@zyphr-dev/node-sdk 0.1.67 → 0.1.69

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zyphr-dev/node-sdk",
-  "version": "0.1.67",
+  "version": "0.1.69",
   "description": "Official Zyphr SDK for Node.js, React, and React Native",
   "type": "module",
   "main": "./dist/index.cjs",

package/src/.openapi-generator/FILES

@@ -162,6 +162,8 @@ src/models/ExecutionResponse.ts
 src/models/ExecutionRetryResponse.ts
 src/models/ExecutionRetryResponseData.ts
 src/models/ForgotPasswordRequest.ts
+src/models/ForgotPasswordResult.ts
+src/models/ForgotPasswordResultData.ts
 src/models/GenerateSubscriberToken200Response.ts
 src/models/GenerateSubscriberToken200ResponseData.ts
 src/models/GenerateSubscriberTokenRequest.ts
@@ -215,6 +217,8 @@ src/models/ListWorkflows200Response.ts
 src/models/ListWorkflows200ResponseMeta.ts
 src/models/LoginRequest.ts
 src/models/MagicLinkSendRequest.ts
+src/models/MagicLinkSendResult.ts
+src/models/MagicLinkSendResultData.ts
 src/models/MagicLinkVerifyRequest.ts
 src/models/MagicLinkVerifyResponse.ts
 src/models/MagicLinkVerifyResponseData.ts
@@ -323,6 +327,7 @@ src/models/ResetPasswordRequest.ts
 src/models/ResetPasswordResponse.ts
 src/models/ResubscribeRequest.ts
 src/models/ResubscribeResponse.ts
+src/models/ReturnedAuthLink.ts
 src/models/RevokeAllSessionsResponse.ts
 src/models/RevokeAllSessionsResponseData.ts
 src/models/RevokeSessionRequest.ts

package/src/src/apis/AuthEmailVerificationApi.ts

@@ -73,7 +73,7 @@ export interface AuthEmailVerificationApiInterface {
     confirmEmailVerification(confirmEmailVerificationRequest: ConfirmEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ConfirmEmailVerificationResponse>;
 
     /**
-     * Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
+     * Resend the verification email to the authenticated user. Rate limited to once per 60 seconds. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user\'s `Authorization: Bearer` token. Failures behave as on `POST /auth/verify-email/send`, including the 200 accepted-and-suppressed response for a recipient outside the application allowlist.
      * @summary Resend email verification
      * @param {ResendEmailVerificationRequest} [resendEmailVerificationRequest] 
      * @param {*} [options] Override http request option.
@@ -83,7 +83,7 @@ export interface AuthEmailVerificationApiInterface {
     resendEmailVerificationRaw(requestParameters: AuthEmailVerificationApiResendEmailVerificationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>>;
 
     /**
-     * Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
+     * Resend the verification email to the authenticated user. Rate limited to once per 60 seconds. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user\'s `Authorization: Bearer` token. Failures behave as on `POST /auth/verify-email/send`, including the 200 accepted-and-suppressed response for a recipient outside the application allowlist.
      * Resend email verification
      */
     resendEmailVerification(resendEmailVerificationRequest?: ResendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult>;
@@ -172,7 +172,7 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
     }
 
     /**
-     * Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
+     * Resend the verification email to the authenticated user. Rate limited to once per 60 seconds. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user\'s `Authorization: Bearer` token. Failures behave as on `POST /auth/verify-email/send`, including the 200 accepted-and-suppressed response for a recipient outside the application allowlist.
      * Resend email verification
      */
     async resendEmailVerificationRaw(requestParameters: AuthEmailVerificationApiResendEmailVerificationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>> {
@@ -224,7 +224,7 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
     }
 
