@zyphr-dev/node-sdk 0.1.54 → 0.1.56

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zyphr-dev/node-sdk",
-  "version": "0.1.54",
+  "version": "0.1.56",
   "description": "Official Zyphr SDK for Node.js, React, and React Native",
   "type": "module",
   "main": "./dist/index.cjs",

package/src/.openapi-generator/FILES

@@ -523,9 +523,6 @@ src/models/WebhookIpsResponseData.ts
 src/models/WebhookJobResponse.ts
 src/models/WebhookListResponse.ts
 src/models/WebhookMetricsResponse.ts
-src/models/WebhookRegion.ts
-src/models/WebhookRegionsResponse.ts
-src/models/WebhookRegionsResponseData.ts
 src/models/WebhookReplayResponse.ts
 src/models/WebhookResponse.ts
 src/models/WebhookSecretRotateResponse.ts

package/src/client.ts

@@ -34,6 +34,7 @@ import {
   DevicesApi,
   DomainsApi,
   UtilityApi,
+  WorkflowsApi,
   EmailsApi,
   InboundEmailApi,
   InboxApi,
@@ -103,6 +104,15 @@ export class Zyphr {
   /** Publishable-key-safe utilities: password policy + pre-submit strength check. */
   readonly utility: UtilityApi;
   readonly domains: DomainsApi;
+  /**
+   * Multi-step workflow definitions and triggering (sc-7926).
+   *
+   * All 12 operations are API-key authenticated with dedicated
+   * `workflows:read` / `workflows:write` / `workflows:execute` scopes, so this
+   * is deliberate public surface. It was generated but never wired onto the
+   * facade, which made the documented `zyphr.workflows.*` calls throw.
+   */
+  readonly workflows: WorkflowsApi;
   /** Inbound (received) email — read access. Requires the `email:read` scope. */
   readonly inbound: InboundEmailApi;
 
@@ -162,6 +172,7 @@ export class Zyphr {
     this.devices = new DevicesApi(config);
     this.utility = new UtilityApi(config);
     this.domains = new DomainsApi(config);
+    this.workflows = new WorkflowsApi(config);
     this.inbound = new InboundEmailApi(config);
 
     this.waas = {

package/src/src/apis/AuthApplicationApi.ts

@@ -28,6 +28,11 @@ import {
     SetSelfApplicationTestRecipientsRequestToJSON,
 } from '../models/index';
 
+export interface AuthApplicationApiExportEndUserDataRequest {
+    id: string;
+    userId: string;
+}
+
 export interface AuthApplicationApiSetSelfApplicationTestRecipientsOperationRequest {
     setSelfApplicationTestRecipientsRequest: SetSelfApplicationTestRecipientsRequest;
 }
@@ -39,6 +44,23 @@ export interface AuthApplicationApiSetSelfApplicationTestRecipientsOperationRequ
  * @interface AuthApplicationApiInterface
  */
 export interface AuthApplicationApiInterface {
+    /**
+     * Returns a machine-readable JSON bundle of everything stored about one end user, for answering a GDPR Art. 15 (access) or Art. 20 (portability) request.  Zyphr is a **processor**: we do not answer data subjects directly. This endpoint gives you, the controller, the data needed to respond to your own end user.  **Credentials are deliberately excluded** and are listed in `export_metadata.excluded`: password hashes, session refresh-token hashes, MFA secrets, OAuth access/refresh tokens and WebAuthn public keys. These are authentication artifacts rather than personal data about the subject, and including them would turn this endpoint into a credential-exfiltration path.  Message history is capped at the 1,000 most recent messages; `export_metadata.message_history_truncated` reports whether the cap was hit. 
+     * @summary Export all data held about an end user
+     * @param {string} id Application ID
+     * @param {string} userId End user ID
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AuthApplicationApiInterface
+     */
+    exportEndUserDataRaw(requestParameters: AuthApplicationApiExportEndUserDataRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+
+    /**
+     * Returns a machine-readable JSON bundle of everything stored about one end user, for answering a GDPR Art. 15 (access) or Art. 20 (portability) request.  Zyphr is a **processor**: we do not answer data subjects directly. This endpoint gives you, the controller, the data needed to respond to your own end user.  **Credentials are deliberately excluded** and are listed in `export_metadata.excluded`: password hashes, session refresh-token hashes, MFA secrets, OAuth access/refresh tokens and WebAuthn public keys. These are authentication artifacts rather than personal data about the subject, and including them would turn this endpoint into a credential-exfiltration path.  Message history is capped at the 1,000 most recent messages; `export_metadata.message_history_truncated` reports whether the cap was hit. 
+     * Export all data held about an end user
+     */
+    exportEndUserData(id: string, userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+
     /**
      * Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment\'s mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
      * @summary Get the authenticating application
@@ -77,6 +99,47 @@ export interface AuthApplicationApiInterface {
  */
 export class AuthApplicationApi extends runtime.BaseAPI implements AuthApplicationApiInterface {
 
