@zyphr-dev/node-sdk 0.1.65 → 0.1.66

package/dist/index.d.cts

@@ -1163,6 +1163,8 @@ declare const AuthEmailType: {
     readonly MAGIC_LINK: "magic_link";
     readonly PASSWORD_RESET: "password_reset";
     readonly EMAIL_VERIFICATION: "email_verification";
+    readonly EMAIL_OTP: "email_otp";
+    readonly INVITATION: "invitation";
 };
 type AuthEmailType = typeof AuthEmailType[keyof typeof AuthEmailType];
 declare function instanceOfAuthEmailType(value: any): boolean;
@@ -2985,7 +2987,7 @@ declare function UpsertAuthEmailTemplateRequestToJSONTyped(value?: UpsertAuthEma
  */
 
 /**
- * Atomic upsert of any subset of magic_link, password_reset, email_verification.
+ * Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation.
  * At least one entry must be provided.
  *
  * @export
@@ -3010,6 +3012,18 @@ interface BulkUpsertAuthEmailTemplatesRequest {
      * @memberof BulkUpsertAuthEmailTemplatesRequest
      */
     emailVerification?: UpsertAuthEmailTemplateRequest;
+    /**
+     *
+     * @type {UpsertAuthEmailTemplateRequest}
+     * @memberof BulkUpsertAuthEmailTemplatesRequest
+     */
+    emailOtp?: UpsertAuthEmailTemplateRequest;
+    /**
+     *
+     * @type {UpsertAuthEmailTemplateRequest}
+     * @memberof BulkUpsertAuthEmailTemplatesRequest
+     */
+    invitation?: UpsertAuthEmailTemplateRequest;
 }
 /**
  * Check if a given object implements the BulkUpsertAuthEmailTemplatesRequest interface.
@@ -9595,7 +9609,7 @@ interface InviteEndUser200ResponseData {
      */
     created?: boolean;
     /**
-     * True when a magic-link or password-reset email was successfully dispatched.
+     * True when the requested invitation, magic-link or password-reset email was successfully dispatched.
      * @type {boolean}
      * @memberof InviteEndUser200ResponseData
      */
@@ -9610,6 +9624,10 @@ interface InviteEndUser200ResponseData {
      *   linked OAuth provider and/or a passkey, so it is not locked out and no
      *   set-password link is sent. The attempt is recorded as a suppressed message,
      *   visible via `GET /emails`.
+     *   (For `send_link: "invitation"` the reason is returned here only; no
+     *   suppressed message is recorded.)
+     * - `user_has_password` — `send_link: "invitation"` only: the identity already has
+     *   a password, so there is nothing to accept. Use `password_reset` to send a reset.
      * - `user_not_found_in_environment` — the identity could not be resolved in the
      *   calling environment (a race; it was created or resolved immediately prior).
      * - `recipient_not_allowlisted` — the application's `test_recipients` allowlist
@@ -9725,6 +9743,7 @@ interface InviteEndUserRequest {
  * @export
  */
 declare const InviteEndUserRequestSendLinkEnum: {
+    readonly INVITATION: "invitation";
     readonly MAGIC: "magic";
     readonly PASSWORD_RESET: "password_reset";
     readonly NONE: "none";
@@ -10274,6 +10293,12 @@ declare function MagicLinkVerifyRequestToJSONTyped(value?: MagicLinkVerifyReques
  * @interface MagicLinkVerifyResponseData
  */
 interface MagicLinkVerifyResponseData {
+    /**
+     *
+     * @type {boolean}
+     * @memberof MagicLinkVerifyResponseData
+     */
+    mfaRequired?: boolean;
     /**
      *
      * @type {AuthUser}
@@ -10286,6 +10311,12 @@ interface MagicLinkVerifyResponseData {
      * @memberof MagicLinkVerifyResponseData
      */
     tokens?: AuthTokens;
+    /**
+     *
+     * @type {AuthLoginResultMfaChallenge}
+     * @memberof MagicLinkVerifyResponseData
+     */
+    mfaChallenge?: AuthLoginResultMfaChallenge;
     /**
      *
      * @type {boolean}
@@ -25604,7 +25635,7 @@ interface AuthEmailTemplatesApiUpsertAuthEmailTemplateOperationRequest {
  */
 interface AuthEmailTemplatesApiInterface {
     /**
-     * Atomic upsert of any subset of magic_link, password_reset, email_verification. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito.
