@zyphr-dev/node-sdk 0.1.45 → 0.1.47

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zyphr-dev/node-sdk",
-  "version": "0.1.45",
+  "version": "0.1.47",
   "description": "Official Zyphr SDK for Node.js, React, and React Native",
   "type": "module",
   "main": "./dist/index.cjs",

package/src/clientAuth.ts

@@ -28,7 +28,8 @@
  * const login = await zyphr.auth.login.loginEndUser({ ... });
  * zyphr.setAccessToken(login.data.tokens.access_token);
  *
- * const me = await zyphr.auth.profile.getEndUser(zyphr.authedRequest());
+ * // The stored token is applied automatically to user-scoped calls:
+ * const me = await zyphr.auth.profile.getEndUser();
  * ```
  */
 
@@ -60,7 +61,14 @@ export interface ZyphrClientOptions {
   applicationKey: string;
   /** Override the base API URL (defaults to https://api.zyphr.dev/v1). */
   baseUrl?: string;
-  /** Optional end-user access token, if you already have a session on construction. */
+  /**
+   * Optional end-user access token, if you already have a session on
+   * construction. Once set (here or via {@link ZyphrClient.setAccessToken}), it
+   * is applied automatically as `Authorization: Bearer` to every user-scoped
+   * call — you no longer need to pass {@link ZyphrClient.authedRequest} for
+   * authentication (though authedRequest still works and a token passed to it
+   * overrides the stored one).
+   */
   accessToken?: string;
 }
 
@@ -157,10 +165,18 @@ export class ZyphrClient {
 
     const config = new Configuration({
       basePath: options.baseUrl,
-      // The only credential this client sends automatically is the publishable
-      // application key. End-user Bearer tokens are attached per-request via
-      // authedRequest() so token rotation doesn't require rebuilding the client.
+      // The publishable application key is sent automatically on every call.
       apiKey: (name: string) => (name === 'X-Application-Key' ? this.applicationKey : ''),
+      // The stored end-user access token is also applied automatically: any
+      // user-scoped generated method (which authenticates the EndUserToken
+      // scheme) invokes this callback and attaches `Authorization: Bearer`.
+      // The callback reads `this.accessToken` at call time, so setAccessToken()
+      // takes effect on subsequent calls without rebuilding the client. When no
+      // token is set it returns '', and the generated code adds no header — so
+      // anonymous endpoints (login, register, password-reset) stay unauthenticated.
+      // An explicit token passed to authedRequest() sets the header directly in
+      // RequestInit, which overrides this callback.
+      accessToken: async () => this.accessToken ?? '',
       middleware: [errorMiddleware],
     });
 
@@ -182,7 +198,7 @@ export class ZyphrClient {
     this.devices = new DevicesApi(config);
   }
 
-  /** Store the end-user access token for subsequent authedRequest() calls. */
+  /** Store the end-user access token; it is applied automatically to subsequent user-scoped calls. */
   setAccessToken(accessToken: string | undefined): void {
     this.accessToken = accessToken;
   }
@@ -195,17 +211,33 @@ export class ZyphrClient {
   /**
    * Build request overrides that authenticate as the current end user: the
    * stored Bearer token plus the publishable application key required by
-   * user-scoped endpoints. Pass an explicit token to override the stored one.
+   * user-scoped endpoints.
+   *
+   * The stored token is now applied automatically to user-scoped calls, so this
+   * is no longer required for authentication. It remains useful to authenticate
+   * a single call with a different token — a token passed here sets the header
+   * directly in RequestInit and overrides the stored token for that call.
    *
    * @example
    * ```ts
-   * const me = await zyphr.auth.profile.getEndUser(zyphr.authedRequest());
+   * // Authenticate one call as a different user, without changing stored state:
+   * const me = await zyphr.auth.profile.getEndUser(zyphr.authedRequest(otherToken));
    * ```
    */
   authedRequest(accessToken?: string): RequestInit {
     const token = accessToken ?? this.accessToken;