+    /**
+     * Returns a machine-readable JSON bundle of everything stored about one end user, for answering a GDPR Art. 15 (access) or Art. 20 (portability) request.  Zyphr is a **processor**: we do not answer data subjects directly. This endpoint gives you, the controller, the data needed to respond to your own end user.  **Credentials are deliberately excluded** and are listed in `export_metadata.excluded`: password hashes, session refresh-token hashes, MFA secrets, OAuth access/refresh tokens and WebAuthn public keys. These are authentication artifacts rather than personal data about the subject, and including them would turn this endpoint into a credential-exfiltration path.  Message history is capped at the 1,000 most recent messages; `export_metadata.message_history_truncated` reports whether the cap was hit. 
+     * Export all data held about an end user
+     */
+    async exportEndUserDataRaw(requestParameters: AuthApplicationApiExportEndUserDataRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError(
+                'id',
+                'Required parameter "id" was null or undefined when calling exportEndUserData().'
+            );
+        }
+
+        if (requestParameters['userId'] == null) {
+            throw new runtime.RequiredError(
+                'userId',
+                'Required parameter "userId" was null or undefined when calling exportEndUserData().'
+            );
+        }
+
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        const response = await this.request({
+            path: `/v1/applications/{id}/users/{userId}/export`.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id']))).replace(`{${"userId"}}`, encodeURIComponent(String(requestParameters['userId']))),
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Returns a machine-readable JSON bundle of everything stored about one end user, for answering a GDPR Art. 15 (access) or Art. 20 (portability) request.  Zyphr is a **processor**: we do not answer data subjects directly. This endpoint gives you, the controller, the data needed to respond to your own end user.  **Credentials are deliberately excluded** and are listed in `export_metadata.excluded`: password hashes, session refresh-token hashes, MFA secrets, OAuth access/refresh tokens and WebAuthn public keys. These are authentication artifacts rather than personal data about the subject, and including them would turn this endpoint into a credential-exfiltration path.  Message history is capped at the 1,000 most recent messages; `export_metadata.message_history_truncated` reports whether the cap was hit. 
+     * Export all data held about an end user
+     */
+    async exportEndUserData(id: string, userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.exportEndUserDataRaw({ id: id, userId: userId }, initOverrides);
+    }
+
     /**
      * Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment\'s mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
      * Get the authenticating application

package/src/src/apis/AuthPasswordResetApi.ts

@@ -60,7 +60,7 @@ export interface AuthPasswordResetApiValidateResetTokenOperationRequest {
  */
 export interface AuthPasswordResetApiInterface {
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration.
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`. 
      * @summary Request a password reset
      * @param {ForgotPasswordRequest} forgotPasswordRequest 
      * @param {*} [options] Override http request option.
@@ -70,7 +70,7 @@ export interface AuthPasswordResetApiInterface {
     forgotPasswordRaw(requestParameters: AuthPasswordResetApiForgotPasswordOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>>;
 
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration.
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`. 
      * Request a password reset
      */
     forgotPassword(forgotPasswordRequest: ForgotPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult>;
@@ -115,7 +115,7 @@ export interface AuthPasswordResetApiInterface {
 export class AuthPasswordResetApi extends runtime.BaseAPI implements AuthPasswordResetApiInterface {
 
