@zyphr-dev/node-sdk 0.1.52 → 0.1.54

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zyphr-dev/node-sdk",
-  "version": "0.1.52",
+  "version": "0.1.54",
   "description": "Official Zyphr SDK for Node.js, React, and React Native",
   "type": "module",
   "main": "./dist/index.cjs",

package/src/.openapi-generator/FILES

@@ -318,6 +318,7 @@ src/models/RenderTemplateRequest.ts
 src/models/ReorderWorkflowStepsRequest.ts
 src/models/ReplayWebhookEventsRequest.ts
 src/models/RequestMeta.ts
+src/models/ResendEmailVerificationRequest.ts
 src/models/ResetPasswordRequest.ts
 src/models/ResetPasswordResponse.ts
 src/models/ResubscribeRequest.ts

package/src/src/apis/AuthEmailVerificationApi.ts

@@ -18,6 +18,7 @@ import type {
   ApiError,
   ConfirmEmailVerificationRequest,
   ConfirmEmailVerificationResponse,
+  ResendEmailVerificationRequest,
   SendEmailVerificationRequest,
   SuccessResult,
 } from '../models/index';
@@ -28,6 +29,8 @@ import {
     ConfirmEmailVerificationRequestToJSON,
     ConfirmEmailVerificationResponseFromJSON,
     ConfirmEmailVerificationResponseToJSON,
+    ResendEmailVerificationRequestFromJSON,
+    ResendEmailVerificationRequestToJSON,
     SendEmailVerificationRequestFromJSON,
     SendEmailVerificationRequestToJSON,
     SuccessResultFromJSON,
@@ -38,8 +41,8 @@ export interface AuthEmailVerificationApiConfirmEmailVerificationOperationReques
     confirmEmailVerificationRequest: ConfirmEmailVerificationRequest;
 }
 
-export interface AuthEmailVerificationApiResendEmailVerificationRequest {
-    sendEmailVerificationRequest?: SendEmailVerificationRequest;
+export interface AuthEmailVerificationApiResendEmailVerificationOperationRequest {
+    resendEmailVerificationRequest?: ResendEmailVerificationRequest;
 }
 
 export interface AuthEmailVerificationApiSendEmailVerificationOperationRequest {
@@ -54,7 +57,7 @@ export interface AuthEmailVerificationApiSendEmailVerificationOperationRequest {
  */
 export interface AuthEmailVerificationApiInterface {
     /**
-     * Verify the user\'s email using the token from the verification email.
+     * Verify the user\'s email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user\'s verified state back and report that — correct whether or not the link already consumed the token.
      * @summary Confirm email verification
      * @param {ConfirmEmailVerificationRequest} confirmEmailVerificationRequest 
      * @param {*} [options] Override http request option.
@@ -64,7 +67,7 @@ export interface AuthEmailVerificationApiInterface {
     confirmEmailVerificationRaw(requestParameters: AuthEmailVerificationApiConfirmEmailVerificationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ConfirmEmailVerificationResponse>>;
 
     /**
-     * Verify the user\'s email using the token from the verification email.
+     * Verify the user\'s email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user\'s verified state back and report that — correct whether or not the link already consumed the token.
      * Confirm email verification
      */
     confirmEmailVerification(confirmEmailVerificationRequest: ConfirmEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ConfirmEmailVerificationResponse>;
@@ -72,21 +75,21 @@ export interface AuthEmailVerificationApiInterface {
     /**
      * Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
      * @summary Resend email verification
-     * @param {SendEmailVerificationRequest} [sendEmailVerificationRequest] 
+     * @param {ResendEmailVerificationRequest} [resendEmailVerificationRequest] 
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof AuthEmailVerificationApiInterface
      */
-    resendEmailVerificationRaw(requestParameters: AuthEmailVerificationApiResendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>>;
+    resendEmailVerificationRaw(requestParameters: AuthEmailVerificationApiResendEmailVerificationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>>;
 
     /**
      * Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
      * Resend email verification
      */
-    resendEmailVerification(sendEmailVerificationRequest?: SendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult>;
+    resendEmailVerification(resendEmailVerificationRequest?: ResendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult>;
 
