/src/clientAuth.ts

@@ -28,7 +28,8 @@
  * const login = await zyphr.auth.login.loginEndUser({ ... });
  * zyphr.setAccessToken(login.data.tokens.access_token);
  *
- * const me = await zyphr.auth.profile.getEndUser(zyphr.authedRequest());
+ * // The stored token is applied automatically to user-scoped calls:
+ * const me = await zyphr.auth.profile.getEndUser();
  * ```
  */
 
@@ -60,7 +61,14 @@ export interface ZyphrClientOptions {
   applicationKey: string;
   /** Override the base API URL (defaults to https://api.zyphr.dev/v1). */
   baseUrl?: string;
-  /** Optional end-user access token, if you already have a session on construction. */
+  /**
+   * Optional end-user access token, if you already have a session on
+   * construction. Once set (here or via {@link ZyphrClient.setAccessToken}), it
+   * is applied automatically as `Authorization: Bearer` to every user-scoped
+   * call — you no longer need to pass {@link ZyphrClient.authedRequest} for
+   * authentication (though authedRequest still works and a token passed to it
+   * overrides the stored one).
+   */
   accessToken?: string;
 }
 
@@ -157,10 +165,18 @@ export class ZyphrClient {
 
     const config = new Configuration({
       basePath: options.baseUrl,
-      // The only credential this client sends automatically is the publishable
-      // application key. End-user Bearer tokens are attached per-request via
-      // authedRequest() so token rotation doesn't require rebuilding the client.
+      // The publishable application key is sent automatically on every call.
       apiKey: (name: string) => (name === 'X-Application-Key' ? this.applicationKey : ''),
+      // The stored end-user access token is also applied automatically: any
+      // user-scoped generated method (which authenticates the EndUserToken
+      // scheme) invokes this callback and attaches `Authorization: Bearer`.
+      // The callback reads `this.accessToken` at call time, so setAccessToken()
+      // takes effect on subsequent calls without rebuilding the client. When no
+      // token is set it returns '', and the generated code adds no header — so
+      // anonymous endpoints (login, register, password-reset) stay unauthenticated.
+      // An explicit token passed to authedRequest() sets the header directly in
+      // RequestInit, which overrides this callback.
+      accessToken: async () => this.accessToken ?? '',
       middleware: [errorMiddleware],
     });
 
@@ -182,7 +198,7 @@ export class ZyphrClient {
     this.devices = new DevicesApi(config);
   }
 
-  /** Store the end-user access token for subsequent authedRequest() calls. */
+  /** Store the end-user access token; it is applied automatically to subsequent user-scoped calls. */
   setAccessToken(accessToken: string | undefined): void {
     this.accessToken = accessToken;
   }
@@ -195,15 +211,25 @@ export class ZyphrClient {
   /**
    * Build request overrides that authenticate as the current end user: the
    * stored Bearer token plus the publishable application key required by
-   * user-scoped endpoints. Pass an explicit token to override the stored one.
+   * user-scoped endpoints.
+   *
+   * The stored token is now applied automatically to user-scoped calls, so this
+   * is no longer required for authentication. It remains useful to authenticate
+   * a single call with a different token — a token passed here sets the header
+   * directly in RequestInit and overrides the stored token for that call.
    *
    * @example
    * ```ts
-   * const me = await zyphr.auth.profile.getEndUser(zyphr.authedRequest());
+   * // Authenticate one call as a different user, without changing stored state:
+   * const me = await zyphr.auth.profile.getEndUser(zyphr.authedRequest(otherToken));
    * ```
    */
   authedRequest(accessToken?: string): RequestInit {
     const token = accessToken ?? this.accessToken;
+    // Must include X-Application-Key: the runtime replaces the whole headers
+    // object with this initOverride (it does not deep-merge), so anything not
+    // re-listed here — including the app key the Configuration would otherwise
+    // add — is dropped for this call.
     const headers: Record<string, string> = {
       'X-Application-Key': this.applicationKey,
     };

package/src/src/models/WebhookEventType.ts

@@ -27,6 +27,7 @@ export const WebhookEventType = {
     EMAIL_OPENED: 'email.opened',
     EMAIL_CLICKED: 'email.clicked',
     EMAIL_FAILED: 'email.failed',
+    EMAIL_SUPPRESSED: 'email.suppressed',
     EMAIL_RECEIVED: 'email.received',
     PUSH_SENT: 'push.sent',
     PUSH_DELIVERED: 'push.delivered',