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration.
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`. 
      * Request a password reset
      */
     async forgotPasswordRaw(requestParameters: AuthPasswordResetApiForgotPasswordOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>> {
@@ -152,7 +152,7 @@ export class AuthPasswordResetApi extends runtime.BaseAPI implements AuthPasswor
     }
 
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration.
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`. 
      * Request a password reset
      */
     async forgotPassword(forgotPasswordRequest: ForgotPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult> {

package/src/src/apis/EmailsApi.ts

@@ -167,7 +167,7 @@ export interface EmailsApiInterface {
     sendBatchEmail(sendBatchEmailRequest: SendBatchEmailRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SendBatchEmailResponse>;
 
     /**
-     * Queue an email for delivery. The email is processed asynchronously and you\'ll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`. 
+     * Queue an email for delivery. The email is processed asynchronously and you\'ll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`.  **CAN-SPAM compliance — actions required from you:**  - **Set `classification`** to `transactional` or `marketing`. Unclassified is   treated as marketing, the stricter reading. Transactional mail (password   resets, receipts) is exempt from the opt-out and postal-address requirements. - **Set your postal address** in project settings. Commercial email must carry a   valid physical postal address — the most commonly missed CAN-SPAM element.   Marketing sends without one are flagged. - **Include an unsubscribe mechanism** on commercial email. Zyphr enforces   suppression automatically once someone opts out, but the link itself is yours   to include.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
      * @summary Send an email
      * @param {SendEmailRequest} sendEmailRequest 
      * @param {*} [options] Override http request option.
@@ -177,7 +177,7 @@ export interface EmailsApiInterface {
     sendEmailRaw(requestParameters: EmailsApiSendEmailOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SendEmailResponse>>;
 
     /**
-     * Queue an email for delivery. The email is processed asynchronously and you\'ll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`. 
+     * Queue an email for delivery. The email is processed asynchronously and you\'ll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`.  **CAN-SPAM compliance — actions required from you:**  - **Set `classification`** to `transactional` or `marketing`. Unclassified is   treated as marketing, the stricter reading. Transactional mail (password   resets, receipts) is exempt from the opt-out and postal-address requirements. - **Set your postal address** in project settings. Commercial email must carry a   valid physical postal address — the most commonly missed CAN-SPAM element.   Marketing sends without one are flagged. - **Include an unsubscribe mechanism** on commercial email. Zyphr enforces   suppression automatically once someone opts out, but the link itself is yours   to include.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
      * Send an email
      */
     sendEmail(sendEmailRequest: SendEmailRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SendEmailResponse>;
@@ -397,7 +397,7 @@ export class EmailsApi extends runtime.BaseAPI implements EmailsApiInterface {
     }
 
     /**
-     * Queue an email for delivery. The email is processed asynchronously and you\'ll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`. 
+     * Queue an email for delivery. The email is processed asynchronously and you\'ll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`.  **CAN-SPAM compliance — actions required from you:**  - **Set `classification`** to `transactional` or `marketing`. Unclassified is   treated as marketing, the stricter reading. Transactional mail (password   resets, receipts) is exempt from the opt-out and postal-address requirements. - **Set your postal address** in project settings. Commercial email must carry a   valid physical postal address — the most commonly missed CAN-SPAM element.   Marketing sends without one are flagged. - **Include an unsubscribe mechanism** on commercial email. Zyphr enforces   suppression automatically once someone opts out, but the link itself is yours   to include.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
      * Send an email
      */
     async sendEmailRaw(requestParameters: EmailsApiSendEmailOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SendEmailResponse>> {
@@ -430,7 +430,7 @@ export class EmailsApi extends runtime.BaseAPI implements EmailsApiInterface {
     }
 
     /**
-     * Queue an email for delivery. The email is processed asynchronously and you\'ll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`. 
+     * Queue an email for delivery. The email is processed asynchronously and you\'ll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`.  **CAN-SPAM compliance — actions required from you:**  - **Set `classification`** to `transactional` or `marketing`. Unclassified is   treated as marketing, the stricter reading. Transactional mail (password   resets, receipts) is exempt from the opt-out and postal-address requirements. - **Set your postal address** in project settings. Commercial email must carry a   valid physical postal address — the most commonly missed CAN-SPAM element.   Marketing sends without one are flagged. - **Include an unsubscribe mechanism** on commercial email. Zyphr enforces   suppression automatically once someone opts out, but the link itself is yours   to include.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
      * Send an email
      */
     async sendEmail(sendEmailRequest: SendEmailRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SendEmailResponse> {

package/src/src/apis/SMSApi.ts

@@ -141,6 +141,21 @@ export interface SMSApiInterface {
      */
     getSmsConfig(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SmsConfigResponse>;
 