     /**
-     * Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
+     * Resend the verification email to the authenticated user. Rate limited to once per 60 seconds. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user\'s `Authorization: Bearer` token. Failures behave as on `POST /auth/verify-email/send`, including the 200 accepted-and-suppressed response for a recipient outside the application allowlist.
      * Resend email verification
      */
     async resendEmailVerification(resendEmailVerificationRequest?: ResendEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult> {

package/src/src/apis/AuthMagicLinksApi.ts

@@ -17,21 +17,21 @@ import * as runtime from '../runtime';
 import type {
   ApiError,
   MagicLinkSendRequest,
+  MagicLinkSendResult,
   MagicLinkVerifyRequest,
   MagicLinkVerifyResponse,
-  SuccessResult,
 } from '../models/index';
 import {
     ApiErrorFromJSON,
     ApiErrorToJSON,
     MagicLinkSendRequestFromJSON,
     MagicLinkSendRequestToJSON,
+    MagicLinkSendResultFromJSON,
+    MagicLinkSendResultToJSON,
     MagicLinkVerifyRequestFromJSON,
     MagicLinkVerifyRequestToJSON,
     MagicLinkVerifyResponseFromJSON,
     MagicLinkVerifyResponseToJSON,
-    SuccessResultFromJSON,
-    SuccessResultToJSON,
 } from '../models/index';
 
 export interface AuthMagicLinksApiSendMagicLinkRequest {
@@ -50,20 +50,20 @@ export interface AuthMagicLinksApiVerifyMagicLinkRequest {
  */
 export interface AuthMagicLinksApiInterface {
     /**
-     * Send a magic link email for passwordless authentication.
+     * Send a magic link email for passwordless authentication.  **Sending the email yourself:** pass `return_link: true` (with `redirect_url`) and Zyphr mints the link but sends nothing, returning it in `data.link`. Requires your application secret, so call it server-side only. 
      * @summary Send a magic link
      * @param {MagicLinkSendRequest} magicLinkSendRequest 
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof AuthMagicLinksApiInterface
      */
-    sendMagicLinkRaw(requestParameters: AuthMagicLinksApiSendMagicLinkRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>>;
+    sendMagicLinkRaw(requestParameters: AuthMagicLinksApiSendMagicLinkRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<MagicLinkSendResult>>;
 
     /**
-     * Send a magic link email for passwordless authentication.
+     * Send a magic link email for passwordless authentication.  **Sending the email yourself:** pass `return_link: true` (with `redirect_url`) and Zyphr mints the link but sends nothing, returning it in `data.link`. Requires your application secret, so call it server-side only. 
      * Send a magic link
      */
-    sendMagicLink(magicLinkSendRequest: MagicLinkSendRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult>;
+    sendMagicLink(magicLinkSendRequest: MagicLinkSendRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<MagicLinkSendResult>;
 
     /**
      * Verify a magic link token and authenticate the user. Returns auth result with is_new_user flag. A magic link is a single factor, so a user who has enrolled MFA gets `mfa_required: true` and an `mfa_challenge` instead of tokens; complete the login with the challenge token at `POST /auth/mfa/verify`, exactly as after password login.
@@ -89,10 +89,10 @@ export interface AuthMagicLinksApiInterface {
 export class AuthMagicLinksApi extends runtime.BaseAPI implements AuthMagicLinksApiInterface {
 
     /**
-     * Send a magic link email for passwordless authentication.
+     * Send a magic link email for passwordless authentication.  **Sending the email yourself:** pass `return_link: true` (with `redirect_url`) and Zyphr mints the link but sends nothing, returning it in `data.link`. Requires your application secret, so call it server-side only. 
      * Send a magic link
      */
-    async sendMagicLinkRaw(requestParameters: AuthMagicLinksApiSendMagicLinkRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>> {
+    async sendMagicLinkRaw(requestParameters: AuthMagicLinksApiSendMagicLinkRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<MagicLinkSendResult>> {
         if (requestParameters['magicLinkSendRequest'] == null) {
             throw new runtime.RequiredError(
                 'magicLinkSendRequest',
@@ -136,14 +136,14 @@ export class AuthMagicLinksApi extends runtime.BaseAPI implements AuthMagicLinks
             body: MagicLinkSendRequestToJSON(requestParameters['magicLinkSendRequest']),
         }, initOverrides);
 
