@proveanything/smartlinks 2.0.28 → 2.0.30

package/dist/ai-tools.d.ts

@@ -29,6 +29,8 @@ export declare const AI_TOOL_NAMES: {
     readonly PDF_INSPECT: "pdf.inspect";
     readonly PDF_RENDER: "pdf.render";
     readonly PDF_EXTRACT: "pdf.extract";
+    readonly PDF_DECODE_BARCODES: "pdf.decodeBarcodes";
+    readonly PDF_INSPECT_GRAPHICS: "pdf.inspectGraphics";
     readonly HTTP_REQUEST: "http.request";
     readonly TRANSLATE: "translate";
 };

package/dist/ai-tools.js

@@ -26,6 +26,8 @@ export const AI_TOOL_NAMES = {
     PDF_INSPECT: 'pdf.inspect',
     PDF_RENDER: 'pdf.render',
     PDF_EXTRACT: 'pdf.extract',
+    PDF_DECODE_BARCODES: 'pdf.decodeBarcodes',
+    PDF_INSPECT_GRAPHICS: 'pdf.inspectGraphics',
     HTTP_REQUEST: 'http.request',
     TRANSLATE: 'translate',
 };
@@ -66,7 +68,11 @@ export const BUILTIN_AI_TOOLS = [
     { name: 'pdf.render', group: 'media', capabilities: ['web:read'],
         description: 'Rasterize a single PDF page to a PNG at a controllable DPI (e.g. 300 for small print) and return a hosted image URL — feed to a vision call or screenshot a page.' },
     { name: 'pdf.extract', group: 'media', capabilities: ['web:read', 'ai:vision'],
-        description: 'Extract typed JSON from a PDF in one call given a schema and/or prompt. Auto-routes: text-layer pages use cheap text extraction; curve-only/raster pages are rendered and read with vision.' },
+        description: 'Extract typed JSON from a PDF in one call given a schema and/or prompt. Auto-routes: text-layer pages use cheap text extraction; curve-only/raster pages are rendered and read with vision. Optional per-field confidence/source (includeConfidence) and bounding boxes (includeBoxes).' },
+    { name: 'pdf.decodeBarcodes', group: 'media', capabilities: ['web:read'],
+        description: 'Deterministically decode 1D/2D barcodes (EAN/UPC/QR/Code128/DataMatrix/…) on a PDF page by rasterizing and running a WASM decoder — reliable barcode/QR values where vision hallucinates. Returns value, symbology, page, bbox, confidence. No AI.' },
+    { name: 'pdf.inspectGraphics', group: 'media', capabilities: ['web:read'],
+        description: 'Prepress structural inspection: per-page vector-path/image/outlined-text counts + colour spaces used, plus document-level named SPOT colours (e.g. "PANTONE 871 C"). Answers whether spot/foil plates survived. Deterministic, no AI.' },
     { name: 'http.request', group: 'net', capabilities: ['net:http'],
         description: 'SSRF-guarded outbound HTTP(S) request to a public URL; returns status/headers/body.' },
     { name: 'translate', group: 'text', capabilities: ['ai:text'],

package/dist/api/collection.d.ts

@@ -1,4 +1,4 @@
-import { CollectionResponse, CollectionCreateRequest, CollectionUpdateRequest, AppsConfigResponse, DomainTarget, HubAvailabilityResponse } from "../types/collection.js";
+import { CollectionResponse, CollectionCreateRequest, CollectionUpdateRequest, AppsConfigResponse, DomainTarget, HubAvailabilityResponse, CollectionUser, CollectionAccessLevel, InviteUserInput } from "../types/collection.js";
 export declare namespace collection {
     /**
      * Retrieves a single Collection by its ID.
@@ -170,4 +170,35 @@ export declare namespace collection {
      * @throws ErrorResponse if the request fails
      */
     function assignSN(collectionId: string, codeId: string, value: any): Promise<any>;
+    /**
+     * List the users with access to a collection, each with their access level (admin only). Access is
+     * stored in the collection's `roles` map (userId → level); this resolves each to name/email.
+     * GET /admin/collection/:collectionId/getUsers
+     * @param collectionId - Identifier of the collection
+     * @returns Promise resolving to the collection's users
+     */
+    function getUsers(collectionId: string): Promise<CollectionUser[]>;
+    /**
+     * Grant, change, or remove a user's access level on a collection (admin only). Pass `null` or
+     * `'None'` to remove access. The server enforces privilege-escalation rules — you cannot grant an
+     * access level above your own, nor change a user whose level is above yours.
+     * POST /admin/collection/:collectionId/updateUserAccess
+     * @param collectionId - Identifier of the collection
+     * @param userId - The user (auth uid) whose access to change
+     * @param access - The new access level, or `null` to remove access
+     */
+    function setUserAccess(collectionId: string, userId: string, access: CollectionAccessLevel | null): Promise<void>;
+    /**
+     * Invite a user to a collection by email (admin only). Creates or links their account in the login /
+     * auth-kit collection (`loginCollectionId`, default `'global'`) and emails them an invite (new account)
+     * or an added-to-collection notice (existing account); returns their `uid`. This does NOT grant access
+     * on its own — follow with {@link setUserAccess} to set their level (this mirrors the console flow).
+     * POST /user/inviteUser
+     * @param collectionId - The collection the user is being added to (the invite's target)
+     * @param input - Invite details (email, optional name, access level, login collection, origin)
+     * @returns Promise resolving to the invited user's `{ uid }`
+     */
+    function inviteUser(collectionId: string, input: InviteUserInput): Promise<{
+        uid: string;
+    }>;
 }