+    /**
+     * Returns the URL to configure in your SMS provider so STOP/opt-out replies reach Zyphr. The token is generated on first request and is stable thereafter.  **This is required for TCPA compliance.** Until your provider is pointed at this URL, opt-out replies stop at the provider and never reach us — from Zyphr\'s side the recipient never opted out, and sends continue.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
+     * @summary Get the inbound SMS webhook URL
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof SMSApiInterface
+     */
+    getSmsInboundWebhookRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+
+    /**
+     * Returns the URL to configure in your SMS provider so STOP/opt-out replies reach Zyphr. The token is generated on first request and is stable thereafter.  **This is required for TCPA compliance.** Until your provider is pointed at this URL, opt-out replies stop at the provider and never reach us — from Zyphr\'s side the recipient never opted out, and sends continue.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
+     * Get the inbound SMS webhook URL
+     */
+    getSmsInboundWebhook(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+
     /**
      * List SMS messages for the account with optional filtering and pagination.
      * @summary List SMS messages
@@ -177,7 +192,7 @@ export interface SMSApiInterface {
     sendBatchSms(sendBatchSmsRequest: SendBatchSmsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SendBatchSmsResponse>;
 
     /**
-     * Send a single SMS text message. Supports subscriber preference checks and scheduling.
+     * Send a single SMS text message. Supports subscriber preference checks and scheduling.  **TCPA compliance — actions required from you:**  - **Configure the inbound webhook.** Zyphr only processes STOP/opt-out replies   if your SMS provider is pointed at our inbound endpoint. Until you do this,   opt-outs never reach us and we will keep delivering. See   [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). - **Pass `recipient_timezone`** (IANA, e.g. `America/New_York`) so quiet hours   (8am-9pm recipient-local) can be enforced. Without it we send and record that   quiet hours could not be evaluated. We deliberately do not infer a timezone   from the area code — people keep numbers when they move. - **Record consent** for marketing sends. Marketing requires prior express   *written* consent; `express` consent covers transactional only. With no record   on file we deliver and flag it, which is a gap in your evidence, not permission. - **Set `classification`.** Unclassified messages are treated as marketing, the   stricter reading. 
      * @summary Send an SMS message
      * @param {SendSmsRequest} sendSmsRequest 
      * @param {*} [options] Override http request option.
@@ -187,7 +202,7 @@ export interface SMSApiInterface {
     sendSmsRaw(requestParameters: SMSApiSendSmsOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SendSmsResponse>>;
 
     /**
-     * Send a single SMS text message. Supports subscriber preference checks and scheduling.
+     * Send a single SMS text message. Supports subscriber preference checks and scheduling.  **TCPA compliance — actions required from you:**  - **Configure the inbound webhook.** Zyphr only processes STOP/opt-out replies   if your SMS provider is pointed at our inbound endpoint. Until you do this,   opt-outs never reach us and we will keep delivering. See   [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). - **Pass `recipient_timezone`** (IANA, e.g. `America/New_York`) so quiet hours   (8am-9pm recipient-local) can be enforced. Without it we send and record that   quiet hours could not be evaluated. We deliberately do not infer a timezone   from the area code — people keep numbers when they move. - **Record consent** for marketing sends. Marketing requires prior express   *written* consent; `express` consent covers transactional only. With no record   on file we deliver and flag it, which is a gap in your evidence, not permission. - **Set `classification`.** Unclassified messages are treated as marketing, the   stricter reading. 
      * Send an SMS message
      */
     sendSms(sendSmsRequest: SendSmsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SendSmsResponse>;
@@ -349,6 +364,37 @@ export class SMSApi extends runtime.BaseAPI implements SMSApiInterface {
         return await response.value();
     }
 