+     * Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito.
      * @summary Bulk-upsert auth email templates
      * @param {BulkUpsertAuthEmailTemplatesRequest} bulkUpsertAuthEmailTemplatesRequest
      * @param {*} [options] Override http request option.
@@ -25613,7 +25644,7 @@ interface AuthEmailTemplatesApiInterface {
      */
     bulkUpsertAuthEmailTemplatesRaw(requestParameters: AuthEmailTemplatesApiBulkUpsertAuthEmailTemplatesOperationRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<BulkUpsertAuthEmailTemplatesResponse>>;
     /**
-     * Atomic upsert of any subset of magic_link, password_reset, email_verification. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito.
+     * Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito.
      * Bulk-upsert auth email templates
      */
     bulkUpsertAuthEmailTemplates(bulkUpsertAuthEmailTemplatesRequest: BulkUpsertAuthEmailTemplatesRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<BulkUpsertAuthEmailTemplatesResponse>;
@@ -25751,12 +25782,12 @@ interface AuthEmailTemplatesApiInterface {
  */
 declare class AuthEmailTemplatesApi extends BaseAPI implements AuthEmailTemplatesApiInterface {
     /**
-     * Atomic upsert of any subset of magic_link, password_reset, email_verification. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito.
+     * Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito.
      * Bulk-upsert auth email templates
      */
     bulkUpsertAuthEmailTemplatesRaw(requestParameters: AuthEmailTemplatesApiBulkUpsertAuthEmailTemplatesOperationRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<BulkUpsertAuthEmailTemplatesResponse>>;
     /**
-     * Atomic upsert of any subset of magic_link, password_reset, email_verification. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito.
+     * Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito.
      * Bulk-upsert auth email templates
      */
     bulkUpsertAuthEmailTemplates(bulkUpsertAuthEmailTemplatesRequest: BulkUpsertAuthEmailTemplatesRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<BulkUpsertAuthEmailTemplatesResponse>;
@@ -26265,7 +26296,7 @@ interface AuthMagicLinksApiInterface {
      */
     sendMagicLink(magicLinkSendRequest: MagicLinkSendRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<SuccessResult>;
     /**
-     * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag.
+     * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag. A magic link is a single factor, so a user who has enrolled MFA gets `mfa_required: true` and an `mfa_challenge` instead of tokens; complete the login with the challenge token at `POST /auth/mfa/verify`, exactly as after password login.
      * @summary Verify a magic link
      * @param {MagicLinkVerifyRequest} magicLinkVerifyRequest
      * @param {*} [options] Override http request option.
@@ -26274,7 +26305,7 @@ interface AuthMagicLinksApiInterface {
      */
     verifyMagicLinkRaw(requestParameters: AuthMagicLinksApiVerifyMagicLinkRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<MagicLinkVerifyResponse>>;
     /**
-     * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag.
+     * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag. A magic link is a single factor, so a user who has enrolled MFA gets `mfa_required: true` and an `mfa_challenge` instead of tokens; complete the login with the challenge token at `POST /auth/mfa/verify`, exactly as after password login.
      * Verify a magic link
      */
     verifyMagicLink(magicLinkVerifyRequest: MagicLinkVerifyRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<MagicLinkVerifyResponse>;
@@ -26294,12 +26325,12 @@ declare class AuthMagicLinksApi extends BaseAPI implements AuthMagicLinksApiInte
      */
     sendMagicLink(magicLinkSendRequest: MagicLinkSendRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<SuccessResult>;
     /**
-     * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag.
+     * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag. A magic link is a single factor, so a user who has enrolled MFA gets `mfa_required: true` and an `mfa_challenge` instead of tokens; complete the login with the challenge token at `POST /auth/mfa/verify`, exactly as after password login.
