@zyphr-dev/node-sdk 0.1.55 → 0.1.57

package/dist/index.d.cts

@@ -9512,6 +9512,29 @@ interface InviteEndUser200ResponseData {
      * @memberof InviteEndUser200ResponseData
      */
     linkSent?: boolean;
+    /**
+     * Present only when `send_link` was requested and `link_sent` is false — explains why,
+     * so a caller can distinguish "suppressed by design" from "delivery failed".
+     *
+     * Known values:
+     *
+     * - `identity_has_other_auth_methods` — the identity has no password but does have a
+     *   linked OAuth provider and/or a passkey, so it is not locked out and no
+     *   set-password link is sent. The attempt is recorded as a suppressed message,
+     *   visible via `GET /emails`.
+     * - `user_not_found_in_environment` — the identity could not be resolved in the
+     *   calling environment (a race; it was created or resolved immediately prior).
+     * - `recipient_not_allowlisted` — the application's `test_recipients` allowlist
+     *   blocked the recipient.
+     * - `send_failed` — dispatch was attempted and failed with no more specific code.
+     *
+     * Not a closed set: a mail-provider error code may be surfaced verbatim, so treat
+     * an unrecognised value as a generic failure rather than an error.
+     *
+     * @type {string}
+     * @memberof InviteEndUser200ResponseData
+     */
+    linkSuppressedReason?: string;
 }
 /**
  * Check if a given object implements the InviteEndUser200ResponseData interface.
@@ -26837,7 +26860,7 @@ interface AuthPasswordResetApiValidateResetTokenOperationRequest {
  */
 interface AuthPasswordResetApiInterface {
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration.
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`.
      * @summary Request a password reset
      * @param {ForgotPasswordRequest} forgotPasswordRequest
      * @param {*} [options] Override http request option.
@@ -26846,7 +26869,7 @@ interface AuthPasswordResetApiInterface {
      */
     forgotPasswordRaw(requestParameters: AuthPasswordResetApiForgotPasswordOperationRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<SuccessResult>>;
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration.
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`.
      * Request a password reset
      */
     forgotPassword(forgotPasswordRequest: ForgotPasswordRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<SuccessResult>;
@@ -26884,12 +26907,12 @@ interface AuthPasswordResetApiInterface {
  */
 declare class AuthPasswordResetApi extends BaseAPI implements AuthPasswordResetApiInterface {
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration.
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`.
      * Request a password reset
      */
     forgotPasswordRaw(requestParameters: AuthPasswordResetApiForgotPasswordOperationRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<SuccessResult>>;
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration.
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`.
      * Request a password reset
      */
     forgotPassword(forgotPasswordRequest: ForgotPasswordRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<SuccessResult>;
@@ -28118,7 +28141,7 @@ interface DevicesApiInterface {
      */
     listDevices(userId?: string, platform?: ListDevicesPlatformEnum, limit?: number, offset?: number, initOverrides?: RequestInit | InitOverrideFunction): Promise<DeviceListResponse>;
     /**
-     * Register a device for push notifications. If the token already exists, updates it.
+     * Register a device for push notifications.  Registration is an upsert keyed on (project, token), so calling it on every app launch is safe and idempotent. Re-registering an existing token under a different `user_id` **reassigns** the device to that user — the previous association does not persist, so a push addressed to the old user will not reach this device.  `user_id` is an opaque string you choose. It is stored verbatim with no foreign key, and `POST /v1/push` matches on exactly that value. No Subscriber record is created for you.  Requires a secret API key, so call it from your backend and derive `user_id` from the authenticated session rather than the request body.
      * @summary Register a device
      * @param {RegisterDeviceRequest} registerDeviceRequest
      * @param {*} [options] Override http request option.
@@ -28127,7 +28150,7 @@ interface DevicesApiInterface {
      */
     registerDeviceRaw(requestParameters: DevicesApiRegisterDeviceOperationRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<DeviceResponse>>;
     /**
-     * Register a device for push notifications. If the token already exists, updates it.
+     * Register a device for push notifications.  Registration is an upsert keyed on (project, token), so calling it on every app launch is safe and idempotent. Re-registering an existing token under a different `user_id` **reassigns** the device to that user — the previous association does not persist, so a push addressed to the old user will not reach this device.  `user_id` is an opaque string you choose. It is stored verbatim with no foreign key, and `POST /v1/push` matches on exactly that value. No Subscriber record is created for you.  Requires a secret API key, so call it from your backend and derive `user_id` from the authenticated session rather than the request body.
