@zyphr-dev/node-sdk 0.1.53 → 0.1.55

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zyphr-dev/node-sdk",
-  "version": "0.1.53",
+  "version": "0.1.55",
   "description": "Official Zyphr SDK for Node.js, React, and React Native",
   "type": "module",
   "main": "./dist/index.cjs",

package/src/.openapi-generator/FILES

@@ -318,6 +318,7 @@ src/models/RenderTemplateRequest.ts
 src/models/ReorderWorkflowStepsRequest.ts
 src/models/ReplayWebhookEventsRequest.ts
 src/models/RequestMeta.ts
+src/models/ResendEmailVerificationRequest.ts
 src/models/ResetPasswordRequest.ts
 src/models/ResetPasswordResponse.ts
 src/models/ResubscribeRequest.ts
@@ -522,9 +523,6 @@ src/models/WebhookIpsResponseData.ts
 src/models/WebhookJobResponse.ts
 src/models/WebhookListResponse.ts
 src/models/WebhookMetricsResponse.ts
-src/models/WebhookRegion.ts
-src/models/WebhookRegionsResponse.ts
-src/models/WebhookRegionsResponseData.ts
 src/models/WebhookReplayResponse.ts
 src/models/WebhookResponse.ts
 src/models/WebhookSecretRotateResponse.ts

package/src/client.ts

@@ -34,6 +34,7 @@ import {
   DevicesApi,
   DomainsApi,
   UtilityApi,
+  WorkflowsApi,
   EmailsApi,
   InboundEmailApi,
   InboxApi,
@@ -103,6 +104,15 @@ export class Zyphr {
   /** Publishable-key-safe utilities: password policy + pre-submit strength check. */
   readonly utility: UtilityApi;
   readonly domains: DomainsApi;
+  /**
+   * Multi-step workflow definitions and triggering (sc-7926).
+   *
+   * All 12 operations are API-key authenticated with dedicated
+   * `workflows:read` / `workflows:write` / `workflows:execute` scopes, so this
+   * is deliberate public surface. It was generated but never wired onto the
+   * facade, which made the documented `zyphr.workflows.*` calls throw.
+   */
+  readonly workflows: WorkflowsApi;
   /** Inbound (received) email — read access. Requires the `email:read` scope. */
   readonly inbound: InboundEmailApi;
 
@@ -162,6 +172,7 @@ export class Zyphr {
     this.devices = new DevicesApi(config);
     this.utility = new UtilityApi(config);
     this.domains = new DomainsApi(config);
+    this.workflows = new WorkflowsApi(config);
     this.inbound = new InboundEmailApi(config);
 
     this.waas = {

package/src/src/apis/AuthApplicationApi.ts

@@ -28,6 +28,11 @@ import {
     SetSelfApplicationTestRecipientsRequestToJSON,
 } from '../models/index';
 
+export interface AuthApplicationApiExportEndUserDataRequest {
+    id: string;
+    userId: string;
+}
+
 export interface AuthApplicationApiSetSelfApplicationTestRecipientsOperationRequest {
     setSelfApplicationTestRecipientsRequest: SetSelfApplicationTestRecipientsRequest;
 }
@@ -39,6 +44,23 @@ export interface AuthApplicationApiSetSelfApplicationTestRecipientsOperationRequ
  * @interface AuthApplicationApiInterface
  */
 export interface AuthApplicationApiInterface {
+    /**
+     * Returns a machine-readable JSON bundle of everything stored about one end user, for answering a GDPR Art. 15 (access) or Art. 20 (portability) request.  Zyphr is a **processor**: we do not answer data subjects directly. This endpoint gives you, the controller, the data needed to respond to your own end user.  **Credentials are deliberately excluded** and are listed in `export_metadata.excluded`: password hashes, session refresh-token hashes, MFA secrets, OAuth access/refresh tokens and WebAuthn public keys. These are authentication artifacts rather than personal data about the subject, and including them would turn this endpoint into a credential-exfiltration path.  Message history is capped at the 1,000 most recent messages; `export_metadata.message_history_truncated` reports whether the cap was hit. 
+     * @summary Export all data held about an end user
+     * @param {string} id Application ID
+     * @param {string} userId End user ID
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthApplicationApiInterface
+     */
+    exportEndUserDataRaw(requestParameters: AuthApplicationApiExportEndUserDataRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+
+    /**
+     * Returns a machine-readable JSON bundle of everything stored about one end user, for answering a GDPR Art. 15 (access) or Art. 20 (portability) request.  Zyphr is a **processor**: we do not answer data subjects directly. This endpoint gives you, the controller, the data needed to respond to your own end user.  **Credentials are deliberately excluded** and are listed in `export_metadata.excluded`: password hashes, session refresh-token hashes, MFA secrets, OAuth access/refresh tokens and WebAuthn public keys. These are authentication artifacts rather than personal data about the subject, and including them would turn this endpoint into a credential-exfiltration path.  Message history is capped at the 1,000 most recent messages; `export_metadata.message_history_truncated` reports whether the cap was hit. 
+     * Export all data held about an end user
+     */
+    exportEndUserData(id: string, userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+
     /**
      * Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment\'s mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
      * @summary Get the authenticating application
@@ -77,6 +99,47 @@ export interface AuthApplicationApiInterface {
  */
 export class AuthApplicationApi extends runtime.BaseAPI implements AuthApplicationApiInterface {
 