-        return new runtime.JSONApiResponse(response, (jsonValue) => SuccessResultFromJSON(jsonValue));
+        return new runtime.JSONApiResponse(response, (jsonValue) => MagicLinkSendResultFromJSON(jsonValue));
     }
 
     /**
-     * Send a magic link email for passwordless authentication.
+     * Send a magic link email for passwordless authentication.  **Sending the email yourself:** pass `return_link: true` (with `redirect_url`) and Zyphr mints the link but sends nothing, returning it in `data.link`. Requires your application secret, so call it server-side only. 
      * Send a magic link
      */
-    async sendMagicLink(magicLinkSendRequest: MagicLinkSendRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult> {
+    async sendMagicLink(magicLinkSendRequest: MagicLinkSendRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<MagicLinkSendResult> {
         const response = await this.sendMagicLinkRaw({ magicLinkSendRequest: magicLinkSendRequest }, initOverrides);
         return await response.value();
     }

package/src/src/apis/AuthPasswordResetApi.ts

@@ -17,9 +17,9 @@ import * as runtime from '../runtime';
 import type {
   ApiError,
   ForgotPasswordRequest,
+  ForgotPasswordResult,
   ResetPasswordRequest,
   ResetPasswordResponse,
-  SuccessResult,
   ValidateResetTokenRequest,
   ValidateResetTokenResponse,
 } from '../models/index';
@@ -28,12 +28,12 @@ import {
     ApiErrorToJSON,
     ForgotPasswordRequestFromJSON,
     ForgotPasswordRequestToJSON,
+    ForgotPasswordResultFromJSON,
+    ForgotPasswordResultToJSON,
     ResetPasswordRequestFromJSON,
     ResetPasswordRequestToJSON,
     ResetPasswordResponseFromJSON,
     ResetPasswordResponseToJSON,
-    SuccessResultFromJSON,
-    SuccessResultToJSON,
     ValidateResetTokenRequestFromJSON,
     ValidateResetTokenRequestToJSON,
     ValidateResetTokenResponseFromJSON,
@@ -60,20 +60,20 @@ export interface AuthPasswordResetApiValidateResetTokenOperationRequest {
  */
 export interface AuthPasswordResetApiInterface {
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`. 
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`.  **Sending the email yourself:** pass `return_link: true` (with `redirect_url`) and Zyphr mints the token but sends nothing, returning the link in `data.link`. When no link is minted, `data.link` is null and `data.link_suppressed_reason` says why. Unlike the default response, this reveals whether the address is registered — acceptable only because the endpoint requires your application secret, so it must only be called server-side. 
      * @summary Request a password reset
      * @param {ForgotPasswordRequest} forgotPasswordRequest 
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof AuthPasswordResetApiInterface
      */
-    forgotPasswordRaw(requestParameters: AuthPasswordResetApiForgotPasswordOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>>;
+    forgotPasswordRaw(requestParameters: AuthPasswordResetApiForgotPasswordOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ForgotPasswordResult>>;
 
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`. 
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`.  **Sending the email yourself:** pass `return_link: true` (with `redirect_url`) and Zyphr mints the token but sends nothing, returning the link in `data.link`. When no link is minted, `data.link` is null and `data.link_suppressed_reason` says why. Unlike the default response, this reveals whether the address is registered — acceptable only because the endpoint requires your application secret, so it must only be called server-side. 
      * Request a password reset
      */
-    forgotPassword(forgotPasswordRequest: ForgotPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult>;
+    forgotPassword(forgotPasswordRequest: ForgotPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ForgotPasswordResult>;
 
     /**
      * Reset a user\'s password using a valid reset token.
@@ -115,10 +115,10 @@ export interface AuthPasswordResetApiInterface {
 export class AuthPasswordResetApi extends runtime.BaseAPI implements AuthPasswordResetApiInterface {
 