+    /**
+     * Returns the URL to configure in your SMS provider so STOP/opt-out replies reach Zyphr. The token is generated on first request and is stable thereafter.  **This is required for TCPA compliance.** Until your provider is pointed at this URL, opt-out replies stop at the provider and never reach us — from Zyphr\'s side the recipient never opted out, and sends continue.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
+     * Get the inbound SMS webhook URL
+     */
+    async getSmsInboundWebhookRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>> {
+        const queryParameters: any = {};
+
+        const headerParameters: runtime.HTTPHeaders = {};
+
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-API-Key"] = await this.configuration.apiKey("X-API-Key"); // ApiKeyAuth authentication
+        }
+
+        const response = await this.request({
+            path: `/sms/inbound-webhook`,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+
+        return new runtime.VoidApiResponse(response);
+    }
+
+    /**
+     * Returns the URL to configure in your SMS provider so STOP/opt-out replies reach Zyphr. The token is generated on first request and is stable thereafter.  **This is required for TCPA compliance.** Until your provider is pointed at this URL, opt-out replies stop at the provider and never reach us — from Zyphr\'s side the recipient never opted out, and sends continue.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
+     * Get the inbound SMS webhook URL
+     */
+    async getSmsInboundWebhook(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void> {
+        await this.getSmsInboundWebhookRaw(initOverrides);
+    }
+
     /**
      * List SMS messages for the account with optional filtering and pagination.
      * List SMS messages
@@ -440,7 +486,7 @@ export class SMSApi extends runtime.BaseAPI implements SMSApiInterface {
     }
 
     /**
-     * Send a single SMS text message. Supports subscriber preference checks and scheduling.
+     * Send a single SMS text message. Supports subscriber preference checks and scheduling.  **TCPA compliance — actions required from you:**  - **Configure the inbound webhook.** Zyphr only processes STOP/opt-out replies   if your SMS provider is pointed at our inbound endpoint. Until you do this,   opt-outs never reach us and we will keep delivering. See   [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). - **Pass `recipient_timezone`** (IANA, e.g. `America/New_York`) so quiet hours   (8am-9pm recipient-local) can be enforced. Without it we send and record that   quiet hours could not be evaluated. We deliberately do not infer a timezone   from the area code — people keep numbers when they move. - **Record consent** for marketing sends. Marketing requires prior express   *written* consent; `express` consent covers transactional only. With no record   on file we deliver and flag it, which is a gap in your evidence, not permission. - **Set `classification`.** Unclassified messages are treated as marketing, the   stricter reading. 
      * Send an SMS message
      */
     async sendSmsRaw(requestParameters: SMSApiSendSmsOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SendSmsResponse>> {
@@ -473,7 +519,7 @@ export class SMSApi extends runtime.BaseAPI implements SMSApiInterface {
     }
 
     /**
-     * Send a single SMS text message. Supports subscriber preference checks and scheduling.
+     * Send a single SMS text message. Supports subscriber preference checks and scheduling.  **TCPA compliance — actions required from you:**  - **Configure the inbound webhook.** Zyphr only processes STOP/opt-out replies   if your SMS provider is pointed at our inbound endpoint. Until you do this,   opt-outs never reach us and we will keep delivering. See   [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). - **Pass `recipient_timezone`** (IANA, e.g. `America/New_York`) so quiet hours   (8am-9pm recipient-local) can be enforced. Without it we send and record that   quiet hours could not be evaluated. We deliberately do not infer a timezone   from the area code — people keep numbers when they move. - **Record consent** for marketing sends. Marketing requires prior express   *written* consent; `express` consent covers transactional only. With no record   on file we deliver and flag it, which is a gap in your evidence, not permission. - **Set `classification`.** Unclassified messages are treated as marketing, the   stricter reading. 
      * Send an SMS message
      */
     async sendSms(sendSmsRequest: SendSmsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SendSmsResponse> {

package/src/src/apis/WebhooksApi.ts

@@ -35,7 +35,6 @@ import type {
   WebhookJobResponse,
   WebhookListResponse,
   WebhookMetricsResponse,
-  WebhookRegionsResponse,
   WebhookReplayResponse,
   WebhookResponse,
   WebhookSecretRotateResponse,
@@ -85,8 +84,6 @@ import {
     WebhookListResponseToJSON,
     WebhookMetricsResponseFromJSON,
     WebhookMetricsResponseToJSON,
-    WebhookRegionsResponseFromJSON,
-    WebhookRegionsResponseToJSON,
     WebhookReplayResponseFromJSON,
     WebhookReplayResponseToJSON,
     WebhookResponseFromJSON,
@@ -373,21 +370,6 @@ export interface WebhooksApiInterface {
      */
     getWebhookMetrics(id: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<WebhookMetricsResponse>;
 