+    /**
+     * Returns a machine-readable JSON bundle of everything stored about one end user, for answering a GDPR Art. 15 (access) or Art. 20 (portability) request.  Zyphr is a **processor**: we do not answer data subjects directly. This endpoint gives you, the controller, the data needed to respond to your own end user.  **Credentials are deliberately excluded** and are listed in `export_metadata.excluded`: password hashes, session refresh-token hashes, MFA secrets, OAuth access/refresh tokens and WebAuthn public keys. These are authentication artifacts rather than personal data about the subject, and including them would turn this endpoint into a credential-exfiltration path.  Message history is capped at the 1,000 most recent messages; `export_metadata.message_history_truncated` reports whether the cap was hit. 
+     * Export all data held about an end user
+     */
+    async exportEndUserDataRaw(requestParameters: AuthApplicationApiExportEndUserDataRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling exportEndUserData().'
+            );
+        }
+
+        if (requestParameters['userId'] == null) {
+            throw new runtime.RequiredError(
+                'userId',
+                'Required parameter "userId" was null or undefined when calling exportEndUserData().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        const response = await this.request({
+            path: `/v1/applications/{id}/users/{userId}/export`.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id']))).replace(`{${"userId"}}`, encodeURIComponent(String(requestParameters['userId']))),
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Returns a machine-readable JSON bundle of everything stored about one end user, for answering a GDPR Art. 15 (access) or Art. 20 (portability) request.  Zyphr is a **processor**: we do not answer data subjects directly. This endpoint gives you, the controller, the data needed to respond to your own end user.  **Credentials are deliberately excluded** and are listed in `export_metadata.excluded`: password hashes, session refresh-token hashes, MFA secrets, OAuth access/refresh tokens and WebAuthn public keys. These are authentication artifacts rather than personal data about the subject, and including them would turn this endpoint into a credential-exfiltration path.  Message history is capped at the 1,000 most recent messages; `export_metadata.message_history_truncated` reports whether the cap was hit. 
+     * Export all data held about an end user
+     */
+    async exportEndUserData(id: string, userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.exportEndUserDataRaw({ id: id, userId: userId }, initOverrides);
+    }
+
     /**
      * Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment\'s mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
      * Get the authenticating application

package/src/src/apis/AuthEmailVerificationApi.ts

@@ -18,6 +18,7 @@ import type {
   ApiError,
   ConfirmEmailVerificationRequest,
   ConfirmEmailVerificationResponse,
+  ResendEmailVerificationRequest,
   SendEmailVerificationRequest,
   SuccessResult,
 } from '../models/index';
@@ -28,6 +29,8 @@ import {
     ConfirmEmailVerificationRequestToJSON,
     ConfirmEmailVerificationResponseFromJSON,
     ConfirmEmailVerificationResponseToJSON,
+    ResendEmailVerificationRequestFromJSON,
+    ResendEmailVerificationRequestToJSON,
     SendEmailVerificationRequestFromJSON,
     SendEmailVerificationRequestToJSON,
     SuccessResultFromJSON,
@@ -38,8 +41,8 @@ export interface AuthEmailVerificationApiConfirmEmailVerificationOperationReques
     confirmEmailVerificationRequest: ConfirmEmailVerificationRequest;
 }
 