+    // The runtime REPLACES the whole headers object with this initOverride (it
+    // does not deep-merge — see createFetchParams), so every header the request
+    // needs must be re-listed here or it is dropped for this call:
+    //   - X-Application-Key: the app key the Configuration would otherwise add.
+    //   - Content-Type: application/json: the generated method sets this for
+    //     body-carrying calls; without it a POST via authedRequest() goes out
+    //     with no JSON content-type, the server parses no fields, and returns a
+    //     misleading validation error (e.g. "current_password is required").
+    //     Harmless on GETs (no body); required for any mutating call. (sc-7631)
     const headers: Record<string, string> = {
       'X-Application-Key': this.applicationKey,
+      'Content-Type': 'application/json',
     };
     if (token) {
       headers.Authorization = `Bearer ${token}`;

package/src/src/apis/EmailsApi.ts

@@ -134,7 +134,7 @@ export interface EmailsApiInterface {
     /**
      * Retrieve a paginated list of sent emails
      * @summary List emails
-     * @param {'pending' | 'queued' | 'sent' | 'delivered' | 'failed' | 'bounced' | 'rejected'} [status] 
+     * @param {'pending' | 'queued' | 'sent' | 'delivered' | 'failed' | 'bounced' | 'rejected' | 'suppressed'} [status] 
      * @param {string} [tag] 
      * @param {number} [limit] 
      * @param {number} [offset] 
@@ -450,6 +450,7 @@ export const ListEmailsStatusEnum = {
     DELIVERED: 'delivered',
     FAILED: 'failed',
     BOUNCED: 'bounced',
-    REJECTED: 'rejected'
+    REJECTED: 'rejected',
+    SUPPRESSED: 'suppressed'
 } as const;
 export type ListEmailsStatusEnum = typeof ListEmailsStatusEnum[keyof typeof ListEmailsStatusEnum];

package/src/src/models/EmailMessage.ts

@@ -57,6 +57,13 @@ export interface EmailMessage {
      * @memberof EmailMessage
      */
     status?: EmailMessageStatusEnum;
+    /**
+     * Why the message is in its current status, when applicable. For a `suppressed` row this is the suppression reason (e.g. `recipient_not_allowlisted` when blocked by the auth application's test_recipients allowlist). Null for normal sends.
+     * 
+     * @type {string}
+     * @memberof EmailMessage
+     */
+    statusReason?: string | null;
     /**
      * 
      * @type {Array<string>}
@@ -118,7 +125,8 @@ export const EmailMessageStatusEnum = {
     DELIVERED: 'delivered',
     FAILED: 'failed',
     BOUNCED: 'bounced',
-    REJECTED: 'rejected'
+    REJECTED: 'rejected',
+    SUPPRESSED: 'suppressed'
 } as const;
 export type EmailMessageStatusEnum = typeof EmailMessageStatusEnum[keyof typeof EmailMessageStatusEnum];
 
@@ -145,6 +153,7 @@ export function EmailMessageFromJSONTyped(json: any, ignoreDiscriminator: boolea
         'to': json['to'] == null ? undefined : EmailAddressFromJSON(json['to']),
         'subject': json['subject'] == null ? undefined : json['subject'],
         'status': json['status'] == null ? undefined : json['status'],
+        'statusReason': json['status_reason'] == null ? undefined : json['status_reason'],
         'tags': json['tags'] == null ? undefined : json['tags'],
         'queuedAt': json['queued_at'] == null ? undefined : (new Date(json['queued_at'])),
         'sentAt': json['sent_at'] == null ? undefined : (new Date(json['sent_at'])),
@@ -172,6 +181,7 @@ export function EmailMessageToJSONTyped(value?: EmailMessage | null, ignoreDiscr
         'to': EmailAddressToJSON(value['to']),
         'subject': value['subject'],
         'status': value['status'],
+        'status_reason': value['statusReason'],
         'tags': value['tags'],
         'queued_at': value['queuedAt'] == null ? undefined : ((value['queuedAt']).toISOString()),
         'sent_at': value['sentAt'] == null ? undefined : ((value['sentAt'] as any).toISOString()),

package/src/src/models/WebhookEventType.ts

@@ -27,6 +27,7 @@ export const WebhookEventType = {
     EMAIL_OPENED: 'email.opened',
     EMAIL_CLICKED: 'email.clicked',
     EMAIL_FAILED: 'email.failed',
+    EMAIL_SUPPRESSED: 'email.suppressed',
     EMAIL_RECEIVED: 'email.received',
     PUSH_SENT: 'push.sent',
     PUSH_DELIVERED: 'push.delivered',