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`. 
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`.  **Sending the email yourself:** pass `return_link: true` (with `redirect_url`) and Zyphr mints the token but sends nothing, returning the link in `data.link`. When no link is minted, `data.link` is null and `data.link_suppressed_reason` says why. Unlike the default response, this reveals whether the address is registered — acceptable only because the endpoint requires your application secret, so it must only be called server-side. 
      * Request a password reset
      */
-    async forgotPasswordRaw(requestParameters: AuthPasswordResetApiForgotPasswordOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>> {
+    async forgotPasswordRaw(requestParameters: AuthPasswordResetApiForgotPasswordOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ForgotPasswordResult>> {
         if (requestParameters['forgotPasswordRequest'] == null) {
             throw new runtime.RequiredError(
                 'forgotPasswordRequest',
@@ -162,14 +162,14 @@ export class AuthPasswordResetApi extends runtime.BaseAPI implements AuthPasswor
             body: ForgotPasswordRequestToJSON(requestParameters['forgotPasswordRequest']),
         }, initOverrides);
 
-        return new runtime.JSONApiResponse(response, (jsonValue) => SuccessResultFromJSON(jsonValue));
+        return new runtime.JSONApiResponse(response, (jsonValue) => ForgotPasswordResultFromJSON(jsonValue));
     }
 
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`. 
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`.  **Sending the email yourself:** pass `return_link: true` (with `redirect_url`) and Zyphr mints the token but sends nothing, returning the link in `data.link`. When no link is minted, `data.link` is null and `data.link_suppressed_reason` says why. Unlike the default response, this reveals whether the address is registered — acceptable only because the endpoint requires your application secret, so it must only be called server-side. 
      * Request a password reset
      */
-    async forgotPassword(forgotPasswordRequest: ForgotPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult> {
+    async forgotPassword(forgotPasswordRequest: ForgotPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ForgotPasswordResult> {
         const response = await this.forgotPasswordRaw({ forgotPasswordRequest: forgotPasswordRequest }, initOverrides);
         return await response.value();
     }

package/src/src/apis/AuthUserDirectoryApi.ts

@@ -175,7 +175,7 @@ export interface AuthUserDirectoryApiInterface {
     getEndUserClaims(userId: string, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetEndUserClaims200Response>;
 
     /**
-     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).  **Sending the email yourself:** pass `return_link: true` with a `send_link` and Zyphr mints that link but sends nothing, returning it in `data.link` (`link_sent` stays false). The same `link_suppressed_reason` values apply when no link can be minted. 
      * @summary Pre-provision (invite) an end user (server-side admin)
      * @param {InviteEndUserRequest} inviteEndUserRequest 
      * @param {*} [options] Override http request option.
@@ -185,7 +185,7 @@ export interface AuthUserDirectoryApiInterface {
     inviteEndUserRaw(requestParameters: AuthUserDirectoryApiInviteEndUserOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<InviteEndUser200Response>>;
 
     /**
-     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).  **Sending the email yourself:** pass `return_link: true` with a `send_link` and Zyphr mints that link but sends nothing, returning it in `data.link` (`link_sent` stays false). The same `link_suppressed_reason` values apply when no link can be minted. 
      * Pre-provision (invite) an end user (server-side admin)
      */
     inviteEndUser(inviteEndUserRequest: InviteEndUserRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<InviteEndUser200Response>;
@@ -539,7 +539,7 @@ export class AuthUserDirectoryApi extends runtime.BaseAPI implements AuthUserDir
     }
 
     /**
-     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).  **Sending the email yourself:** pass `return_link: true` with a `send_link` and Zyphr mints that link but sends nothing, returning it in `data.link` (`link_sent` stays false). The same `link_suppressed_reason` values apply when no link can be minted. 
      * Pre-provision (invite) an end user (server-side admin)
      */
     async inviteEndUserRaw(requestParameters: AuthUserDirectoryApiInviteEndUserOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<InviteEndUser200Response>> {
@@ -590,7 +590,7 @@ export class AuthUserDirectoryApi extends runtime.BaseAPI implements AuthUserDir
     }
 