-export interface AuthEmailVerificationApiResendEmailVerificationRequest {
-    sendEmailVerificationRequest?: SendEmailVerificationRequest;
+export interface AuthEmailVerificationApiResendEmailVerificationOperationRequest {
+    resendEmailVerificationRequest?: ResendEmailVerificationRequest;
 }
 
 export interface AuthEmailVerificationApiSendEmailVerificationOperationRequest {
@@ -54,7 +57,7 @@ export interface AuthEmailVerificationApiSendEmailVerificationOperationRequest {
  */
 export interface AuthEmailVerificationApiInterface {
     /**
-     * Verify the user\'s email using the token from the verification email.
+     * Verify the user\'s email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user\'s verified state back and report that — correct whether or not the link already consumed the token.
      * @summary Confirm email verification
      * @param {ConfirmEmailVerificationRequest} confirmEmailVerificationRequest 
      * @param {*} [options] Override http request option.
@@ -64,7 +67,7 @@ export interface AuthEmailVerificationApiInterface {
     confirmEmailVerificationRaw(requestParameters: AuthEmailVerificationApiConfirmEmailVerificationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ConfirmEmailVerificationResponse>>;
 
     /**
-     * Verify the user\'s email using the token from the verification email.
+     * Verify the user\'s email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user\'s verified state back and report that — correct whether or not the link already consumed the token.
      * Confirm email verification
      */
     confirmEmailVerification(confirmEmailVerificationRequest: ConfirmEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ConfirmEmailVerificationResponse>;
@@ -72,21 +75,21 @@ export interface AuthEmailVerificationApiInterface {
     /**
      * Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
      * @summary Resend email verification
-     * @param {SendEmailVerificationRequest} [sendEmailVerificationRequest] 
+     * @param {ResendEmailVerificationRequest} [resendEmailVerificationRequest] 
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof AuthEmailVerificationApiInterface
      */
-    resendEmailVerificationRaw(requestParameters: AuthEmailVerificationApiResendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>>;
+    resendEmailVerificationRaw(requestParameters: AuthEmailVerificationApiResendEmailVerificationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>>;
 
     /**
      * Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
      * Resend email verification
      */
-    resendEmailVerification(sendEmailVerificationRequest?: SendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult>;
+    resendEmailVerification(resendEmailVerificationRequest?: ResendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult>;
 
     /**
-     * Send an email verification link to the authenticated user.
+     * Send an email verification link to the authenticated user. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user\'s `Authorization: Bearer` token. If the recipient is blocked by the application\'s `auth_email_mode=allowlist` gate, the request is still **accepted with 200** (mirroring `POST /auth/forgot-password`): no email is sent, and the suppression is recorded as a `messages` row (`status=suppressed`, `status_reason=recipient_not_allowlisted`) and an `email.suppressed` webhook. It is NOT a 500.
      * @summary Send email verification
      * @param {SendEmailVerificationRequest} [sendEmailVerificationRequest] 
      * @param {*} [options] Override http request option.
@@ -96,7 +99,7 @@ export interface AuthEmailVerificationApiInterface {
     sendEmailVerificationRaw(requestParameters: AuthEmailVerificationApiSendEmailVerificationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>>;
 
     /**
-     * Send an email verification link to the authenticated user.
+     * Send an email verification link to the authenticated user. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user\'s `Authorization: Bearer` token. If the recipient is blocked by the application\'s `auth_email_mode=allowlist` gate, the request is still **accepted with 200** (mirroring `POST /auth/forgot-password`): no email is sent, and the suppression is recorded as a `messages` row (`status=suppressed`, `status_reason=recipient_not_allowlisted`) and an `email.suppressed` webhook. It is NOT a 500.
      * Send email verification
      */
     sendEmailVerification(sendEmailVerificationRequest?: SendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult>;
@@ -109,7 +112,7 @@ export interface AuthEmailVerificationApiInterface {
 export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEmailVerificationApiInterface {
 
     /**
-     * Verify the user\'s email using the token from the verification email.
+     * Verify the user\'s email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user\'s verified state back and report that — correct whether or not the link already consumed the token.
      * Confirm email verification
      */
     async confirmEmailVerificationRaw(requestParameters: AuthEmailVerificationApiConfirmEmailVerificationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ConfirmEmailVerificationResponse>> {
@@ -146,7 +149,7 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
     }
 