package/dist/api/collection.js

@@ -253,4 +253,54 @@ export var collection;
         return post(path, { value });
     }
     collection.assignSN = assignSN;
+    /**
+     * List the users with access to a collection, each with their access level (admin only). Access is
+     * stored in the collection's `roles` map (userId → level); this resolves each to name/email.
+     * GET /admin/collection/:collectionId/getUsers
+     * @param collectionId - Identifier of the collection
+     * @returns Promise resolving to the collection's users
+     */
+    async function getUsers(collectionId) {
+        return request(`/admin/collection/${encodeURIComponent(collectionId)}/getUsers`);
+    }
+    collection.getUsers = getUsers;
+    /**
+     * Grant, change, or remove a user's access level on a collection (admin only). Pass `null` or
+     * `'None'` to remove access. The server enforces privilege-escalation rules — you cannot grant an
+     * access level above your own, nor change a user whose level is above yours.
+     * POST /admin/collection/:collectionId/updateUserAccess
+     * @param collectionId - Identifier of the collection
+     * @param userId - The user (auth uid) whose access to change
+     * @param access - The new access level, or `null` to remove access
+     */
+    async function setUserAccess(collectionId, userId, access) {
+        await post(`/admin/collection/${encodeURIComponent(collectionId)}/updateUserAccess`, {
+            userId,
+            access: access !== null && access !== void 0 ? access : 'None'
+        });
+    }
+    collection.setUserAccess = setUserAccess;
+    /**
+     * Invite a user to a collection by email (admin only). Creates or links their account in the login /
+     * auth-kit collection (`loginCollectionId`, default `'global'`) and emails them an invite (new account)
+     * or an added-to-collection notice (existing account); returns their `uid`. This does NOT grant access
+     * on its own — follow with {@link setUserAccess} to set their level (this mirrors the console flow).
+     * POST /user/inviteUser
+     * @param collectionId - The collection the user is being added to (the invite's target)
+     * @param input - Invite details (email, optional name, access level, login collection, origin)
+     * @returns Promise resolving to the invited user's `{ uid }`
+     */
+    async function inviteUser(collectionId, input) {
+        var _a, _b;
+        const consoleOrigin = (_a = input.consoleOrigin) !== null && _a !== void 0 ? _a : (typeof window !== 'undefined' ? window.location.origin : undefined);
+        return post(`/user/inviteUser`, {
+            email: input.email.trim(),
+            name: input.name,
+            collectionId: (_b = input.loginCollectionId) !== null && _b !== void 0 ? _b : 'global',
+            targetCollectionId: collectionId,
+            accessLevel: input.access,
+            consoleOrigin
+        });
+    }
+    collection.inviteUser = inviteUser;
 })(collection || (collection = {}));

package/dist/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.0.28  |  Generated: 2026-09-28T13:20:09.049Z
+Version: 2.0.30  |  Generated: 2026-09-29T17:13:26.956Z
 
 This is a concise summary of all available API functions and types.
 