     /**
-     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+     * Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset\'s. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application\'s redirect_uris allowlist (custom schemes such as yourapp://path are permitted).  **Sending the email yourself:** pass `return_link: true` with a `send_link` and Zyphr mints that link but sends nothing, returning it in `data.link` (`link_sent` stays false). The same `link_suppressed_reason` values apply when no link can be minted. 
      * Pre-provision (invite) an end user (server-side admin)
      */
     async inviteEndUser(inviteEndUserRequest: InviteEndUserRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<InviteEndUser200Response> {

package/src/src/models/ForgotPasswordRequest.ts

@@ -31,6 +31,15 @@ export interface ForgotPasswordRequest {
      * @memberof ForgotPasswordRequest
      */
     redirectUrl?: string;
+    /**
+     * When true, Zyphr mints the token but sends no email, and returns the
+     * link in `data.link` so you can render and send the email yourself
+     * (for example through `POST /v1/emails`). Requires `redirect_url`.
+     * 
+     * @type {boolean}
+     * @memberof ForgotPasswordRequest
+     */
+    returnLink?: boolean;
 }
 
 /**
@@ -53,6 +62,7 @@ export function ForgotPasswordRequestFromJSONTyped(json: any, ignoreDiscriminato
         
         'email': json['email'],
         'redirectUrl': json['redirect_url'] == null ? undefined : json['redirect_url'],
+        'returnLink': json['return_link'] == null ? undefined : json['return_link'],
     };
 }
 
@@ -69,6 +79,7 @@ export function ForgotPasswordRequestToJSONTyped(value?: ForgotPasswordRequest |
         
         'email': value['email'],
         'redirect_url': value['redirectUrl'],
+        'return_link': value['returnLink'],
     };
 }
 