     /**
-     * Verify the user\'s email using the token from the verification email.
+     * Verify the user\'s email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user\'s verified state back and report that — correct whether or not the link already consumed the token.
      * Confirm email verification
      */
     async confirmEmailVerification(confirmEmailVerificationRequest: ConfirmEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ConfirmEmailVerificationResponse> {
@@ -158,7 +161,7 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
      * Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
      * Resend email verification
      */
-    async resendEmailVerificationRaw(requestParameters: AuthEmailVerificationApiResendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>> {
+    async resendEmailVerificationRaw(requestParameters: AuthEmailVerificationApiResendEmailVerificationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>> {
         const queryParameters: any = {};
 
         const headerParameters: runtime.HTTPHeaders = {};
@@ -186,7 +189,7 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
             method: 'POST',
             headers: headerParameters,
             query: queryParameters,
-            body: SendEmailVerificationRequestToJSON(requestParameters['sendEmailVerificationRequest']),
+            body: ResendEmailVerificationRequestToJSON(requestParameters['resendEmailVerificationRequest']),
         }, initOverrides);
 
         return new runtime.JSONApiResponse(response, (jsonValue) => SuccessResultFromJSON(jsonValue));
@@ -196,13 +199,13 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
      * Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
      * Resend email verification
      */
-    async resendEmailVerification(sendEmailVerificationRequest?: SendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult> {
-        const response = await this.resendEmailVerificationRaw({ sendEmailVerificationRequest: sendEmailVerificationRequest }, initOverrides);
+    async resendEmailVerification(resendEmailVerificationRequest?: ResendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult> {
+        const response = await this.resendEmailVerificationRaw({ resendEmailVerificationRequest: resendEmailVerificationRequest }, initOverrides);
         return await response.value();
     }
 
     /**
-     * Send an email verification link to the authenticated user.
+     * Send an email verification link to the authenticated user. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user\'s `Authorization: Bearer` token. If the recipient is blocked by the application\'s `auth_email_mode=allowlist` gate, the request is still **accepted with 200** (mirroring `POST /auth/forgot-password`): no email is sent, and the suppression is recorded as a `messages` row (`status=suppressed`, `status_reason=recipient_not_allowlisted`) and an `email.suppressed` webhook. It is NOT a 500.
      * Send email verification
      */
     async sendEmailVerificationRaw(requestParameters: AuthEmailVerificationApiSendEmailVerificationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>> {
@@ -240,7 +243,7 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
     }
 
     /**
-     * Send an email verification link to the authenticated user.
+     * Send an email verification link to the authenticated user. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user\'s `Authorization: Bearer` token. If the recipient is blocked by the application\'s `auth_email_mode=allowlist` gate, the request is still **accepted with 200** (mirroring `POST /auth/forgot-password`): no email is sent, and the suppression is recorded as a `messages` row (`status=suppressed`, `status_reason=recipient_not_allowlisted`) and an `email.suppressed` webhook. It is NOT a 500.
      * Send email verification
      */
     async sendEmailVerification(sendEmailVerificationRequest?: SendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult> {

package/src/src/apis/EmailsApi.ts

@@ -167,7 +167,7 @@ export interface EmailsApiInterface {
     sendBatchEmail(sendBatchEmailRequest: SendBatchEmailRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SendBatchEmailResponse>;
 
     /**
-     * Queue an email for delivery. The email is processed asynchronously and you\'ll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`. 
+     * Queue an email for delivery. The email is processed asynchronously and you\'ll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`.  **CAN-SPAM compliance — actions required from you:**  - **Set `classification`** to `transactional` or `marketing`. Unclassified is   treated as marketing, the stricter reading. Transactional mail (password   resets, receipts) is exempt from the opt-out and postal-address requirements. - **Set your postal address** in project settings. Commercial email must carry a   valid physical postal address — the most commonly missed CAN-SPAM element.   Marketing sends without one are flagged. - **Include an unsubscribe mechanism** on commercial email. Zyphr enforces   suppression automatically once someone opts out, but the link itself is yours   to include.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
      * @summary Send an email
      * @param {SendEmailRequest} sendEmailRequest 
      * @param {*} [options] Override http request option.
@@ -177,7 +177,7 @@ export interface EmailsApiInterface {
     sendEmailRaw(requestParameters: EmailsApiSendEmailOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SendEmailResponse>>;
 