      * Verify a magic link
      */
     verifyMagicLinkRaw(requestParameters: AuthMagicLinksApiVerifyMagicLinkRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<MagicLinkVerifyResponse>>;
     /**
-     * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag.
+     * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag. A magic link is a single factor, so a user who has enrolled MFA gets `mfa_required: true` and an `mfa_challenge` instead of tokens; complete the login with the challenge token at `POST /auth/mfa/verify`, exactly as after password login.
      * Verify a magic link
      */
     verifyMagicLink(magicLinkVerifyRequest: MagicLinkVerifyRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<MagicLinkVerifyResponse>;
@@ -27604,7 +27635,7 @@ interface AuthUserDirectoryApiInterface {
      */
     getEndUserClaims(userId: string, initOverrides?: RequestInit | InitOverrideFunction): Promise<GetEndUserClaims200Response>;
     /**
-     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).
+     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).
      * @summary Pre-provision (invite) an end user (server-side admin)
      * @param {InviteEndUserRequest} inviteEndUserRequest
      * @param {*} [options] Override http request option.
@@ -27613,7 +27644,7 @@ interface AuthUserDirectoryApiInterface {
      */
     inviteEndUserRaw(requestParameters: AuthUserDirectoryApiInviteEndUserOperationRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<InviteEndUser200Response>>;
     /**
-     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).
+     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).
      * Pre-provision (invite) an end user (server-side admin)
      */
     inviteEndUser(inviteEndUserRequest: InviteEndUserRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<InviteEndUser200Response>;
@@ -27720,12 +27751,12 @@ declare class AuthUserDirectoryApi extends BaseAPI implements AuthUserDirectoryA
      */
     getEndUserClaims(userId: string, initOverrides?: RequestInit | InitOverrideFunction): Promise<GetEndUserClaims200Response>;
     /**
-     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).
+     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).
      * Pre-provision (invite) an end user (server-side admin)
      */
     inviteEndUserRaw(requestParameters: AuthUserDirectoryApiInviteEndUserOperationRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<InviteEndUser200Response>>;
     /**
-     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).
+     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).
      * Pre-provision (invite) an end user (server-side admin)
      */
     inviteEndUser(inviteEndUserRequest: InviteEndUserRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<InviteEndUser200Response>;

package/dist/index.d.ts

@@ -1163,6 +1163,8 @@ declare const AuthEmailType: {
     readonly MAGIC_LINK: "magic_link";
     readonly PASSWORD_RESET: "password_reset";
     readonly EMAIL_VERIFICATION: "email_verification";
+    readonly EMAIL_OTP: "email_otp";
+    readonly INVITATION: "invitation";
 };
 type AuthEmailType = typeof AuthEmailType[keyof typeof AuthEmailType];
 declare function instanceOfAuthEmailType(value: any): boolean;
@@ -2985,7 +2987,7 @@ declare function UpsertAuthEmailTemplateRequestToJSONTyped(value?: UpsertAuthEma
  */
 
 /**
- * Atomic upsert of any subset of magic_link, password_reset, email_verification.
+ * Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation.
  * At least one entry must be provided.
  *
  * @export
@@ -3010,6 +3012,18 @@ interface BulkUpsertAuthEmailTemplatesRequest {
      * @memberof BulkUpsertAuthEmailTemplatesRequest
      */
     emailVerification?: UpsertAuthEmailTemplateRequest;
+    /**
+     *
+     * @type {UpsertAuthEmailTemplateRequest}
+     * @memberof BulkUpsertAuthEmailTemplatesRequest
+     */
+    emailOtp?: UpsertAuthEmailTemplateRequest;
+    /**
+     *
+     * @type {UpsertAuthEmailTemplateRequest}
+     * @memberof BulkUpsertAuthEmailTemplatesRequest
+     */
+    invitation?: UpsertAuthEmailTemplateRequest;
 }
 /**
  * Check if a given object implements the BulkUpsertAuthEmailTemplatesRequest interface.