-    /**
-     * Get available webhook delivery regions. Requires multi_region plan feature (Enterprise only).
-     * @summary Get available webhook regions
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof WebhooksApiInterface
-     */
-    getWebhookRegionsRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<WebhookRegionsResponse>>;
-
-    /**
-     * Get available webhook delivery regions. Requires multi_region plan feature (Enterprise only).
-     * Get available webhook regions
-     */
-    getWebhookRegions(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<WebhookRegionsResponse>;
-
     /**
      * Get webhook delivery usage statistics for the current billing period.
      * @summary Get webhook usage metrics
@@ -1010,38 +992,6 @@ export class WebhooksApi extends runtime.BaseAPI implements WebhooksApiInterface
         return await response.value();
     }
 
-    /**
-     * Get available webhook delivery regions. Requires multi_region plan feature (Enterprise only).
-     * Get available webhook regions
-     */
-    async getWebhookRegionsRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<WebhookRegionsResponse>> {
-        const queryParameters: any = {};
-
-        const headerParameters: runtime.HTTPHeaders = {};
-
-        if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-API-Key"] = await this.configuration.apiKey("X-API-Key"); // ApiKeyAuth authentication
-        }
-
-        const response = await this.request({
-            path: `/v1/webhooks/regions`,
-            method: 'GET',
-            headers: headerParameters,
-            query: queryParameters,
-        }, initOverrides);
-
-        return new runtime.JSONApiResponse(response, (jsonValue) => WebhookRegionsResponseFromJSON(jsonValue));
-    }
-
-    /**
-     * Get available webhook delivery regions. Requires multi_region plan feature (Enterprise only).
-     * Get available webhook regions
-     */
-    async getWebhookRegions(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<WebhookRegionsResponse> {
-        const response = await this.getWebhookRegionsRaw(initOverrides);
-        return await response.value();
-    }
-
     /**
      * Get webhook delivery usage statistics for the current billing period.
      * Get webhook usage metrics

package/src/src/models/InviteEndUser200ResponseData.ts

@@ -37,6 +37,29 @@ export interface InviteEndUser200ResponseData {
      * @memberof InviteEndUser200ResponseData
      */
     linkSent?: boolean;
+    /**
+     * Present only when `send_link` was requested and `link_sent` is false — explains why,
+     * so a caller can distinguish "suppressed by design" from "delivery failed".
+     * 
+     * Known values:
+     * 
+     * - `identity_has_other_auth_methods` — the identity has no password but does have a
+     *   linked OAuth provider and/or a passkey, so it is not locked out and no
+     *   set-password link is sent. The attempt is recorded as a suppressed message,
+     *   visible via `GET /emails`.
+     * - `user_not_found_in_environment` — the identity could not be resolved in the
+     *   calling environment (a race; it was created or resolved immediately prior).
+     * - `recipient_not_allowlisted` — the application's `test_recipients` allowlist
+     *   blocked the recipient.
+     * - `send_failed` — dispatch was attempted and failed with no more specific code.
+     * 
+     * Not a closed set: a mail-provider error code may be surfaced verbatim, so treat
+     * an unrecognised value as a generic failure rather than an error.
+     * 
+     * @type {string}
+     * @memberof InviteEndUser200ResponseData
+     */
+    linkSuppressedReason?: string;
 }
 
 /**
@@ -59,6 +82,7 @@ export function InviteEndUser200ResponseDataFromJSONTyped(json: any, ignoreDiscr
         'userId': json['user_id'] == null ? undefined : json['user_id'],
         'created': json['created'] == null ? undefined : json['created'],
         'linkSent': json['link_sent'] == null ? undefined : json['link_sent'],
+        'linkSuppressedReason': json['link_suppressed_reason'] == null ? undefined : json['link_suppressed_reason'],
     };
 }
 