@@ -1485,7 +1485,21 @@ interface PdfRenderArgs {
 **PdfExtractArgs** (interface)
 ```typescript
 interface PdfExtractArgs {
-  url: string; schema?: Record<string, any>; prompt?: string; maxPages?: number; dpi?: number
+  url: string; schema?: Record<string, any>; prompt?: string; maxPages?: number; dpi?: number; includeConfidence?: boolean; includeBoxes?: boolean
+}
+```
+
+**PdfDecodeBarcodesArgs** (interface)
+```typescript
+interface PdfDecodeBarcodesArgs {
+  url: string; page?: number; dpi?: number
+}
+```
+
+**PdfInspectGraphicsArgs** (interface)
+```typescript
+interface PdfInspectGraphicsArgs {
+  url: string; page?: number
 }
 ```
 
@@ -1524,6 +1538,8 @@ interface AiToolArgsMap {
   'pdf.inspect': PdfInspectArgs
   'pdf.render': PdfRenderArgs
   'pdf.extract': PdfExtractArgs
+  'pdf.decodeBarcodes': PdfDecodeBarcodesArgs
+  'pdf.inspectGraphics': PdfInspectGraphicsArgs
   'http.request': HttpRequestArgs
   'translate': TranslateArgs
 }
@@ -1613,10 +1629,45 @@ interface PdfRenderResult {
 }
 ```
 
+**PdfFieldMeta** (interface)
+```typescript
+interface PdfFieldMeta {
+  confidence?: number | null; source?: 'text' | 'vision' | 'inferred'; bbox?: { x: number; y: number; w: number; h: number; page: number }
+}
+```
+
 **PdfExtractResult** (interface)
 ```typescript
 interface PdfExtractResult {
-  url: string; method: 'text' | 'vision'; pagesRead: number; fields: Record<string, any>
+  url: string; method: 'text' | 'vision'; pagesRead: number; fields: Record<string, any>; fieldsMeta?: Record<string, PdfFieldMeta>
+}
+```
+
+**PdfBarcode** (interface)
+```typescript
+interface PdfBarcode {
+  type: string; format: string; value: string; page: number; bbox?: { x: number; y: number; w: number; h: number }; confidence: number
+}
+```
+
+**PdfDecodeBarcodesResult** (interface)
+```typescript
+interface PdfDecodeBarcodesResult {
+  url: string; pagesScanned: number; codes: PdfBarcode[]
+}
+```
+
+**PdfGraphicsPage** (interface)
+```typescript
+interface PdfGraphicsPage {
+  page: number; paths: number; images: number; textRuns: number; colourSpaces: string[]
+}
+```
+
+**PdfInspectGraphicsResult** (interface)
+```typescript
+interface PdfInspectGraphicsResult {
+  url: string; pages: PdfGraphicsPage[]; spotColours: string[]; note: string
 }
 ```
 
@@ -4660,6 +4711,27 @@ interface AppConfig {
 }
 ```
 
+**CollectionUser** (interface)
+```typescript
+interface CollectionUser {
+  uid: string
+  access: CollectionAccessLevel | string
+  name?: string
+  email?: string
+}
+```
+
+**InviteUserInput** (interface)
+```typescript
+interface InviteUserInput {
+  email: string
+  name?: string
+  access: CollectionAccessLevel | string
+  loginCollectionId?: string
+  consoleOrigin?: string
+}
+```
+
 **CollectionResponse** = `Collection`
 
 **CollectionCreateRequest** = `Omit<Collection, 'id' | 'shortId'>`
@@ -4668,6 +4740,8 @@ interface AppConfig {
 
 **DomainTarget** = `"smartlinks" | "hub"`
 
+**CollectionAccessLevel** = `'Owner' | 'Admin' | 'Assigner' | 'Reporter' | 'User' | 'None'`
+
 ### common
 
 **IdField** = `'userId' | 'contactId'`
@@ -10382,6 +10456,18 @@ Look up a serial number by code for a collection (admin only).
     value: any) → `Promise<any>`
 Assign a value to a serial number for a collection (admin only).
 
+**getUsers**(collectionId: string) → `Promise<CollectionUser[]>`
+List the users with access to a collection, each with their access level (admin only). Access is stored in the collection's `roles` map (userId → level); this resolves each to name/email. GET /admin/collection/:collectionId/getUsers
+
+**setUserAccess**(collectionId: string,
+    userId: string,
+    access: CollectionAccessLevel | null) → `Promise<void>`
+Grant, change, or remove a user's access level on a collection (admin only). Pass `null` or `'None'` to remove access. The server enforces privilege-escalation rules — you cannot grant an access level above your own, nor change a user whose level is above yours. POST /admin/collection/:collectionId/updateUserAccess
+
+**inviteUser**(collectionId: string,
+    input: InviteUserInput) → `Promise<`
+Invite a user to a collection by email (admin only). Creates or links their account in the login / auth-kit collection (`loginCollectionId`, default `'global'`) and emails them an invite (new account) or an added-to-collection notice (existing account); returns their `uid`. This does NOT grant access on its own — follow with {@link setUserAccess} to set their level (this mirrors the console flow). POST /user/inviteUser
+
 ### comms
 