     /**
-     * Send an email verification link to the authenticated user.
+     * Send an email verification link to the authenticated user. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user\'s `Authorization: Bearer` token. If the recipient is blocked by the application\'s `auth_email_mode=allowlist` gate, the request is still **accepted with 200** (mirroring `POST /auth/forgot-password`): no email is sent, and the suppression is recorded as a `messages` row (`status=suppressed`, `status_reason=recipient_not_allowlisted`) and an `email.suppressed` webhook. It is NOT a 500.
      * @summary Send email verification
      * @param {SendEmailVerificationRequest} [sendEmailVerificationRequest] 
      * @param {*} [options] Override http request option.
@@ -96,7 +99,7 @@ export interface AuthEmailVerificationApiInterface {
     sendEmailVerificationRaw(requestParameters: AuthEmailVerificationApiSendEmailVerificationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>>;
 
     /**
-     * Send an email verification link to the authenticated user.
+     * Send an email verification link to the authenticated user. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user\'s `Authorization: Bearer` token. If the recipient is blocked by the application\'s `auth_email_mode=allowlist` gate, the request is still **accepted with 200** (mirroring `POST /auth/forgot-password`): no email is sent, and the suppression is recorded as a `messages` row (`status=suppressed`, `status_reason=recipient_not_allowlisted`) and an `email.suppressed` webhook. It is NOT a 500.
      * Send email verification
      */
     sendEmailVerification(sendEmailVerificationRequest?: SendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult>;
@@ -109,7 +112,7 @@ export interface AuthEmailVerificationApiInterface {
 export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEmailVerificationApiInterface {
 
     /**
-     * Verify the user\'s email using the token from the verification email.
+     * Verify the user\'s email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user\'s verified state back and report that — correct whether or not the link already consumed the token.
      * Confirm email verification
      */
     async confirmEmailVerificationRaw(requestParameters: AuthEmailVerificationApiConfirmEmailVerificationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ConfirmEmailVerificationResponse>> {
@@ -146,7 +149,7 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
     }
 
     /**
-     * Verify the user\'s email using the token from the verification email.
+     * Verify the user\'s email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user\'s verified state back and report that — correct whether or not the link already consumed the token.
      * Confirm email verification
      */
     async confirmEmailVerification(confirmEmailVerificationRequest: ConfirmEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ConfirmEmailVerificationResponse> {
@@ -158,7 +161,7 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
      * Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
      * Resend email verification
      */
-    async resendEmailVerificationRaw(requestParameters: AuthEmailVerificationApiResendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>> {
+    async resendEmailVerificationRaw(requestParameters: AuthEmailVerificationApiResendEmailVerificationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>> {
         const queryParameters: any = {};
 
         const headerParameters: runtime.HTTPHeaders = {};
@@ -186,7 +189,7 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
             method: 'POST',
             headers: headerParameters,
             query: queryParameters,
-            body: SendEmailVerificationRequestToJSON(requestParameters['sendEmailVerificationRequest']),
+            body: ResendEmailVerificationRequestToJSON(requestParameters['resendEmailVerificationRequest']),
         }, initOverrides);
 
         return new runtime.JSONApiResponse(response, (jsonValue) => SuccessResultFromJSON(jsonValue));
@@ -196,13 +199,13 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
      * Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
      * Resend email verification
      */
-    async resendEmailVerification(sendEmailVerificationRequest?: SendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult> {
-        const response = await this.resendEmailVerificationRaw({ sendEmailVerificationRequest: sendEmailVerificationRequest }, initOverrides);
+    async resendEmailVerification(resendEmailVerificationRequest?: ResendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult> {
+        const response = await this.resendEmailVerificationRaw({ resendEmailVerificationRequest: resendEmailVerificationRequest }, initOverrides);
         return await response.value();
     }
 
     /**
-     * Send an email verification link to the authenticated user.
+     * Send an email verification link to the authenticated user. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user\'s `Authorization: Bearer` token. If the recipient is blocked by the application\'s `auth_email_mode=allowlist` gate, the request is still **accepted with 200** (mirroring `POST /auth/forgot-password`): no email is sent, and the suppression is recorded as a `messages` row (`status=suppressed`, `status_reason=recipient_not_allowlisted`) and an `email.suppressed` webhook. It is NOT a 500.
      * Send email verification
      */
     async sendEmailVerificationRaw(requestParameters: AuthEmailVerificationApiSendEmailVerificationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>> {
@@ -240,7 +243,7 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
     }
 
