@zyphr-dev/node-sdk 0.1.49 → 0.1.51

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zyphr-dev/node-sdk",
-  "version": "0.1.49",
+  "version": "0.1.51",
   "description": "Official Zyphr SDK for Node.js, React, and React Native",
   "type": "module",
   "main": "./dist/index.cjs",

package/src/src/models/ApplicationSelf.ts

@@ -48,11 +48,17 @@ export interface ApplicationSelf {
      */
     signingAlgorithm: ApplicationSelfSigningAlgorithmEnum;
     /**
-     * The auth-email test allowlist. When non-empty, only these addresses receive auth emails (the gate from sc-7443); an empty array disables the gate. Settable via PATCH /auth/application (sc-7600).
+     * The auth-email allowlist. In `allowlist` mode, only these addresses receive auth emails; in `unrestricted` mode it is ignored. Settable via PATCH /auth/application (sc-7600).
      * @type {Array<string>}
      * @memberof ApplicationSelf
      */
     testRecipients: Array<string>;
+    /**
+     * Explicit auth-email gate mode (sc-7673). `unrestricted` sends auth emails to everyone. `allowlist` restricts auth email to `test_recipients` — and an EMPTY allowlist in this mode fails CLOSED (blocks all auth email). This replaces the previous behavior where the gate was inferred from whether `test_recipients` was empty. Defaults to `unrestricted`.
+     * @type {string}
+     * @memberof ApplicationSelf
+     */
+    authEmailMode: ApplicationSelfAuthEmailModeEnum;
 }
 
 
@@ -75,6 +81,15 @@ export const ApplicationSelfSigningAlgorithmEnum = {
 } as const;
 export type ApplicationSelfSigningAlgorithmEnum = typeof ApplicationSelfSigningAlgorithmEnum[keyof typeof ApplicationSelfSigningAlgorithmEnum];
 
+/**
+ * @export
+ */
+export const ApplicationSelfAuthEmailModeEnum = {
+    ALLOWLIST: 'allowlist',
+    UNRESTRICTED: 'unrestricted'
+} as const;
+export type ApplicationSelfAuthEmailModeEnum = typeof ApplicationSelfAuthEmailModeEnum[keyof typeof ApplicationSelfAuthEmailModeEnum];
+
 
 /**
  * Check if a given object implements the ApplicationSelf interface.
@@ -85,6 +100,7 @@ export function instanceOfApplicationSelf(value: object): value is ApplicationSe
     if (!('environment' in value) || value['environment'] === undefined) return false;
     if (!('signingAlgorithm' in value) || value['signingAlgorithm'] === undefined) return false;
     if (!('testRecipients' in value) || value['testRecipients'] === undefined) return false;
+    if (!('authEmailMode' in value) || value['authEmailMode'] === undefined) return false;
     return true;
 }
 
@@ -103,6 +119,7 @@ export function ApplicationSelfFromJSONTyped(json: any, ignoreDiscriminator: boo
         'environment': json['environment'],
         'signingAlgorithm': json['signing_algorithm'],
         'testRecipients': json['test_recipients'],
+        'authEmailMode': json['auth_email_mode'],
     };
 }
 
@@ -122,6 +139,7 @@ export function ApplicationSelfToJSONTyped(value?: ApplicationSelf | null, ignor
         'environment': value['environment'],
         'signing_algorithm': value['signingAlgorithm'],
         'test_recipients': value['testRecipients'],
+        'auth_email_mode': value['authEmailMode'],
     };
 }
 

package/src/src/models/PasswordPolicy.ts

@@ -61,6 +61,12 @@ export interface PasswordPolicy {
      * @memberof PasswordPolicy
      */
     disallowCommon: boolean;
+    /**
+     * Whether passwords found in the HaveIBeenPwned breach corpus are rejected at registration/reset. Checked via k-anonymity (only a 5-char SHA-1 prefix leaves our infrastructure) and fail-open: if the breach source is unavailable the password is allowed. Default false (advisory only — the breach signal is returned but does not gate acceptance unless enabled).
+     * @type {boolean}
+     * @memberof PasswordPolicy
+     */
+    disallowBreached: boolean;
 }
 
 /**
@@ -74,6 +80,7 @@ export function instanceOfPasswordPolicy(value: object): value is PasswordPolicy
     if (!('requireNumbers' in value) || value['requireNumbers'] === undefined) return false;
     if (!('requireSpecial' in value) || value['requireSpecial'] === undefined) return false;
     if (!('disallowCommon' in value) || value['disallowCommon'] === undefined) return false;
+    if (!('disallowBreached' in value) || value['disallowBreached'] === undefined) return false;
     return true;
 }
 
@@ -94,6 +101,7 @@ export function PasswordPolicyFromJSONTyped(json: any, ignoreDiscriminator: bool
         'requireNumbers': json['require_numbers'],
         'requireSpecial': json['require_special'],
         'disallowCommon': json['disallow_common'],
+        'disallowBreached': json['disallow_breached'],
     };
 }
 