     /**
-     * Queue an email for delivery. The email is processed asynchronously and you\'ll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`. 
+     * Queue an email for delivery. The email is processed asynchronously and you\'ll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`.  **CAN-SPAM compliance — actions required from you:**  - **Set `classification`** to `transactional` or `marketing`. Unclassified is   treated as marketing, the stricter reading. Transactional mail (password   resets, receipts) is exempt from the opt-out and postal-address requirements. - **Set your postal address** in project settings. Commercial email must carry a   valid physical postal address — the most commonly missed CAN-SPAM element.   Marketing sends without one are flagged. - **Include an unsubscribe mechanism** on commercial email. Zyphr enforces   suppression automatically once someone opts out, but the link itself is yours   to include.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
      * Send an email
      */
     sendEmail(sendEmailRequest: SendEmailRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SendEmailResponse>;
@@ -397,7 +397,7 @@ export class EmailsApi extends runtime.BaseAPI implements EmailsApiInterface {
     }
 
     /**
-     * Queue an email for delivery. The email is processed asynchronously and you\'ll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`. 
+     * Queue an email for delivery. The email is processed asynchronously and you\'ll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`.  **CAN-SPAM compliance — actions required from you:**  - **Set `classification`** to `transactional` or `marketing`. Unclassified is   treated as marketing, the stricter reading. Transactional mail (password   resets, receipts) is exempt from the opt-out and postal-address requirements. - **Set your postal address** in project settings. Commercial email must carry a   valid physical postal address — the most commonly missed CAN-SPAM element.   Marketing sends without one are flagged. - **Include an unsubscribe mechanism** on commercial email. Zyphr enforces   suppression automatically once someone opts out, but the link itself is yours   to include.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
      * Send an email
      */
     async sendEmailRaw(requestParameters: EmailsApiSendEmailOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SendEmailResponse>> {
@@ -430,7 +430,7 @@ export class EmailsApi extends runtime.BaseAPI implements EmailsApiInterface {
     }
 
     /**
-     * Queue an email for delivery. The email is processed asynchronously and you\'ll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`. 
+     * Queue an email for delivery. The email is processed asynchronously and you\'ll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`.  **CAN-SPAM compliance — actions required from you:**  - **Set `classification`** to `transactional` or `marketing`. Unclassified is   treated as marketing, the stricter reading. Transactional mail (password   resets, receipts) is exempt from the opt-out and postal-address requirements. - **Set your postal address** in project settings. Commercial email must carry a   valid physical postal address — the most commonly missed CAN-SPAM element.   Marketing sends without one are flagged. - **Include an unsubscribe mechanism** on commercial email. Zyphr enforces   suppression automatically once someone opts out, but the link itself is yours   to include.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
      * Send an email
      */
     async sendEmail(sendEmailRequest: SendEmailRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SendEmailResponse> {

package/src/src/apis/SMSApi.ts

@@ -141,6 +141,21 @@ export interface SMSApiInterface {
      */
     getSmsConfig(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SmsConfigResponse>;
 
+    /**
+     * Returns the URL to configure in your SMS provider so STOP/opt-out replies reach Zyphr. The token is generated on first request and is stable thereafter.  **This is required for TCPA compliance.** Until your provider is pointed at this URL, opt-out replies stop at the provider and never reach us — from Zyphr\'s side the recipient never opted out, and sends continue.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
+     * @summary Get the inbound SMS webhook URL
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof SMSApiInterface
+     */
+    getSmsInboundWebhookRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+
+    /**
+     * Returns the URL to configure in your SMS provider so STOP/opt-out replies reach Zyphr. The token is generated on first request and is stable thereafter.  **This is required for TCPA compliance.** Until your provider is pointed at this URL, opt-out replies stop at the provider and never reach us — from Zyphr\'s side the recipient never opted out, and sends continue.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
+     * Get the inbound SMS webhook URL
+     */
+    getSmsInboundWebhook(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+
     /**
      * List SMS messages for the account with optional filtering and pagination.
      * @summary List SMS messages
@@ -177,7 +192,7 @@ export interface SMSApiInterface {
     sendBatchSms(sendBatchSmsRequest: SendBatchSmsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SendBatchSmsResponse>;
 