@@ -76,6 +100,7 @@ export function InviteEndUser200ResponseDataToJSONTyped(value?: InviteEndUser200
         'user_id': value['userId'],
         'created': value['created'],
         'link_sent': value['linkSent'],
+        'link_suppressed_reason': value['linkSuppressedReason'],
     };
 }
 

package/src/src/models/WebhookDelivery.ts

@@ -111,12 +111,6 @@ export interface WebhookDelivery {
      * @memberof WebhookDelivery
      */
     completedAt?: Date | null;
-    /**
-     * 
-     * @type {string}
-     * @memberof WebhookDelivery
-     */
-    deliveryRegion?: string | null;
     /**
      * 
      * @type {Date}
@@ -170,7 +164,6 @@ export function WebhookDeliveryFromJSONTyped(json: any, ignoreDiscriminator: boo
         'firstAttemptedAt': json['first_attempted_at'] == null ? undefined : (new Date(json['first_attempted_at'])),
         'lastAttemptedAt': json['last_attempted_at'] == null ? undefined : (new Date(json['last_attempted_at'])),
         'completedAt': json['completed_at'] == null ? undefined : (new Date(json['completed_at'])),
-        'deliveryRegion': json['delivery_region'] == null ? undefined : json['delivery_region'],
         'createdAt': json['created_at'] == null ? undefined : (new Date(json['created_at'])),
     };
 }
@@ -200,7 +193,6 @@ export function WebhookDeliveryToJSONTyped(value?: WebhookDelivery | null, ignor
         'first_attempted_at': value['firstAttemptedAt'] == null ? undefined : ((value['firstAttemptedAt'] as any).toISOString()),
         'last_attempted_at': value['lastAttemptedAt'] == null ? undefined : ((value['lastAttemptedAt'] as any).toISOString()),
         'completed_at': value['completedAt'] == null ? undefined : ((value['completedAt'] as any).toISOString()),
-        'delivery_region': value['deliveryRegion'],
         'created_at': value['createdAt'] == null ? undefined : ((value['createdAt']).toISOString()),
     };
 }

package/src/src/models/WebhookDeliveryDetail.ts

@@ -111,12 +111,6 @@ export interface WebhookDeliveryDetail {
      * @memberof WebhookDeliveryDetail
      */
     completedAt?: Date | null;
-    /**
-     * 
-     * @type {string}
-     * @memberof WebhookDeliveryDetail
-     */
-    deliveryRegion?: string | null;
     /**
      * 
      * @type {Date}
@@ -194,7 +188,6 @@ export function WebhookDeliveryDetailFromJSONTyped(json: any, ignoreDiscriminato
         'firstAttemptedAt': json['first_attempted_at'] == null ? undefined : (new Date(json['first_attempted_at'])),
         'lastAttemptedAt': json['last_attempted_at'] == null ? undefined : (new Date(json['last_attempted_at'])),
         'completedAt': json['completed_at'] == null ? undefined : (new Date(json['completed_at'])),
-        'deliveryRegion': json['delivery_region'] == null ? undefined : json['delivery_region'],
         'createdAt': json['created_at'] == null ? undefined : (new Date(json['created_at'])),
         'payload': json['payload'] == null ? undefined : json['payload'],
         'lastResponseBody': json['last_response_body'] == null ? undefined : json['last_response_body'],
@@ -228,7 +221,6 @@ export function WebhookDeliveryDetailToJSONTyped(value?: WebhookDeliveryDetail |
         'first_attempted_at': value['firstAttemptedAt'] == null ? undefined : ((value['firstAttemptedAt'] as any).toISOString()),
         'last_attempted_at': value['lastAttemptedAt'] == null ? undefined : ((value['lastAttemptedAt'] as any).toISOString()),
         'completed_at': value['completedAt'] == null ? undefined : ((value['completedAt'] as any).toISOString()),
-        'delivery_region': value['deliveryRegion'],
         'created_at': value['createdAt'] == null ? undefined : ((value['createdAt']).toISOString()),
         'payload': value['payload'],
         'last_response_body': value['lastResponseBody'],