package/src/src/models/ForgotPasswordResult.ts

@@ -0,0 +1,88 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Zyphr API
+ * Zyphr is a developer platform for user authentication and transactional messaging. One API covers auth (passkeys, social sign-in, passwordless, MFA, sessions, organizations) plus email, push notifications, SMS, in-app messages, and webhooks.  ## Authentication  All API requests require authentication using an API key. Include your API key in the `X-API-Key` header:  ``` X-API-Key: zy_live_xxxxxxxxxxxx ```  API keys can be created in the Zyphr Dashboard.  > **Test keys are being retired.** `zy_test_*` keys are no longer issued, and existing ones stop working on **21 October 2026**. They never delivered mail — sends were mocked and marked sent without reaching a provider, so they could not verify domain authentication, rendering, or deliverability. To test your integration, use a `zy_live_*` key against a verified domain and send to an address you control.  ## Rate Limiting  The API implements rate limiting to ensure fair usage. Rate limit information is included in response headers:  - `X-RateLimit-Limit`: Maximum requests per window - `X-RateLimit-Remaining`: Remaining requests in current window - `X-RateLimit-Reset`: Unix timestamp when the window resets  ## Account Sending Status  Every authenticated response carries the account\'s current sending state so you can surface it in your own tooling without a separate call:  - `X-Account-Sending-Status`: `active`, `throttled`, or `frozen` - `X-Account-Sending-Status-Reason`: human-readable reason (present only when the status is `throttled` or `frozen`)  This header is informational and non-blocking on non-send endpoints (reads, billing, and deliverability stay available). Send-capable endpoints additionally enforce the state: a frozen account receives `403 account_frozen` and a throttled account receives `429 account_throttled`, both with the reason in the error message.  ## Errors  All errors follow a consistent format:  ```json {   \"error\": {     \"code\": \"error_code\",     \"message\": \"Human readable message\",     \"details\": {}   },   \"meta\": {     \"request_id\": \"req_xxxx\"   } } ```
+ *
+ * The version of the OpenAPI document: 1.0.0
+ * Contact: support@zyphr.dev
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { ForgotPasswordResultData } from './ForgotPasswordResultData';
+import {
+    ForgotPasswordResultDataFromJSON,
+    ForgotPasswordResultDataFromJSONTyped,
+    ForgotPasswordResultDataToJSON,
+    ForgotPasswordResultDataToJSONTyped,
+} from './ForgotPasswordResultData';
+import type { GetDomain200ResponseMeta } from './GetDomain200ResponseMeta';
+import {
+    GetDomain200ResponseMetaFromJSON,
+    GetDomain200ResponseMetaFromJSONTyped,
+    GetDomain200ResponseMetaToJSON,
+    GetDomain200ResponseMetaToJSONTyped,
+} from './GetDomain200ResponseMeta';
+
+/**
+ * 
+ * @export
+ * @interface ForgotPasswordResult
+ */
+export interface ForgotPasswordResult {
+    /**
+     * 
+     * @type {ForgotPasswordResultData}
+     * @memberof ForgotPasswordResult
+     */
+    data?: ForgotPasswordResultData;
+    /**
+     * 
+     * @type {GetDomain200ResponseMeta}
+     * @memberof ForgotPasswordResult
+     */
+    meta?: GetDomain200ResponseMeta;
+}
+
+/**
+ * Check if a given object implements the ForgotPasswordResult interface.
+ */
+export function instanceOfForgotPasswordResult(value: object): value is ForgotPasswordResult {
+    return true;
+}
+
+export function ForgotPasswordResultFromJSON(json: any): ForgotPasswordResult {
+    return ForgotPasswordResultFromJSONTyped(json, false);
+}
+
+export function ForgotPasswordResultFromJSONTyped(json: any, ignoreDiscriminator: boolean): ForgotPasswordResult {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'data': json['data'] == null ? undefined : ForgotPasswordResultDataFromJSON(json['data']),
+        'meta': json['meta'] == null ? undefined : GetDomain200ResponseMetaFromJSON(json['meta']),
+    };
+}
+
+export function ForgotPasswordResultToJSON(json: any): ForgotPasswordResult {
+    return ForgotPasswordResultToJSONTyped(json, false);
+}
+
+export function ForgotPasswordResultToJSONTyped(value?: ForgotPasswordResult | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'data': ForgotPasswordResultDataToJSON(value['data']),
+        'meta': GetDomain200ResponseMetaToJSON(value['meta']),
+    };
+}
+