 **getPushVapidPublicKey**(collectionId: string) → `Promise<import("../types/comms").PushVapidResponse>`

package/dist/docs/ai.md

@@ -324,15 +324,40 @@ in `input`.
 | `image.searchStock` | Search real stock photos (Unsplash). |
 | `image.transform` | Resize / crop / rotate / grayscale / format-convert / compress → hosted URL. |
 | `pdf.create` | Render HTML → PDF → hosted URL. |
-| `pdf.fill` | Fill an AcroForm PDF's fields → hosted URL. |
-| `pdf.merge` | Merge several PDFs into one → hosted URL. |
+| `pdf.fill` | Fill an AcroForm PDF's fields (`{ field: value }`) → hosted URL. |
+| `pdf.merge` | Merge several PDFs into one, in order → hosted URL. |
+| `pdf.inspect` | Cheap, no-AI introspection: page count/sizes, which pages have a real text layer, raster present, and a routing hint (`text` vs `vision`). |
+| `pdf.render` | Rasterize one page to a PNG at a chosen DPI → hosted image URL (feed to vision, or screenshot a page). |
+| `pdf.extract` | PDF → typed JSON in one call (schema and/or prompt). Auto-routes text vs vision. Optional per-field `confidence`/`source` (`includeConfidence`) and `bbox` (`includeBoxes`) in `fieldsMeta`. |
+| `pdf.decodeBarcodes` | Deterministically decode barcodes/QR on a page (WASM, no AI) → value + symbology + page + bbox + confidence. Use this for barcode digits, never vision. |
+| `pdf.inspectGraphics` | Prepress inspection: per-page path/image/outlined-text counts + colour spaces, plus named SPOT colours (e.g. "PANTONE 871 C"). No AI. |
 | `http.request` | SSRF-guarded outbound HTTP(S) to a public URL (call a REST API). |
 | `translate` | Translate text into one or more languages (generic, model-based). |
 
+**Working with PDFs.** The PDF tools split into *read/analyse* and *produce*:
+
+- **Read a whole PDF as text** → `document.read` (Firecrawl; good for prose/decks).
+- **Turn a PDF into structured fields** → `pdf.extract` (give it a JSON schema and/or a prompt; it
+  returns typed JSON). It routes itself, but you can drive the route yourself: call `pdf.inspect`
+  first (deterministic, no AI) to see whether each page has a real text layer, then `pdf.extract`
+  (cheap text path) or `pdf.render` → `image.describe`/vision for curve-only or raster artwork.
+- **Zoom in on small print** (INCI/allergen lists) → `pdf.render` at a high DPI (e.g. 300), then read
+  the PNG with vision.
+- **Barcodes / QR** → `pdf.decodeBarcodes` (deterministic WASM decode) — never trust vision for barcode
+  digits; it hallucinates them.
+- **Prepress / print QA** (spot colours, colour spaces, vector vs raster) → `pdf.inspectGraphics`.
+- **A review UI that flags guessed fields** → `pdf.extract` with `includeConfidence` (per-field
+  confidence + source) and `includeBoxes` (per-field bbox on text-native pages) in `fieldsMeta`.
+- **Produce a PDF** → `pdf.create` (HTML → PDF), `pdf.fill` (populate an AcroForm's fields),
+  `pdf.merge` (combine several). These return a hosted `hostedUrl`.
+
+Every tool is also directly callable without the model loop via `ai.tools.run(collectionId, name,
+args)` — e.g. render a page or extract fields straight from a UI, no agent round-trip.
+
 Discover tools two ways:
 - **Design time (typed):** import `BUILTIN_AI_TOOLS`, `AI_TOOL_NAMES`, and the per-tool arg types
-  (`WebSearchArgs`, `DataExtractArgs`, …) from the SDK. This is the core set — stable, versioned,
-  documented here.
+  (`WebSearchArgs`, `DataExtractArgs`, `PdfExtractArgs`, …) from the SDK. This is the core set —
+  stable, versioned, documented here.
 - **Runtime (live):** `await ai.catalog(collectionId)` returns the registry as the server sees it,
   including any future app-contributed tools. The built-in set above is always present.
 