@@ -9595,7 +9609,7 @@ interface InviteEndUser200ResponseData {
      */
     created?: boolean;
     /**
-     * True when a magic-link or password-reset email was successfully dispatched.
+     * True when the requested invitation, magic-link or password-reset email was successfully dispatched.
      * @type {boolean}
      * @memberof InviteEndUser200ResponseData
      */
@@ -9610,6 +9624,10 @@ interface InviteEndUser200ResponseData {
      *   linked OAuth provider and/or a passkey, so it is not locked out and no
      *   set-password link is sent. The attempt is recorded as a suppressed message,
      *   visible via `GET /emails`.
+     *   (For `send_link: "invitation"` the reason is returned here only; no
+     *   suppressed message is recorded.)
+     * - `user_has_password` — `send_link: "invitation"` only: the identity already has
+     *   a password, so there is nothing to accept. Use `password_reset` to send a reset.
      * - `user_not_found_in_environment` — the identity could not be resolved in the
      *   calling environment (a race; it was created or resolved immediately prior).
      * - `recipient_not_allowlisted` — the application's `test_recipients` allowlist
@@ -9725,6 +9743,7 @@ interface InviteEndUserRequest {
  * @export
  */
 declare const InviteEndUserRequestSendLinkEnum: {
+    readonly INVITATION: "invitation";
     readonly MAGIC: "magic";
     readonly PASSWORD_RESET: "password_reset";
     readonly NONE: "none";
@@ -10274,6 +10293,12 @@ declare function MagicLinkVerifyRequestToJSONTyped(value?: MagicLinkVerifyReques
  * @interface MagicLinkVerifyResponseData
  */
 interface MagicLinkVerifyResponseData {
+    /**
+     *
+     * @type {boolean}
+     * @memberof MagicLinkVerifyResponseData
+     */
+    mfaRequired?: boolean;
     /**
      *
      * @type {AuthUser}
@@ -10286,6 +10311,12 @@ interface MagicLinkVerifyResponseData {
      * @memberof MagicLinkVerifyResponseData
      */
     tokens?: AuthTokens;
+    /**
+     *
+     * @type {AuthLoginResultMfaChallenge}
+     * @memberof MagicLinkVerifyResponseData
+     */
+    mfaChallenge?: AuthLoginResultMfaChallenge;
     /**
      *
      * @type {boolean}
@@ -25604,7 +25635,7 @@ interface AuthEmailTemplatesApiUpsertAuthEmailTemplateOperationRequest {
  */
 interface AuthEmailTemplatesApiInterface {
     /**
-     * Atomic upsert of any subset of magic_link, password_reset, email_verification. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito.
+     * Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito.
      * @summary Bulk-upsert auth email templates
      * @param {BulkUpsertAuthEmailTemplatesRequest} bulkUpsertAuthEmailTemplatesRequest
      * @param {*} [options] Override http request option.
@@ -25613,7 +25644,7 @@ interface AuthEmailTemplatesApiInterface {
      */
     bulkUpsertAuthEmailTemplatesRaw(requestParameters: AuthEmailTemplatesApiBulkUpsertAuthEmailTemplatesOperationRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<BulkUpsertAuthEmailTemplatesResponse>>;
     /**
-     * Atomic upsert of any subset of magic_link, password_reset, email_verification. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito.
+     * Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito.
      * Bulk-upsert auth email templates
      */
     bulkUpsertAuthEmailTemplates(bulkUpsertAuthEmailTemplatesRequest: BulkUpsertAuthEmailTemplatesRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<BulkUpsertAuthEmailTemplatesResponse>;
@@ -25751,12 +25782,12 @@ interface AuthEmailTemplatesApiInterface {
  */
 declare class AuthEmailTemplatesApi extends BaseAPI implements AuthEmailTemplatesApiInterface {
     /**
-     * Atomic upsert of any subset of magic_link, password_reset, email_verification. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito.
+     * Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito.