package/src/src/models/ForgotPasswordResultData.ts

@@ -0,0 +1,100 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Zyphr API
+ * Zyphr is a developer platform for user authentication and transactional messaging. One API covers auth (passkeys, social sign-in, passwordless, MFA, sessions, organizations) plus email, push notifications, SMS, in-app messages, and webhooks.  ## Authentication  All API requests require authentication using an API key. Include your API key in the `X-API-Key` header:  ``` X-API-Key: zy_live_xxxxxxxxxxxx ```  API keys can be created in the Zyphr Dashboard.  > **Test keys are being retired.** `zy_test_*` keys are no longer issued, and existing ones stop working on **21 October 2026**. They never delivered mail — sends were mocked and marked sent without reaching a provider, so they could not verify domain authentication, rendering, or deliverability. To test your integration, use a `zy_live_*` key against a verified domain and send to an address you control.  ## Rate Limiting  The API implements rate limiting to ensure fair usage. Rate limit information is included in response headers:  - `X-RateLimit-Limit`: Maximum requests per window - `X-RateLimit-Remaining`: Remaining requests in current window - `X-RateLimit-Reset`: Unix timestamp when the window resets  ## Account Sending Status  Every authenticated response carries the account\'s current sending state so you can surface it in your own tooling without a separate call:  - `X-Account-Sending-Status`: `active`, `throttled`, or `frozen` - `X-Account-Sending-Status-Reason`: human-readable reason (present only when the status is `throttled` or `frozen`)  This header is informational and non-blocking on non-send endpoints (reads, billing, and deliverability stay available). Send-capable endpoints additionally enforce the state: a frozen account receives `403 account_frozen` and a throttled account receives `429 account_throttled`, both with the reason in the error message.  ## Errors  All errors follow a consistent format:  ```json {   \"error\": {     \"code\": \"error_code\",     \"message\": \"Human readable message\",     \"details\": {}   },   \"meta\": {     \"request_id\": \"req_xxxx\"   } } ```
+ *
+ * The version of the OpenAPI document: 1.0.0
+ * Contact: support@zyphr.dev
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { mapValues } from '../runtime';
+import type { ReturnedAuthLink } from './ReturnedAuthLink';
+import {
+    ReturnedAuthLinkFromJSON,
+    ReturnedAuthLinkFromJSONTyped,
+    ReturnedAuthLinkToJSON,
+    ReturnedAuthLinkToJSONTyped,
+} from './ReturnedAuthLink';
+
+/**
+ * 
+ * @export
+ * @interface ForgotPasswordResultData
+ */
+export interface ForgotPasswordResultData {
+    /**
+     * 
+     * @type {boolean}
+     * @memberof ForgotPasswordResultData
+     */
+    success?: boolean;
+    /**
+     * Present only when `return_link` was true; null when no link was minted.
+     * @type {ReturnedAuthLink}
+     * @memberof ForgotPasswordResultData
+     */
+    link?: ReturnedAuthLink | null;
+    /**
+     * Present only when `return_link` was true and `link` is null.
+     * @type {string}
+     * @memberof ForgotPasswordResultData
+     */
+    linkSuppressedReason?: ForgotPasswordResultDataLinkSuppressedReasonEnum;
+}
+
+
+/**
+ * @export
+ */
+export const ForgotPasswordResultDataLinkSuppressedReasonEnum = {
+    USER_NOT_FOUND: 'user_not_found',
+    IDENTITY_HAS_OTHER_AUTH_METHODS: 'identity_has_other_auth_methods'
+} as const;
+export type ForgotPasswordResultDataLinkSuppressedReasonEnum = typeof ForgotPasswordResultDataLinkSuppressedReasonEnum[keyof typeof ForgotPasswordResultDataLinkSuppressedReasonEnum];
+
+
+/**
+ * Check if a given object implements the ForgotPasswordResultData interface.
+ */
+export function instanceOfForgotPasswordResultData(value: object): value is ForgotPasswordResultData {
+    return true;
+}
+
+export function ForgotPasswordResultDataFromJSON(json: any): ForgotPasswordResultData {
+    return ForgotPasswordResultDataFromJSONTyped(json, false);
+}
+
+export function ForgotPasswordResultDataFromJSONTyped(json: any, ignoreDiscriminator: boolean): ForgotPasswordResultData {
+    if (json == null) {
+        return json;
+    }
+    return {
+        
+        'success': json['success'] == null ? undefined : json['success'],
+        'link': json['link'] == null ? undefined : ReturnedAuthLinkFromJSON(json['link']),
+        'linkSuppressedReason': json['link_suppressed_reason'] == null ? undefined : json['link_suppressed_reason'],
+    };
+}
+
+export function ForgotPasswordResultDataToJSON(json: any): ForgotPasswordResultData {
+    return ForgotPasswordResultDataToJSONTyped(json, false);
+}
+
+export function ForgotPasswordResultDataToJSONTyped(value?: ForgotPasswordResultData | null, ignoreDiscriminator: boolean = false): any {
+    if (value == null) {
+        return value;
+    }
+
+    return {
+        
+        'success': value['success'],
+        'link': ReturnedAuthLinkToJSON(value['link']),
+        'link_suppressed_reason': value['linkSuppressedReason'],
+    };
+}
+