      * Register a device
      */
     registerDevice(registerDeviceRequest: RegisterDeviceRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<DeviceResponse>;
@@ -28187,12 +28210,12 @@ declare class DevicesApi extends BaseAPI implements DevicesApiInterface {
      */
     listDevices(userId?: string, platform?: ListDevicesPlatformEnum, limit?: number, offset?: number, initOverrides?: RequestInit | InitOverrideFunction): Promise<DeviceListResponse>;
     /**
-     * Register a device for push notifications. If the token already exists, updates it.
+     * Register a device for push notifications.  Registration is an upsert keyed on (project, token), so calling it on every app launch is safe and idempotent. Re-registering an existing token under a different `user_id` **reassigns** the device to that user — the previous association does not persist, so a push addressed to the old user will not reach this device.  `user_id` is an opaque string you choose. It is stored verbatim with no foreign key, and `POST /v1/push` matches on exactly that value. No Subscriber record is created for you.  Requires a secret API key, so call it from your backend and derive `user_id` from the authenticated session rather than the request body.
      * Register a device
      */
     registerDeviceRaw(requestParameters: DevicesApiRegisterDeviceOperationRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<DeviceResponse>>;
     /**
-     * Register a device for push notifications. If the token already exists, updates it.
+     * Register a device for push notifications.  Registration is an upsert keyed on (project, token), so calling it on every app launch is safe and idempotent. Re-registering an existing token under a different `user_id` **reassigns** the device to that user — the previous association does not persist, so a push addressed to the old user will not reach this device.  `user_id` is an opaque string you choose. It is stored verbatim with no foreign key, and `POST /v1/push` matches on exactly that value. No Subscriber record is created for you.  Requires a secret API key, so call it from your backend and derive `user_id` from the authenticated session rather than the request body.
      * Register a device
      */
     registerDevice(registerDeviceRequest: RegisterDeviceRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<DeviceResponse>;
@@ -33624,8 +33647,6 @@ declare class ZyphrClient {
         readonly profile: AuthUserProfileApi;
         readonly webauthn: AuthWebAuthnApi;
     };
-    /** Device registration for push (takes an OS-acquired token). */
-    readonly devices: DevicesApi;
     /**
      * Utility endpoints that are publishable-key-safe: the application's password
      * policy (`getPasswordRequirements`) and a pre-submit password strength check

package/dist/index.d.ts

@@ -9512,6 +9512,29 @@ interface InviteEndUser200ResponseData {
      * @memberof InviteEndUser200ResponseData
      */
     linkSent?: boolean;
+    /**
+     * Present only when `send_link` was requested and `link_sent` is false — explains why,
+     * so a caller can distinguish "suppressed by design" from "delivery failed".
+     *
+     * Known values:
+     *
+     * - `identity_has_other_auth_methods` — the identity has no password but does have a
+     *   linked OAuth provider and/or a passkey, so it is not locked out and no
+     *   set-password link is sent. The attempt is recorded as a suppressed message,
+     *   visible via `GET /emails`.
+     * - `user_not_found_in_environment` — the identity could not be resolved in the
+     *   calling environment (a race; it was created or resolved immediately prior).
+     * - `recipient_not_allowlisted` — the application's `test_recipients` allowlist
+     *   blocked the recipient.
+     * - `send_failed` — dispatch was attempted and failed with no more specific code.
+     *
+     * Not a closed set: a mail-provider error code may be surfaced verbatim, so treat
+     * an unrecognised value as a generic failure rather than an error.
+     *
+     * @type {string}
+     * @memberof InviteEndUser200ResponseData
+     */
+    linkSuppressedReason?: string;
 }
 /**
  * Check if a given object implements the InviteEndUser200ResponseData interface.
@@ -26837,7 +26860,7 @@ interface AuthPasswordResetApiValidateResetTokenOperationRequest {
  */
 interface AuthPasswordResetApiInterface {
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration.
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`.
      * @summary Request a password reset
      * @param {ForgotPasswordRequest} forgotPasswordRequest
      * @param {*} [options] Override http request option.
@@ -26846,7 +26869,7 @@ interface AuthPasswordResetApiInterface {
      */
     forgotPasswordRaw(requestParameters: AuthPasswordResetApiForgotPasswordOperationRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<SuccessResult>>;
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration.
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`.
      * Request a password reset
      */
     forgotPassword(forgotPasswordRequest: ForgotPasswordRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<SuccessResult>;
@@ -26884,12 +26907,12 @@ interface AuthPasswordResetApiInterface {
  */
 declare class AuthPasswordResetApi extends BaseAPI implements AuthPasswordResetApiInterface {
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration.