      * Bulk-upsert auth email templates
      */
     bulkUpsertAuthEmailTemplatesRaw(requestParameters: AuthEmailTemplatesApiBulkUpsertAuthEmailTemplatesOperationRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<BulkUpsertAuthEmailTemplatesResponse>>;
     /**
-     * Atomic upsert of any subset of magic_link, password_reset, email_verification. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito.
+     * Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito.
      * Bulk-upsert auth email templates
      */
     bulkUpsertAuthEmailTemplates(bulkUpsertAuthEmailTemplatesRequest: BulkUpsertAuthEmailTemplatesRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<BulkUpsertAuthEmailTemplatesResponse>;
@@ -26265,7 +26296,7 @@ interface AuthMagicLinksApiInterface {
      */
     sendMagicLink(magicLinkSendRequest: MagicLinkSendRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<SuccessResult>;
     /**
-     * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag.
+     * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag. A magic link is a single factor, so a user who has enrolled MFA gets `mfa_required: true` and an `mfa_challenge` instead of tokens; complete the login with the challenge token at `POST /auth/mfa/verify`, exactly as after password login.
      * @summary Verify a magic link
      * @param {MagicLinkVerifyRequest} magicLinkVerifyRequest
      * @param {*} [options] Override http request option.
@@ -26274,7 +26305,7 @@ interface AuthMagicLinksApiInterface {
      */
     verifyMagicLinkRaw(requestParameters: AuthMagicLinksApiVerifyMagicLinkRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<MagicLinkVerifyResponse>>;
     /**
-     * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag.
+     * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag. A magic link is a single factor, so a user who has enrolled MFA gets `mfa_required: true` and an `mfa_challenge` instead of tokens; complete the login with the challenge token at `POST /auth/mfa/verify`, exactly as after password login.
      * Verify a magic link
      */
     verifyMagicLink(magicLinkVerifyRequest: MagicLinkVerifyRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<MagicLinkVerifyResponse>;
@@ -26294,12 +26325,12 @@ declare class AuthMagicLinksApi extends BaseAPI implements AuthMagicLinksApiInte
      */
     sendMagicLink(magicLinkSendRequest: MagicLinkSendRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<SuccessResult>;
     /**
-     * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag.
+     * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag. A magic link is a single factor, so a user who has enrolled MFA gets `mfa_required: true` and an `mfa_challenge` instead of tokens; complete the login with the challenge token at `POST /auth/mfa/verify`, exactly as after password login.
      * Verify a magic link
      */
     verifyMagicLinkRaw(requestParameters: AuthMagicLinksApiVerifyMagicLinkRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<MagicLinkVerifyResponse>>;
     /**
-     * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag.
+     * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag. A magic link is a single factor, so a user who has enrolled MFA gets `mfa_required: true` and an `mfa_challenge` instead of tokens; complete the login with the challenge token at `POST /auth/mfa/verify`, exactly as after password login.
      * Verify a magic link
      */
     verifyMagicLink(magicLinkVerifyRequest: MagicLinkVerifyRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<MagicLinkVerifyResponse>;
@@ -27604,7 +27635,7 @@ interface AuthUserDirectoryApiInterface {
      */
     getEndUserClaims(userId: string, initOverrides?: RequestInit | InitOverrideFunction): Promise<GetEndUserClaims200Response>;
     /**
-     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).
+     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).
      * @summary Pre-provision (invite) an end user (server-side admin)
      * @param {InviteEndUserRequest} inviteEndUserRequest
      * @param {*} [options] Override http request option.
@@ -27613,7 +27644,7 @@ interface AuthUserDirectoryApiInterface {
      */
     inviteEndUserRaw(requestParameters: AuthUserDirectoryApiInviteEndUserOperationRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<InviteEndUser200Response>>;
     /**
-     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).
+     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).
      * Pre-provision (invite) an end user (server-side admin)
      */
     inviteEndUser(inviteEndUserRequest: InviteEndUserRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<InviteEndUser200Response>;
@@ -27720,12 +27751,12 @@ declare class AuthUserDirectoryApi extends BaseAPI implements AuthUserDirectoryA
      */
     getEndUserClaims(userId: string, initOverrides?: RequestInit | InitOverrideFunction): Promise<GetEndUserClaims200Response>;
     /**
-     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).