     /**
-     * Send an email verification link to the authenticated user.
+     * Send an email verification link to the authenticated user. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user\'s `Authorization: Bearer` token. If the recipient is blocked by the application\'s `auth_email_mode=allowlist` gate, the request is still **accepted with 200** (mirroring `POST /auth/forgot-password`): no email is sent, and the suppression is recorded as a `messages` row (`status=suppressed`, `status_reason=recipient_not_allowlisted`) and an `email.suppressed` webhook. It is NOT a 500.
      * Send email verification
      */
     async sendEmailVerification(sendEmailVerificationRequest?: SendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult> {

package/src/src/models/ApplicationSelf.ts

@@ -59,6 +59,12 @@ export interface ApplicationSelf {
      * @memberof ApplicationSelf
      */
     authEmailMode: ApplicationSelfAuthEmailModeEnum;
+    /**
+     * When true (sc-7680), passwords found in the HaveIBeenPwned breach corpus are rejected at register/reset (and returned `valid:false` by `/auth/password-strength`). When false (default), breach info is advisory only. Fail-open: a breach-source outage never blocks auth.
+     * @type {boolean}
+     * @memberof ApplicationSelf
+     */
+    passwordDisallowBreached: boolean;
 }
 
 
@@ -101,6 +107,7 @@ export function instanceOfApplicationSelf(value: object): value is ApplicationSe
     if (!('signingAlgorithm' in value) || value['signingAlgorithm'] === undefined) return false;
     if (!('testRecipients' in value) || value['testRecipients'] === undefined) return false;
     if (!('authEmailMode' in value) || value['authEmailMode'] === undefined) return false;
+    if (!('passwordDisallowBreached' in value) || value['passwordDisallowBreached'] === undefined) return false;
     return true;
 }
 
@@ -120,6 +127,7 @@ export function ApplicationSelfFromJSONTyped(json: any, ignoreDiscriminator: boo
         'signingAlgorithm': json['signing_algorithm'],
         'testRecipients': json['test_recipients'],
         'authEmailMode': json['auth_email_mode'],
+        'passwordDisallowBreached': json['password_disallow_breached'],
     };
 }
 
@@ -140,6 +148,7 @@ export function ApplicationSelfToJSONTyped(value?: ApplicationSelf | null, ignor
         'signing_algorithm': value['signingAlgorithm'],
         'test_recipients': value['testRecipients'],
         'auth_email_mode': value['authEmailMode'],
+        'password_disallow_breached': value['passwordDisallowBreached'],
     };
 }
 

package/src/src/models/ConfirmEmailVerificationResponseData.ts

@@ -31,6 +31,12 @@ export interface ConfirmEmailVerificationResponseData {
      * @memberof ConfirmEmailVerificationResponseData
      */
     email?: string;
+    /**
+     * True when the address was already verified (the emailed link consumed the token on click). Still a 200 — an idempotent success, not an error (sc-7721).
+     * @type {boolean}
+     * @memberof ConfirmEmailVerificationResponseData
+     */
+    alreadyVerified?: boolean;
 }
 
 /**
@@ -52,6 +58,7 @@ export function ConfirmEmailVerificationResponseDataFromJSONTyped(json: any, ign
         
         'success': json['success'] == null ? undefined : json['success'],
         'email': json['email'] == null ? undefined : json['email'],
+        'alreadyVerified': json['already_verified'] == null ? undefined : json['already_verified'],
     };
 }
 
@@ -68,6 +75,7 @@ export function ConfirmEmailVerificationResponseDataToJSONTyped(value?: ConfirmE
         
         'success': value['success'],
         'email': value['email'],
+        'already_verified': value['alreadyVerified'],
     };
 }
 