package/src/src/models/index.ts

@@ -482,9 +482,6 @@ export * from './WebhookIpsResponseData';
 export * from './WebhookJobResponse';
 export * from './WebhookListResponse';
 export * from './WebhookMetricsResponse';
-export * from './WebhookRegion';
-export * from './WebhookRegionsResponse';
-export * from './WebhookRegionsResponseData';
 export * from './WebhookReplayResponse';
 export * from './WebhookResponse';
 export * from './WebhookSecretRotateResponse';

package/src/src/models/WebhookRegion.ts

@@ -1,81 +0,0 @@
-/* tslint:disable */
-/* eslint-disable */
-/**
- * Zyphr API
- * Zyphr is a multi-channel notification platform that enables developers to send emails, push notifications, SMS, and in-app messages through a unified API.  ## Authentication  All API requests require authentication using an API key. Include your API key in the `X-API-Key` header:  ``` X-API-Key: zy_live_xxxxxxxxxxxx ```  API keys can be created in the Zyphr Dashboard. Use `zy_test_*` keys for testing and `zy_live_*` keys for production.  ## Rate Limiting  The API implements rate limiting to ensure fair usage. Rate limit information is included in response headers:  - `X-RateLimit-Limit`: Maximum requests per window - `X-RateLimit-Remaining`: Remaining requests in current window - `X-RateLimit-Reset`: Unix timestamp when the window resets  ## Account Sending Status  Every authenticated response carries the account\'s current sending state so you can surface it in your own tooling without a separate call:  - `X-Account-Sending-Status`: `active`, `throttled`, or `frozen` - `X-Account-Sending-Status-Reason`: human-readable reason (present only when the status is `throttled` or `frozen`)  This header is informational and non-blocking on non-send endpoints (reads, billing, and deliverability stay available). Send-capable endpoints additionally enforce the state: a frozen account receives `403 account_frozen` and a throttled account receives `429 account_throttled`, both with the reason in the error message.  ## Errors  All errors follow a consistent format:  ```json {   \"error\": {     \"code\": \"error_code\",     \"message\": \"Human readable message\",     \"details\": {}   },   \"meta\": {     \"request_id\": \"req_xxxx\"   } } ```
- *
- * The version of the OpenAPI document: 1.0.0
- * Contact: support@zyphr.dev
- *
- * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
- * https://openapi-generator.tech
- * Do not edit the class manually.
- */
-
-import { mapValues } from '../runtime';
-/**
- * 
- * @export
- * @interface WebhookRegion
- */
-export interface WebhookRegion {
-    /**
-     * 
-     * @type {string}
-     * @memberof WebhookRegion
-     */
-    code?: string;
-    /**
-     * 
-     * @type {string}
-     * @memberof WebhookRegion
-     */
-    name?: string;
-    /**
-     * 
-     * @type {Array<string>}
-     * @memberof WebhookRegion
-     */
-    staticIps?: Array<string>;
-}
-
-/**
- * Check if a given object implements the WebhookRegion interface.
- */
-export function instanceOfWebhookRegion(value: object): value is WebhookRegion {
-    return true;
-}
-
-export function WebhookRegionFromJSON(json: any): WebhookRegion {
-    return WebhookRegionFromJSONTyped(json, false);
-}
-
-export function WebhookRegionFromJSONTyped(json: any, ignoreDiscriminator: boolean): WebhookRegion {
-    if (json == null) {
-        return json;
-    }
-    return {
-        
-        'code': json['code'] == null ? undefined : json['code'],
-        'name': json['name'] == null ? undefined : json['name'],
-        'staticIps': json['static_ips'] == null ? undefined : json['static_ips'],
-    };
-}
-
-export function WebhookRegionToJSON(json: any): WebhookRegion {
-    return WebhookRegionToJSONTyped(json, false);
-}
-
-export function WebhookRegionToJSONTyped(value?: WebhookRegion | null, ignoreDiscriminator: boolean = false): any {
-    if (value == null) {
-        return value;
-    }
-
-    return {
-        
-        'code': value['code'],
-        'name': value['name'],
-        'static_ips': value['staticIps'],
-    };
-}
-