+     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).
      * Pre-provision (invite) an end user (server-side admin)
      */
     inviteEndUserRaw(requestParameters: AuthUserDirectoryApiInviteEndUserOperationRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<ApiResponse<InviteEndUser200Response>>;
     /**
-     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).
+     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).
      * Pre-provision (invite) an end user (server-side admin)
      */
     inviteEndUser(inviteEndUserRequest: InviteEndUserRequest, initOverrides?: RequestInit | InitOverrideFunction): Promise<InviteEndUser200Response>;

package/dist/index.js

@@ -942,7 +942,9 @@ function ApplicationSelfResponseToJSONTyped(value, ignoreDiscriminator = false)
 var AuthEmailType = {
   MAGIC_LINK: "magic_link",
   PASSWORD_RESET: "password_reset",
-  EMAIL_VERIFICATION: "email_verification"
+  EMAIL_VERIFICATION: "email_verification",
+  EMAIL_OTP: "email_otp",
+  INVITATION: "invitation"
 };
 function instanceOfAuthEmailType(value) {
   for (const key in AuthEmailType) {
@@ -2114,7 +2116,9 @@ function BulkUpsertAuthEmailTemplatesRequestFromJSONTyped(json, ignoreDiscrimina
   return {
     "magicLink": json["magic_link"] == null ? void 0 : UpsertAuthEmailTemplateRequestFromJSON(json["magic_link"]),
     "passwordReset": json["password_reset"] == null ? void 0 : UpsertAuthEmailTemplateRequestFromJSON(json["password_reset"]),
-    "emailVerification": json["email_verification"] == null ? void 0 : UpsertAuthEmailTemplateRequestFromJSON(json["email_verification"])
+    "emailVerification": json["email_verification"] == null ? void 0 : UpsertAuthEmailTemplateRequestFromJSON(json["email_verification"]),
+    "emailOtp": json["email_otp"] == null ? void 0 : UpsertAuthEmailTemplateRequestFromJSON(json["email_otp"]),
+    "invitation": json["invitation"] == null ? void 0 : UpsertAuthEmailTemplateRequestFromJSON(json["invitation"])
   };
 }
 function BulkUpsertAuthEmailTemplatesRequestToJSON(json) {
@@ -2127,7 +2131,9 @@ function BulkUpsertAuthEmailTemplatesRequestToJSONTyped(value, ignoreDiscriminat
   return {
     "magic_link": UpsertAuthEmailTemplateRequestToJSON(value["magicLink"]),
     "password_reset": UpsertAuthEmailTemplateRequestToJSON(value["passwordReset"]),
-    "email_verification": UpsertAuthEmailTemplateRequestToJSON(value["emailVerification"])
+    "email_verification": UpsertAuthEmailTemplateRequestToJSON(value["emailVerification"]),
+    "email_otp": UpsertAuthEmailTemplateRequestToJSON(value["emailOtp"]),
+    "invitation": UpsertAuthEmailTemplateRequestToJSON(value["invitation"])
   };
 }
 
@@ -6556,6 +6562,7 @@ function InviteEndUser200ResponseToJSONTyped(value, ignoreDiscriminator = false)
 
 // src/src/models/InviteEndUserRequest.ts
 var InviteEndUserRequestSendLinkEnum = {
+  INVITATION: "invitation",
   MAGIC: "magic",
   PASSWORD_RESET: "password_reset",
   NONE: "none"
@@ -6971,8 +6978,10 @@ function MagicLinkVerifyResponseDataFromJSONTyped(json, ignoreDiscriminator) {
     return json;
   }
   return {
+    "mfaRequired": json["mfa_required"] == null ? void 0 : json["mfa_required"],
     "user": json["user"] == null ? void 0 : AuthUserFromJSON(json["user"]),
     "tokens": json["tokens"] == null ? void 0 : AuthTokensFromJSON(json["tokens"]),
+    "mfaChallenge": json["mfa_challenge"] == null ? void 0 : AuthLoginResultMfaChallengeFromJSON(json["mfa_challenge"]),
     "isNewUser": json["is_new_user"] == null ? void 0 : json["is_new_user"]
   };
 }
@@ -6984,8 +6993,10 @@ function MagicLinkVerifyResponseDataToJSONTyped(value, ignoreDiscriminator = fal
     return value;
   }
   return {
+    "mfa_required": value["mfaRequired"],
     "user": AuthUserToJSON(value["user"]),
     "tokens": AuthTokensToJSON(value["tokens"]),
+    "mfa_challenge": AuthLoginResultMfaChallengeToJSON(value["mfaChallenge"]),
     "is_new_user": value["isNewUser"]
   };
 }
@@ -17419,7 +17430,7 @@ var AuthEmailOTPApi = class extends BaseAPI {
 // src/src/apis/AuthEmailTemplatesApi.ts
 var AuthEmailTemplatesApi = class extends BaseAPI {
   /**
-   * Atomic upsert of any subset of magic_link, password_reset, email_verification. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito. 