     /**
-     * Send a single SMS text message. Supports subscriber preference checks and scheduling.
+     * Send a single SMS text message. Supports subscriber preference checks and scheduling.  **TCPA compliance — actions required from you:**  - **Configure the inbound webhook.** Zyphr only processes STOP/opt-out replies   if your SMS provider is pointed at our inbound endpoint. Until you do this,   opt-outs never reach us and we will keep delivering. See   [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). - **Pass `recipient_timezone`** (IANA, e.g. `America/New_York`) so quiet hours   (8am-9pm recipient-local) can be enforced. Without it we send and record that   quiet hours could not be evaluated. We deliberately do not infer a timezone   from the area code — people keep numbers when they move. - **Record consent** for marketing sends. Marketing requires prior express   *written* consent; `express` consent covers transactional only. With no record   on file we deliver and flag it, which is a gap in your evidence, not permission. - **Set `classification`.** Unclassified messages are treated as marketing, the   stricter reading. 
      * @summary Send an SMS message
      * @param {SendSmsRequest} sendSmsRequest 
      * @param {*} [options] Override http request option.
@@ -187,7 +202,7 @@ export interface SMSApiInterface {
     sendSmsRaw(requestParameters: SMSApiSendSmsOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SendSmsResponse>>;
 
     /**
-     * Send a single SMS text message. Supports subscriber preference checks and scheduling.
+     * Send a single SMS text message. Supports subscriber preference checks and scheduling.  **TCPA compliance — actions required from you:**  - **Configure the inbound webhook.** Zyphr only processes STOP/opt-out replies   if your SMS provider is pointed at our inbound endpoint. Until you do this,   opt-outs never reach us and we will keep delivering. See   [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). - **Pass `recipient_timezone`** (IANA, e.g. `America/New_York`) so quiet hours   (8am-9pm recipient-local) can be enforced. Without it we send and record that   quiet hours could not be evaluated. We deliberately do not infer a timezone   from the area code — people keep numbers when they move. - **Record consent** for marketing sends. Marketing requires prior express   *written* consent; `express` consent covers transactional only. With no record   on file we deliver and flag it, which is a gap in your evidence, not permission. - **Set `classification`.** Unclassified messages are treated as marketing, the   stricter reading. 
      * Send an SMS message
      */
     sendSms(sendSmsRequest: SendSmsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SendSmsResponse>;
@@ -349,6 +364,37 @@ export class SMSApi extends runtime.BaseAPI implements SMSApiInterface {
         return await response.value();
     }
 
+    /**
+     * Returns the URL to configure in your SMS provider so STOP/opt-out replies reach Zyphr. The token is generated on first request and is stable thereafter.  **This is required for TCPA compliance.** Until your provider is pointed at this URL, opt-out replies stop at the provider and never reach us — from Zyphr\'s side the recipient never opted out, and sends continue.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
+     * Get the inbound SMS webhook URL
+     */
+    async getSmsInboundWebhookRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-API-Key"] = await this.configuration.apiKey("X-API-Key"); // ApiKeyAuth authentication
+        }
+
+        const response = await this.request({
+            path: `/sms/inbound-webhook`,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Returns the URL to configure in your SMS provider so STOP/opt-out replies reach Zyphr. The token is generated on first request and is stable thereafter.  **This is required for TCPA compliance.** Until your provider is pointed at this URL, opt-out replies stop at the provider and never reach us — from Zyphr\'s side the recipient never opted out, and sends continue.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
+     * Get the inbound SMS webhook URL
+     */
+    async getSmsInboundWebhook(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.getSmsInboundWebhookRaw(initOverrides);
+    }
+
     /**
      * List SMS messages for the account with optional filtering and pagination.
      * List SMS messages
@@ -440,7 +486,7 @@ export class SMSApi extends runtime.BaseAPI implements SMSApiInterface {
     }
 
     /**
-     * Send a single SMS text message. Supports subscriber preference checks and scheduling.
+     * Send a single SMS text message. Supports subscriber preference checks and scheduling.  **TCPA compliance — actions required from you:**  - **Configure the inbound webhook.** Zyphr only processes STOP/opt-out replies   if your SMS provider is pointed at our inbound endpoint. Until you do this,   opt-outs never reach us and we will keep delivering. See   [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). - **Pass `recipient_timezone`** (IANA, e.g. `America/New_York`) so quiet hours   (8am-9pm recipient-local) can be enforced. Without it we send and record that   quiet hours could not be evaluated. We deliberately do not infer a timezone   from the area code — people keep numbers when they move. - **Record consent** for marketing sends. Marketing requires prior express   *written* consent; `express` consent covers transactional only. With no record   on file we deliver and flag it, which is a gap in your evidence, not permission. - **Set `classification`.** Unclassified messages are treated as marketing, the   stricter reading. 
      * Send an SMS message
      */
     async sendSmsRaw(requestParameters: SMSApiSendSmsOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SendSmsResponse>> {
@@ -473,7 +519,7 @@ export class SMSApi extends runtime.BaseAPI implements SMSApiInterface {
     }
 