@@ -115,6 +123,7 @@ export function PasswordPolicyToJSONTyped(value?: PasswordPolicy | null, ignoreD
         'require_numbers': value['requireNumbers'],
         'require_special': value['requireSpecial'],
         'disallow_common': value['disallowCommon'],
+        'disallow_breached': value['disallowBreached'],
     };
 }
 

package/src/src/models/PasswordStrength.ts

@@ -20,13 +20,25 @@ import { mapValues } from '../runtime';
  */
 export interface PasswordStrength {
     /**
-     * Whether the password would be accepted by the server's enforcement path. A password that is valid here is accepted by registration.
+     * Whether the password would be accepted by the server's enforcement path. A password that is valid here is accepted by registration. When the application enables `disallow_breached`, a breached password is `valid: false` here AND rejected by register/reset (no drift).
      * @type {boolean}
      * @memberof PasswordStrength
      */
     valid: boolean;
     /**
-     * Strength score, 0-100.
+     * Whether the password appears in the HaveIBeenPwned breach corpus. This is a distinct signal from `valid` and is always returned regardless of the app's `disallow_breached` setting. Fail-open: if the breach source is unavailable this is `false`.
+     * @type {boolean}
+     * @memberof PasswordStrength
+     */
+    breached: boolean;
+    /**
+     * HIBP occurrence count for the password (0 if not breached or if the breach lookup failed/was unavailable).
+     * @type {number}
+     * @memberof PasswordStrength
+     */
+    breachCount: number;
+    /**
+     * Strength score, 0-100. A pure composition measure — independent of the breach signal.
      * @type {number}
      * @memberof PasswordStrength
      */
@@ -63,6 +75,8 @@ export type PasswordStrengthLabelEnum = typeof PasswordStrengthLabelEnum[keyof t
  */
 export function instanceOfPasswordStrength(value: object): value is PasswordStrength {
     if (!('valid' in value) || value['valid'] === undefined) return false;
+    if (!('breached' in value) || value['breached'] === undefined) return false;
+    if (!('breachCount' in value) || value['breachCount'] === undefined) return false;
     if (!('score' in value) || value['score'] === undefined) return false;
     if (!('label' in value) || value['label'] === undefined) return false;
     if (!('feedback' in value) || value['feedback'] === undefined) return false;
@@ -80,6 +94,8 @@ export function PasswordStrengthFromJSONTyped(json: any, ignoreDiscriminator: bo
     return {
         
         'valid': json['valid'],
+        'breached': json['breached'],
+        'breachCount': json['breach_count'],
         'score': json['score'],
         'label': json['label'],
         'feedback': json['feedback'],
@@ -98,6 +114,8 @@ export function PasswordStrengthToJSONTyped(value?: PasswordStrength | null, ign
     return {
         
         'valid': value['valid'],
+        'breached': value['breached'],
+        'breach_count': value['breachCount'],
         'score': value['score'],
         'label': value['label'],
         'feedback': value['feedback'],

package/src/src/models/SetSelfApplicationTestRecipientsRequest.ts

@@ -14,24 +14,40 @@
 
 import { mapValues } from '../runtime';
 /**
- * 
+ * Provide test_recipients and/or auth_email_mode. Omitting one leaves that value unchanged; sending neither is a 400.
  * @export
  * @interface SetSelfApplicationTestRecipientsRequest
  */
 export interface SetSelfApplicationTestRecipientsRequest {
     /**
-     * Email addresses allowed to receive auth emails. An empty array clears the allowlist (disables the gate).
+     * Email addresses allowed to receive auth emails when auth_email_mode is 'allowlist'. Ignored in 'unrestricted' mode. Optional — omit to leave the current list unchanged.
      * @type {Array<string>}
      * @memberof SetSelfApplicationTestRecipientsRequest
      */
-    testRecipients: Array<string>;
+    testRecipients?: Array<string>;
+    /**
+     * Optional (sc-7673). Explicit auth-email gate mode. 'unrestricted' sends to everyone; 'allowlist' restricts to test_recipients (an EMPTY list in allowlist mode fails closed — blocks all auth email). Omit to leave the current mode unchanged.
+     * @type {string}
+     * @memberof SetSelfApplicationTestRecipientsRequest
+     */
+    authEmailMode?: SetSelfApplicationTestRecipientsRequestAuthEmailModeEnum;
 }
 
+
+/**
+ * @export
+ */
+export const SetSelfApplicationTestRecipientsRequestAuthEmailModeEnum = {
+    ALLOWLIST: 'allowlist',
+    UNRESTRICTED: 'unrestricted'
+} as const;
+export type SetSelfApplicationTestRecipientsRequestAuthEmailModeEnum = typeof SetSelfApplicationTestRecipientsRequestAuthEmailModeEnum[keyof typeof SetSelfApplicationTestRecipientsRequestAuthEmailModeEnum];
+
+
 /**
  * Check if a given object implements the SetSelfApplicationTestRecipientsRequest interface.
  */
 export function instanceOfSetSelfApplicationTestRecipientsRequest(value: object): value is SetSelfApplicationTestRecipientsRequest {
-    if (!('testRecipients' in value) || value['testRecipients'] === undefined) return false;
     return true;
 }
 
@@ -45,7 +61,8 @@ export function SetSelfApplicationTestRecipientsRequestFromJSONTyped(json: any,
     }
     return {
         
-        'testRecipients': json['test_recipients'],
+        'testRecipients': json['test_recipients'] == null ? undefined : json['test_recipients'],
+        'authEmailMode': json['auth_email_mode'] == null ? undefined : json['auth_email_mode'],
     };
 }
 
@@ -61,6 +78,7 @@ export function SetSelfApplicationTestRecipientsRequestToJSONTyped(value?: SetSe
     return {
         
         'test_recipients': value['testRecipients'],
+        'auth_email_mode': value['authEmailMode'],
     };
 }