+   * Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito. 
    * Bulk-upsert auth email templates
    */
   async bulkUpsertAuthEmailTemplatesRaw(requestParameters, initOverrides) {
@@ -17458,7 +17469,7 @@ var AuthEmailTemplatesApi = class extends BaseAPI {
     return new JSONApiResponse(response, (jsonValue) => BulkUpsertAuthEmailTemplatesResponseFromJSON(jsonValue));
   }
   /**
-   * Atomic upsert of any subset of magic_link, password_reset, email_verification. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito. 
+   * Atomic upsert of any subset of magic_link, password_reset, email_verification, email_otp, invitation. Validates all inputs before any write; if any one fails validation or MJML compile, none are saved. Designed for one-shot migration imports from Auth0/Firebase/Clerk/Cognito. 
    * Bulk-upsert auth email templates
    */
   async bulkUpsertAuthEmailTemplates(bulkUpsertAuthEmailTemplatesRequest, initOverrides) {
@@ -18467,7 +18478,7 @@ var AuthMagicLinksApi = class extends BaseAPI {
     return await response.value();
   }
   /**
-   * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag.
+   * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag. A magic link is a single factor, so a user who has enrolled MFA gets `mfa_required: true` and an `mfa_challenge` instead of tokens; complete the login with the challenge token at `POST /auth/mfa/verify`, exactly as after password login.
    * Verify a magic link
    */
   async verifyMagicLinkRaw(requestParameters, initOverrides) {
@@ -18506,7 +18517,7 @@ var AuthMagicLinksApi = class extends BaseAPI {
     return new JSONApiResponse(response, (jsonValue) => MagicLinkVerifyResponseFromJSON(jsonValue));
   }
   /**
-   * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag.
+   * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag. A magic link is a single factor, so a user who has enrolled MFA gets `mfa_required: true` and an `mfa_challenge` instead of tokens; complete the login with the challenge token at `POST /auth/mfa/verify`, exactly as after password login.
    * Verify a magic link
    */
   async verifyMagicLink(magicLinkVerifyRequest, initOverrides) {
@@ -20486,7 +20497,7 @@ var AuthUserDirectoryApi = class extends BaseAPI {
     return await response.value();
   }
   /**
-   * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+   * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
    * Pre-provision (invite) an end user (server-side admin)
    */
   async inviteEndUserRaw(requestParameters, initOverrides) {
@@ -20525,7 +20536,7 @@ var AuthUserDirectoryApi = class extends BaseAPI {
     return new JSONApiResponse(response, (jsonValue) => InviteEndUser200ResponseFromJSON(jsonValue));
   }
   /**
-   * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"magic\"` sends a magic-link sign-in email. - `send_link: \"password_reset\"` sends a set-password email. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required when `send_link` is \"magic\" or \"password_reset\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+   * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
    * Pre-provision (invite) an end user (server-side admin)
    */
   async inviteEndUser(inviteEndUserRequest, initOverrides) {