     /**
-     * Send a single SMS text message. Supports subscriber preference checks and scheduling.
+     * Send a single SMS text message. Supports subscriber preference checks and scheduling.  **TCPA compliance — actions required from you:**  - **Configure the inbound webhook.** Zyphr only processes STOP/opt-out replies   if your SMS provider is pointed at our inbound endpoint. Until you do this,   opt-outs never reach us and we will keep delivering. See   [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). - **Pass `recipient_timezone`** (IANA, e.g. `America/New_York`) so quiet hours   (8am-9pm recipient-local) can be enforced. Without it we send and record that   quiet hours could not be evaluated. We deliberately do not infer a timezone   from the area code — people keep numbers when they move. - **Record consent** for marketing sends. Marketing requires prior express   *written* consent; `express` consent covers transactional only. With no record   on file we deliver and flag it, which is a gap in your evidence, not permission. - **Set `classification`.** Unclassified messages are treated as marketing, the   stricter reading. 
      * Send an SMS message
      */
     async sendSms(sendSmsRequest: SendSmsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SendSmsResponse> {

package/src/src/apis/WebhooksApi.ts

@@ -35,7 +35,6 @@ import type {
   WebhookJobResponse,
   WebhookListResponse,
   WebhookMetricsResponse,
-  WebhookRegionsResponse,
   WebhookReplayResponse,
   WebhookResponse,
   WebhookSecretRotateResponse,
@@ -85,8 +84,6 @@ import {
     WebhookListResponseToJSON,
     WebhookMetricsResponseFromJSON,
     WebhookMetricsResponseToJSON,
-    WebhookRegionsResponseFromJSON,
-    WebhookRegionsResponseToJSON,
     WebhookReplayResponseFromJSON,
     WebhookReplayResponseToJSON,
     WebhookResponseFromJSON,
@@ -373,21 +370,6 @@ export interface WebhooksApiInterface {
      */
     getWebhookMetrics(id: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<WebhookMetricsResponse>;
 
-    /**
-     * Get available webhook delivery regions. Requires multi_region plan feature (Enterprise only).
-     * @summary Get available webhook regions
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof WebhooksApiInterface
-     */
-    getWebhookRegionsRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<WebhookRegionsResponse>>;
-
-    /**
-     * Get available webhook delivery regions. Requires multi_region plan feature (Enterprise only).
-     * Get available webhook regions
-     */
-    getWebhookRegions(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<WebhookRegionsResponse>;
-
     /**
      * Get webhook delivery usage statistics for the current billing period.
      * @summary Get webhook usage metrics
@@ -1010,38 +992,6 @@ export class WebhooksApi extends runtime.BaseAPI implements WebhooksApiInterface
         return await response.value();
     }
 
-    /**
-     * Get available webhook delivery regions. Requires multi_region plan feature (Enterprise only).
-     * Get available webhook regions
-     */
-    async getWebhookRegionsRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<WebhookRegionsResponse>> {
-        const queryParameters: any = {};
-
-        const headerParameters: runtime.HTTPHeaders = {};
-
-        if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-API-Key"] = await this.configuration.apiKey("X-API-Key"); // ApiKeyAuth authentication
-        }
-
-        const response = await this.request({
-            path: `/v1/webhooks/regions`,
-            method: 'GET',
-            headers: headerParameters,
-            query: queryParameters,
-        }, initOverrides);
-
-        return new runtime.JSONApiResponse(response, (jsonValue) => WebhookRegionsResponseFromJSON(jsonValue));
-    }
-
-    /**
-     * Get available webhook delivery regions. Requires multi_region plan feature (Enterprise only).
-     * Get available webhook regions
-     */
-    async getWebhookRegions(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<WebhookRegionsResponse> {
-        const response = await this.getWebhookRegionsRaw(initOverrides);
-        return await response.value();
-    }
-
     /**
      * Get webhook delivery usage statistics for the current billing period.
      * Get webhook usage metrics

package/src/src/models/ConfirmEmailVerificationResponseData.ts

@@ -31,6 +31,12 @@ export interface ConfirmEmailVerificationResponseData {
      * @memberof ConfirmEmailVerificationResponseData
      */
     email?: string;
+    /**
+     * True when the address was already verified (the emailed link consumed the token on click). Still a 200 — an idempotent success, not an error (sc-7721).
+     * @type {boolean}
+     * @memberof ConfirmEmailVerificationResponseData
+     */
+    alreadyVerified?: boolean;
 }
 
