@zyphr-dev/node-sdk 0.1.57 → 0.1.59

package/dist/index.cjs

@@ -20535,7 +20535,7 @@ var AuthEmailTemplatesApi = class extends BaseAPI {
 // src/src/apis/AuthEmailVerificationApi.ts
 var AuthEmailVerificationApi = class extends BaseAPI {
   /**
-   * Verify the user\'s email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user\'s verified state back and report that — correct whether or not the link already consumed the token.
+   * Verify the user\'s email using the token from the emailed link. Zyphr does NOT host auth pages and never redeems the token itself. The emailed link points at YOUR `redirect_url` with `?token=<raw>`; your app reads that token and posts it here. Nothing is verified until this call. This endpoint is idempotent: re-posting an already-redeemed token returns `200` with `already_verified: true` rather than an error, so a double submit or a link opened twice is safe. Only a genuinely invalid / expired / unknown token returns `400`. Note `redirect_url` is REQUIRED (snake_case) when sending the verification email — there is no hosted fallback page.
    * Confirm email verification
    */
   async confirmEmailVerificationRaw(requestParameters, initOverrides) {
@@ -20574,7 +20574,7 @@ var AuthEmailVerificationApi = class extends BaseAPI {
     return new JSONApiResponse(response, (jsonValue) => ConfirmEmailVerificationResponseFromJSON(jsonValue));
   }
   /**
-   * Verify the user\'s email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user\'s verified state back and report that — correct whether or not the link already consumed the token.
+   * Verify the user\'s email using the token from the emailed link. Zyphr does NOT host auth pages and never redeems the token itself. The emailed link points at YOUR `redirect_url` with `?token=<raw>`; your app reads that token and posts it here. Nothing is verified until this call. This endpoint is idempotent: re-posting an already-redeemed token returns `200` with `already_verified: true` rather than an error, so a double submit or a link opened twice is safe. Only a genuinely invalid / expired / unknown token returns `400`. Note `redirect_url` is REQUIRED (snake_case) when sending the verification email — there is no hosted fallback page.
    * Confirm email verification
    */
   async confirmEmailVerification(confirmEmailVerificationRequest, initOverrides) {
@@ -24065,7 +24065,7 @@ var DevicesApi = class extends BaseAPI {
     return await response.value();
   }
   /**
-   * Register a device for push notifications.  Registration is an upsert keyed on (project, token), so calling it on every app launch is safe and idempotent. Re-registering an existing token under a different `user_id` **reassigns** the device to that user — the previous association does not persist, so a push addressed to the old user will not reach this device.  `user_id` is an opaque string you choose. It is stored verbatim with no foreign key, and `POST /v1/push` matches on exactly that value. No Subscriber record is created for you.  Requires a secret API key, so call it from your backend and derive `user_id` from the authenticated session rather than the request body. 
+   * Register a device for push notifications.  Registration is an upsert keyed on (project, token), so calling it on every app launch is safe and idempotent. Re-registering an existing token under a different `user_id` **reassigns** the device to that user — the previous association does not persist, so a push addressed to the old user will not reach this device.  `user_id` is an opaque string you choose. It is stored verbatim with no foreign key, and `POST /v1/push` matches on exactly that value. No Subscriber record is created for you.  Call this from your backend and derive `user_id` from the authenticated session rather than the request body.  **Two credentials are accepted, and the choice matters for push routing:**  - **Application credentials** — `X-Application-Key` + `X-Application-Secret`   (`za_*`). The device is bound to that application, and pushes to it   resolve *that application\'s* push provider credentials. Use this when a   single project contains more than one app: APNs credentials are bound to   a bundle id, so a device registered under the wrong application has its   pushes rejected by Apple. The application is taken from the credential   and can never be set from the request body.    Using an **environment-scoped** key (`za_test_pub_*` / `za_live_pub_*`)   also binds the device to that environment, which is what lets APNs   sandbox and production credentials be configured separately. A legacy   application-level key (`za_pub_*`) binds the application only, and such   devices will not match an environment-scoped push config.  - **Project secret API key** (`zy_*`) — the device is not bound to any   application and resolves the project-level push provider config. This is   the historical behaviour and remains supported. 
    * Register a device
    */
   async registerDeviceRaw(requestParameters, initOverrides) {
@@ -24078,6 +24078,14 @@ var DevicesApi = class extends BaseAPI {
     const queryParameters = {};
     const headerParameters = {};
     headerParameters["Content-Type"] = "application/json";
+    if (this.configuration && this.configuration.apiKey) {
+      {
+        const apiKeyValue = await this.configuration.apiKey("X-Application-Secret");
+        if (apiKeyValue) {
+          headerParameters["X-Application-Secret"] = apiKeyValue;
+        }
+      }
+    }
     if (this.configuration && this.configuration.apiKey) {
       {
         const apiKeyValue = await this.configuration.apiKey("X-API-Key");
@@ -24086,6 +24094,14 @@ var DevicesApi = class extends BaseAPI {
         }
       }
     }
+    if (this.configuration && this.configuration.apiKey) {
+      {
+        const apiKeyValue = await this.configuration.apiKey("X-Application-Key");
+        if (apiKeyValue) {
+          headerParameters["X-Application-Key"] = apiKeyValue;
+        }
+      }
+    }
     const response = await this.request({
       path: `/devices`,
       method: "POST",
@@ -24096,7 +24112,7 @@ var DevicesApi = class extends BaseAPI {
     return new JSONApiResponse(response, (jsonValue) => DeviceResponseFromJSON(jsonValue));
   }
   /**
-   * Register a device for push notifications.  Registration is an upsert keyed on (project, token), so calling it on every app launch is safe and idempotent. Re-registering an existing token under a different `user_id` **reassigns** the device to that user — the previous association does not persist, so a push addressed to the old user will not reach this device.  `user_id` is an opaque string you choose. It is stored verbatim with no foreign key, and `POST /v1/push` matches on exactly that value. No Subscriber record is created for you.  Requires a secret API key, so call it from your backend and derive `user_id` from the authenticated session rather than the request body. 
+   * Register a device for push notifications.  Registration is an upsert keyed on (project, token), so calling it on every app launch is safe and idempotent. Re-registering an existing token under a different `user_id` **reassigns** the device to that user — the previous association does not persist, so a push addressed to the old user will not reach this device.  `user_id` is an opaque string you choose. It is stored verbatim with no foreign key, and `POST /v1/push` matches on exactly that value. No Subscriber record is created for you.  Call this from your backend and derive `user_id` from the authenticated session rather than the request body.  **Two credentials are accepted, and the choice matters for push routing:**  - **Application credentials** — `X-Application-Key` + `X-Application-Secret`   (`za_*`). The device is bound to that application, and pushes to it   resolve *that application\'s* push provider credentials. Use this when a   single project contains more than one app: APNs credentials are bound to   a bundle id, so a device registered under the wrong application has its   pushes rejected by Apple. The application is taken from the credential   and can never be set from the request body.    Using an **environment-scoped** key (`za_test_pub_*` / `za_live_pub_*`)   also binds the device to that environment, which is what lets APNs   sandbox and production credentials be configured separately. A legacy   application-level key (`za_pub_*`) binds the application only, and such   devices will not match an environment-scoped push config.  - **Project secret API key** (`zy_*`) — the device is not bound to any   application and resolves the project-level push provider config. This is   the historical behaviour and remains supported. 
    * Register a device
    */
   async registerDevice(registerDeviceRequest, initOverrides) {