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`.
      * Request a password reset
      */
     forgotPasswordRaw(requestParameters: AuthPasswordResetApiForgotPasswordOperationRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<SuccessResult>>;
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration.
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`.
      * Request a password reset
      */
     forgotPassword(forgotPasswordRequest: ForgotPasswordRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<SuccessResult>;
@@ -28118,7 +28141,7 @@ interface DevicesApiInterface {
      */
     listDevices(userId?: string, platform?: ListDevicesPlatformEnum, limit?: number, offset?: number, initOverrides?: RequestInit | InitOverrideFunction): Promise<DeviceListResponse>;
     /**
-     * Register a device for push notifications. If the token already exists, updates it.
+     * Register a device for push notifications.  Registration is an upsert keyed on (project, token), so calling it on every app launch is safe and idempotent. Re-registering an existing token under a different `user_id` **reassigns** the device to that user — the previous association does not persist, so a push addressed to the old user will not reach this device.  `user_id` is an opaque string you choose. It is stored verbatim with no foreign key, and `POST /v1/push` matches on exactly that value. No Subscriber record is created for you.  Requires a secret API key, so call it from your backend and derive `user_id` from the authenticated session rather than the request body.
      * @summary Register a device
      * @param {RegisterDeviceRequest} registerDeviceRequest
      * @param {*} [options] Override http request option.
@@ -28127,7 +28150,7 @@ interface DevicesApiInterface {
      */
     registerDeviceRaw(requestParameters: DevicesApiRegisterDeviceOperationRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<DeviceResponse>>;
     /**
-     * Register a device for push notifications. If the token already exists, updates it.
+     * Register a device for push notifications.  Registration is an upsert keyed on (project, token), so calling it on every app launch is safe and idempotent. Re-registering an existing token under a different `user_id` **reassigns** the device to that user — the previous association does not persist, so a push addressed to the old user will not reach this device.  `user_id` is an opaque string you choose. It is stored verbatim with no foreign key, and `POST /v1/push` matches on exactly that value. No Subscriber record is created for you.  Requires a secret API key, so call it from your backend and derive `user_id` from the authenticated session rather than the request body.
      * Register a device
      */
     registerDevice(registerDeviceRequest: RegisterDeviceRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<DeviceResponse>;
@@ -28187,12 +28210,12 @@ declare class DevicesApi extends BaseAPI implements DevicesApiInterface {
      */
     listDevices(userId?: string, platform?: ListDevicesPlatformEnum, limit?: number, offset?: number, initOverrides?: RequestInit | InitOverrideFunction): Promise<DeviceListResponse>;
     /**
-     * Register a device for push notifications. If the token already exists, updates it.
+     * Register a device for push notifications.  Registration is an upsert keyed on (project, token), so calling it on every app launch is safe and idempotent. Re-registering an existing token under a different `user_id` **reassigns** the device to that user — the previous association does not persist, so a push addressed to the old user will not reach this device.  `user_id` is an opaque string you choose. It is stored verbatim with no foreign key, and `POST /v1/push` matches on exactly that value. No Subscriber record is created for you.  Requires a secret API key, so call it from your backend and derive `user_id` from the authenticated session rather than the request body.
      * Register a device
      */
     registerDeviceRaw(requestParameters: DevicesApiRegisterDeviceOperationRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<DeviceResponse>>;
     /**
-     * Register a device for push notifications. If the token already exists, updates it.
+     * Register a device for push notifications.  Registration is an upsert keyed on (project, token), so calling it on every app launch is safe and idempotent. Re-registering an existing token under a different `user_id` **reassigns** the device to that user — the previous association does not persist, so a push addressed to the old user will not reach this device.  `user_id` is an opaque string you choose. It is stored verbatim with no foreign key, and `POST /v1/push` matches on exactly that value. No Subscriber record is created for you.  Requires a secret API key, so call it from your backend and derive `user_id` from the authenticated session rather than the request body.
      * Register a device
      */
     registerDevice(registerDeviceRequest: RegisterDeviceRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<DeviceResponse>;
@@ -33624,8 +33647,6 @@ declare class ZyphrClient {
         readonly profile: AuthUserProfileApi;
         readonly webauthn: AuthWebAuthnApi;
     };
-    /** Device registration for push (takes an OS-acquired token). */
-    readonly devices: DevicesApi;
     /**
      * Utility endpoints that are publishable-key-safe: the application's password
      * policy (`getPasswordRequirements`) and a pre-submit password strength check