 /**
@@ -52,6 +58,7 @@ export function ConfirmEmailVerificationResponseDataFromJSONTyped(json: any, ign
         
         'success': json['success'] == null ? undefined : json['success'],
         'email': json['email'] == null ? undefined : json['email'],
+        'alreadyVerified': json['already_verified'] == null ? undefined : json['already_verified'],
     };
 }
 
@@ -68,6 +75,7 @@ export function ConfirmEmailVerificationResponseDataToJSONTyped(value?: ConfirmE
         
         'success': value['success'],
         'email': value['email'],
+        'already_verified': value['alreadyVerified'],
     };
 }
 

package/src/src/models/{WebhookRegion.ts → ResendEmailVerificationRequest.ts}

@@ -16,66 +16,50 @@ import { mapValues } from '../runtime';
 /**
  * 
  * @export
- * @interface WebhookRegion
+ * @interface ResendEmailVerificationRequest
  */
-export interface WebhookRegion {
+export interface ResendEmailVerificationRequest {
     /**
-     * 
+     * URL to redirect to after verification
      * @type {string}
-     * @memberof WebhookRegion
+     * @memberof ResendEmailVerificationRequest
      */
-    code?: string;
-    /**
-     * 
-     * @type {string}
-     * @memberof WebhookRegion
-     */
-    name?: string;
-    /**
-     * 
-     * @type {Array<string>}
-     * @memberof WebhookRegion
-     */
-    staticIps?: Array<string>;
+    redirectUrl?: string;
 }
 
 /**
- * Check if a given object implements the WebhookRegion interface.
+ * Check if a given object implements the ResendEmailVerificationRequest interface.
  */
-export function instanceOfWebhookRegion(value: object): value is WebhookRegion {
+export function instanceOfResendEmailVerificationRequest(value: object): value is ResendEmailVerificationRequest {
     return true;
 }
 
-export function WebhookRegionFromJSON(json: any): WebhookRegion {
-    return WebhookRegionFromJSONTyped(json, false);
+export function ResendEmailVerificationRequestFromJSON(json: any): ResendEmailVerificationRequest {
+    return ResendEmailVerificationRequestFromJSONTyped(json, false);
 }
 
-export function WebhookRegionFromJSONTyped(json: any, ignoreDiscriminator: boolean): WebhookRegion {
+export function ResendEmailVerificationRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): ResendEmailVerificationRequest {
     if (json == null) {
         return json;
     }
     return {
         
-        'code': json['code'] == null ? undefined : json['code'],
-        'name': json['name'] == null ? undefined : json['name'],
-        'staticIps': json['static_ips'] == null ? undefined : json['static_ips'],
+        'redirectUrl': json['redirect_url'] == null ? undefined : json['redirect_url'],
     };
 }
 
-export function WebhookRegionToJSON(json: any): WebhookRegion {
-    return WebhookRegionToJSONTyped(json, false);
+export function ResendEmailVerificationRequestToJSON(json: any): ResendEmailVerificationRequest {
+    return ResendEmailVerificationRequestToJSONTyped(json, false);
 }
 
-export function WebhookRegionToJSONTyped(value?: WebhookRegion | null, ignoreDiscriminator: boolean = false): any {
+export function ResendEmailVerificationRequestToJSONTyped(value?: ResendEmailVerificationRequest | null, ignoreDiscriminator: boolean = false): any {
     if (value == null) {
         return value;
     }
 
     return {
         
-        'code': value['code'],
-        'name': value['name'],
-        'static_ips': value['staticIps'],
+        'redirect_url': value['redirectUrl'],
     };
 }
 

package/src/src/models/SendEmailVerificationRequest.ts

@@ -20,7 +20,7 @@ import { mapValues } from '../runtime';
  */
 export interface SendEmailVerificationRequest {
     /**
-     * URL to redirect to after verification
+     * URL to redirect to after verification (snake_case `redirect_url` — a camelCase `redirectUrl` is ignored and the hosted verification page is used instead). Must match one of the application's configured redirect URIs.
      * @type {string}
      * @memberof SendEmailVerificationRequest
      */