package/src/src/models/ResendEmailVerificationRequest.ts

@@ -0,0 +1,65 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Zyphr API
+ * Zyphr is a multi-channel notification platform that enables developers to send emails, push notifications, SMS, and in-app messages through a unified API.  ## Authentication  All API requests require authentication using an API key. Include your API key in the `X-API-Key` header:  ``` X-API-Key: zy_live_xxxxxxxxxxxx ```  API keys can be created in the Zyphr Dashboard. Use `zy_test_*` keys for testing and `zy_live_*` keys for production.  ## Rate Limiting  The API implements rate limiting to ensure fair usage. Rate limit information is included in response headers:  - `X-RateLimit-Limit`: Maximum requests per window - `X-RateLimit-Remaining`: Remaining requests in current window - `X-RateLimit-Reset`: Unix timestamp when the window resets  ## Account Sending Status  Every authenticated response carries the account\'s current sending state so you can surface it in your own tooling without a separate call:  - `X-Account-Sending-Status`: `active`, `throttled`, or `frozen` - `X-Account-Sending-Status-Reason`: human-readable reason (present only when the status is `throttled` or `frozen`)  This header is informational and non-blocking on non-send endpoints (reads, billing, and deliverability stay available). Send-capable endpoints additionally enforce the state: a frozen account receives `403 account_frozen` and a throttled account receives `429 account_throttled`, both with the reason in the error message.  ## Errors  All errors follow a consistent format:  ```json {   \"error\": {     \"code\": \"error_code\",     \"message\": \"Human readable message\",     \"details\": {}   },   \"meta\": {     \"request_id\": \"req_xxxx\"   } } ```
+ *
+ * The version of the OpenAPI document: 1.0.0
+ * Contact: support@zyphr.dev
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+/**
+ * 
+ * @export
+ * @interface ResendEmailVerificationRequest
+ */
+export interface ResendEmailVerificationRequest {
+    /**
+     * URL to redirect to after verification
+     * @type {string}
+     * @memberof ResendEmailVerificationRequest
+     */
+    redirectUrl?: string;
+}
+
+/**
+ * Check if a given object implements the ResendEmailVerificationRequest interface.
+ */
+export function instanceOfResendEmailVerificationRequest(value: object): value is ResendEmailVerificationRequest {
+    return true;
+}
+
+export function ResendEmailVerificationRequestFromJSON(json: any): ResendEmailVerificationRequest {
+    return ResendEmailVerificationRequestFromJSONTyped(json, false);
+}
+
+export function ResendEmailVerificationRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): ResendEmailVerificationRequest {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'redirectUrl': json['redirect_url'] == null ? undefined : json['redirect_url'],
+    };
+}
+
+export function ResendEmailVerificationRequestToJSON(json: any): ResendEmailVerificationRequest {
+    return ResendEmailVerificationRequestToJSONTyped(json, false);
+}
+
+export function ResendEmailVerificationRequestToJSONTyped(value?: ResendEmailVerificationRequest | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'redirect_url': value['redirectUrl'],
+    };
+}
+

package/src/src/models/SendEmailVerificationRequest.ts

@@ -20,7 +20,7 @@ import { mapValues } from '../runtime';
  */
 export interface SendEmailVerificationRequest {
     /**
-     * URL to redirect to after verification
+     * URL to redirect to after verification (snake_case `redirect_url` — a camelCase `redirectUrl` is ignored and the hosted verification page is used instead). Must match one of the application's configured redirect URIs.
      * @type {string}
      * @memberof SendEmailVerificationRequest
      */

package/src/src/models/SetSelfApplicationTestRecipientsRequest.ts

@@ -14,7 +14,7 @@
 
 import { mapValues } from '../runtime';
 /**
- * Provide test_recipients and/or auth_email_mode. Omitting one leaves that value unchanged; sending neither is a 400.
+ * Provide any of test_recipients, auth_email_mode, or password_disallow_breached. Omitting one leaves that value unchanged; sending none is a 400. Unknown fields are rejected (400).
  * @export
  * @interface SetSelfApplicationTestRecipientsRequest
  */
@@ -31,6 +31,12 @@ export interface SetSelfApplicationTestRecipientsRequest {
      * @memberof SetSelfApplicationTestRecipientsRequest
      */
     authEmailMode?: SetSelfApplicationTestRecipientsRequestAuthEmailModeEnum;
+    /**
+     * Optional (sc-7680/sc-7697). When true, reject HIBP-breached passwords at register/reset. Omit to leave unchanged.
+     * @type {boolean}
+     * @memberof SetSelfApplicationTestRecipientsRequest
+     */
+    passwordDisallowBreached?: boolean;
 }
 
 
@@ -63,6 +69,7 @@ export function SetSelfApplicationTestRecipientsRequestFromJSONTyped(json: any,
         
         'testRecipients': json['test_recipients'] == null ? undefined : json['test_recipients'],
         'authEmailMode': json['auth_email_mode'] == null ? undefined : json['auth_email_mode'],
+        'passwordDisallowBreached': json['password_disallow_breached'] == null ? undefined : json['password_disallow_breached'],
     };
 }
 
@@ -79,6 +86,7 @@ export function SetSelfApplicationTestRecipientsRequestToJSONTyped(value?: SetSe
         
         'test_recipients': value['testRecipients'],
         'auth_email_mode': value['authEmailMode'],
+        'password_disallow_breached': value['passwordDisallowBreached'],
     };
 }
 

package/src/src/models/index.ts

@@ -277,6 +277,7 @@ export * from './RenderTemplateRequest';
 export * from './ReorderWorkflowStepsRequest';
 export * from './ReplayWebhookEventsRequest';
 export * from './RequestMeta';
+export * from './ResendEmailVerificationRequest';
 export * from './ResetPasswordRequest';
 export * from './ResetPasswordResponse';
 export * from './ResubscribeRequest';