package/src/src/models/InviteEndUser200ResponseData.ts

@@ -13,6 +13,14 @@
  */
 
 import { mapValues } from '../runtime';
+import type { ReturnedAuthLink } from './ReturnedAuthLink';
+import {
+    ReturnedAuthLinkFromJSON,
+    ReturnedAuthLinkFromJSONTyped,
+    ReturnedAuthLinkToJSON,
+    ReturnedAuthLinkToJSONTyped,
+} from './ReturnedAuthLink';
+
 /**
  * 
  * @export
@@ -37,6 +45,12 @@ export interface InviteEndUser200ResponseData {
      * @memberof InviteEndUser200ResponseData
      */
     linkSent?: boolean;
+    /**
+     * 
+     * @type {ReturnedAuthLink}
+     * @memberof InviteEndUser200ResponseData
+     */
+    link?: ReturnedAuthLink;
     /**
      * Present only when `send_link` was requested and `link_sent` is false — explains why,
      * so a caller can distinguish "suppressed by design" from "delivery failed".
@@ -86,6 +100,7 @@ export function InviteEndUser200ResponseDataFromJSONTyped(json: any, ignoreDiscr
         'userId': json['user_id'] == null ? undefined : json['user_id'],
         'created': json['created'] == null ? undefined : json['created'],
         'linkSent': json['link_sent'] == null ? undefined : json['link_sent'],
+        'link': json['link'] == null ? undefined : ReturnedAuthLinkFromJSON(json['link']),
         'linkSuppressedReason': json['link_suppressed_reason'] == null ? undefined : json['link_suppressed_reason'],
     };
 }
@@ -104,6 +119,7 @@ export function InviteEndUser200ResponseDataToJSONTyped(value?: InviteEndUser200
         'user_id': value['userId'],
         'created': value['created'],
         'link_sent': value['linkSent'],
+        'link': ReturnedAuthLinkToJSON(value['link']),
         'link_suppressed_reason': value['linkSuppressedReason'],
     };
 }

package/src/src/models/InviteEndUserRequest.ts

@@ -49,6 +49,12 @@ export interface InviteEndUserRequest {
      * @memberof InviteEndUserRequest
      */
     redirectUrl?: string;
+    /**
+     * Return the link in `data.link` instead of emailing it. Requires `send_link` other than "none".
+     * @type {boolean}
+     * @memberof InviteEndUserRequest
+     */
+    returnLink?: boolean;
 }
 
 
@@ -87,6 +93,7 @@ export function InviteEndUserRequestFromJSONTyped(json: any, ignoreDiscriminator
         'metadata': json['metadata'] == null ? undefined : json['metadata'],
         'sendLink': json['send_link'] == null ? undefined : json['send_link'],
         'redirectUrl': json['redirect_url'] == null ? undefined : json['redirect_url'],
+        'returnLink': json['return_link'] == null ? undefined : json['return_link'],
     };
 }
 
@@ -106,6 +113,7 @@ export function InviteEndUserRequestToJSONTyped(value?: InviteEndUserRequest | n
         'metadata': value['metadata'],
         'send_link': value['sendLink'],
         'redirect_url': value['redirectUrl'],
+        'return_link': value['returnLink'],
     };
 }
 

package/src/src/models/MagicLinkSendRequest.ts

@@ -31,6 +31,15 @@ export interface MagicLinkSendRequest {
      * @memberof MagicLinkSendRequest
      */
     redirectUrl?: string;
+    /**
+     * When true, Zyphr mints the token but sends no email, and returns the
+     * link in `data.link` so you can render and send the email yourself
+     * (for example through `POST /v1/emails`). Requires `redirect_url`.
+     * 
+     * @type {boolean}
+     * @memberof MagicLinkSendRequest
+     */
+    returnLink?: boolean;
 }
 
 /**
@@ -53,6 +62,7 @@ export function MagicLinkSendRequestFromJSONTyped(json: any, ignoreDiscriminator
         
         'email': json['email'],
         'redirectUrl': json['redirect_url'] == null ? undefined : json['redirect_url'],
+        'returnLink': json['return_link'] == null ? undefined : json['return_link'],
     };
 }
 
@@ -69,6 +79,7 @@ export function MagicLinkSendRequestToJSONTyped(value?: MagicLinkSendRequest | n
         
         'email': value['email'],
         'redirect_url': value['redirectUrl'],
+        'return_link': value['returnLink'],
     };
 }