package/dist/docs/server-functions.md

@@ -400,6 +400,12 @@ Prefer the platform primitives above over a dependency; when you do need one, pi
 | Schema validation of inputs | no | `zod` |
 | JWT (sign/verify for a third-party API) | Web Crypto can, verbosely | `jose` |
 | Hash / HMAC / encrypt | **native** — `crypto.subtle` | — |
+| PDF **text** extraction (cheap first-pass, no AI) | no | `unpdf` — a serverless/WASM pdf.js build with no Node deps; `import { extractText } from 'unpdf'`. Text only. |
+
+> **PDFs in a server function:** for a cheap text-layer check use `unpdf` (edge-safe, WASM). For
+> anything heavier — rendering pages, vision extraction, **barcode/QR decode**, or prepress/spot-colour
+> inspection — call the platform tools `pdf.render` / `pdf.extract` / `pdf.decodeBarcodes` /
+> `pdf.inspectGraphics` via `ai.tools.run`; those run in the full platform runtime, not the sandbox.
 
 **The common actions, and how to do each:**
 

package/dist/openapi.yaml

@@ -4334,6 +4334,35 @@ paths:
           description: Unauthorized
         404:
           description: Not found
+  /admin/collection/{collectionId}/getUsers:
+    get:
+      tags:
+        - collection
+      summary: List the users with access to a collection, each with their access level (admin only).
+      operationId: collection_getUsers
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: collectionId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/CollectionUser"
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
   /admin/collection/{collectionId}/hub:
     post:
       tags:
@@ -8694,6 +8723,38 @@ paths:
           application/json:
             schema:
               $ref: "#/components/schemas/TranslationUpdateRequest"
+  /admin/collection/{collectionId}/updateUserAccess:
+    post:
+      tags:
+        - collection
+      summary: "Grant, change, or remove a user's access level on a collection (admin only)."
+      operationId: collection_setUserAccess
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: collectionId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema: {}
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CollectionAccessLevel"
   /admin/collection/{encodedCollectionId}/comm/send:
     post:
       tags:
@@ -17064,6 +17125,22 @@ components:
           additionalProperties: true
       required:
         - url
+    PdfDecodeBarcodesArgs:
+      type: object
+      properties:
+        url:
+          type: object
+          additionalProperties: true
+      required:
+        - url
+    PdfInspectGraphicsArgs:
+      type: object
+      properties:
+        url:
+          type: object
+          additionalProperties: true
+      required:
+        - url
     HttpRequestArgs:
       type: object
       properties:
@@ -17125,6 +17202,10 @@ components:
           $ref: "#/components/schemas/PdfRenderArgs"
         pdf.extract:
           $ref: "#/components/schemas/PdfExtractArgs"
+        pdf.decodeBarcodes:
+          $ref: "#/components/schemas/PdfDecodeBarcodesArgs"
+        pdf.inspectGraphics:
+          $ref: "#/components/schemas/PdfInspectGraphicsArgs"
         http.request:
           $ref: "#/components/schemas/HttpRequestArgs"
         translate:
@@ -17148,6 +17229,8 @@ components:
         - pdf.inspect
         - pdf.render
         - pdf.extract
+        - pdf.decodeBarcodes
+        - pdf.inspectGraphics
         - http.request
         - translate
     WebSearchResultItem:
@@ -17256,6 +17339,12 @@ components:
           additionalProperties: true
       required:
         - url
+    PdfFieldMeta:
+      type: object
+      properties:
+        confidence:
+          type: object
+          additionalProperties: true
     PdfExtractResult:
       type: object
       properties:
@@ -17266,6 +17355,42 @@ components:
             - vision
       required:
         - url
+    PdfBarcode:
+      type: object
+      properties:
+        type:
+          type: object
+          additionalProperties: true
+      required:
+        - type
+    PdfDecodeBarcodesResult:
+      type: object
+      properties:
+        url:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
+      required:
+        - url
+    PdfGraphicsPage:
+      type: object
+      properties:
+        page:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
+      required:
+        - page
+    PdfInspectGraphicsResult:
+      type: object
+      properties:
+        url:
+          type: object
+          additionalProperties: true
+      required:
+        - url
     ResponsesAgentTrace:
       type: object
       properties:
@@ -17347,6 +17472,8 @@ components:
         - pdf.inspect
         - pdf.render
         - pdf.extract
+        - pdf.decodeBarcodes
+        - pdf.inspectGraphics
         - http.request
         - translate
     AgentStreamEvent:
@@ -22643,6 +22770,38 @@ components:
             $ref: "#/components/schemas/AppConfig"
       required:
         - apps
+    CollectionUser:
+      type: object
+      properties:
+        uid:
+          type: string
+        access:
+          type: object
+          additionalProperties: true
+        name:
+          type: string
+        email:
+          type: string
+      required:
+        - uid
+        - access
+    InviteUserInput:
+      type: object
+      properties:
+        email:
+          type: string
+        name:
+          type: string
+        access:
+          type: object
+          additionalProperties: true
+        loginCollectionId:
+          type: string
+        consoleOrigin:
+          type: string
+      required:
+        - email
+        - access
     CollectionResponse:
       $ref: "#/components/schemas/Collection"
     CollectionCreateRequest:
@@ -22652,6 +22811,15 @@ components:
     DomainTarget:
       type: object
       additionalProperties: true
+    CollectionAccessLevel:
+      type: string
+      enum:
+        - Owner
+        - Admin
+        - Assigner
+        - Reporter
+        - User
+        - None
     IdField:
       type: string
       enum:

package/dist/types/ai.d.ts

@@ -848,7 +848,7 @@ export interface CatalogResponse {
 /** Capability tags a tool requires; scope a run with `allowCapabilities`. */
 export type AiToolCapability = 'web:read' | 'ai:vision' | 'ai:image' | 'ai:text' | 'media:image' | 'media:pdf' | 'net:http';
 /** The names of the built-in server-side agent tools (run via `server_tools`). */
-export type AiToolName = 'web.fetchPage' | 'web.extractSchema' | 'web.screenshot' | 'web.search' | 'brand.assets' | 'document.read' | 'data.extract' | 'image.describe' | 'image.generate' | 'image.fromReference' | 'image.searchStock' | 'image.transform' | 'pdf.create' | 'pdf.fill' | 'pdf.merge' | 'pdf.inspect' | 'pdf.render' | 'pdf.extract' | 'http.request' | 'translate';
+export type AiToolName = 'web.fetchPage' | 'web.extractSchema' | 'web.screenshot' | 'web.search' | 'brand.assets' | 'document.read' | 'data.extract' | 'image.describe' | 'image.generate' | 'image.fromReference' | 'image.searchStock' | 'image.transform' | 'pdf.create' | 'pdf.fill' | 'pdf.merge' | 'pdf.inspect' | 'pdf.render' | 'pdf.extract' | 'pdf.decodeBarcodes' | 'pdf.inspectGraphics' | 'http.request' | 'translate';
 export interface WebFetchPageArgs {
     url: string;
     type?: string;
@@ -956,6 +956,17 @@ export interface PdfExtractArgs {
     prompt?: string;
     maxPages?: number;
     dpi?: number;
+    includeConfidence?: boolean;
+    includeBoxes?: boolean;
+}
+export interface PdfDecodeBarcodesArgs {
+    url: string;
+    page?: number;
+    dpi?: number;
+}
+export interface PdfInspectGraphicsArgs {
+    url: string;
+    page?: number;
 }
 export interface HttpRequestArgs {
     url: string;
@@ -988,6 +999,8 @@ export interface AiToolArgsMap {
     'pdf.inspect': PdfInspectArgs;
     'pdf.render': PdfRenderArgs;
     'pdf.extract': PdfExtractArgs;
+    'pdf.decodeBarcodes': PdfDecodeBarcodesArgs;
+    'pdf.inspectGraphics': PdfInspectGraphicsArgs;
     'http.request': HttpRequestArgs;
     'translate': TranslateArgs;
 }
@@ -1077,11 +1090,56 @@ export interface PdfRenderResult {
     width: number;
     height: number;
 }
+/** Per-field metadata from pdf.extract when includeConfidence / includeBoxes is set. */
+export interface PdfFieldMeta {
+    confidence?: number | null;
+    source?: 'text' | 'vision' | 'inferred';
+    bbox?: {
+        x: number;
+        y: number;
+        w: number;
+        h: number;
+        page: number;
+    };
+}
 export interface PdfExtractResult {
     url: string;
     method: 'text' | 'vision';
     pagesRead: number;
     fields: Record<string, any>;
+    fieldsMeta?: Record<string, PdfFieldMeta>;
+}
+/** One decoded barcode/QR from pdf.decodeBarcodes. bbox is in PDF points (top-left origin). */
+export interface PdfBarcode {
+    type: string;
+    format: string;
+    value: string;
+    page: number;
+    bbox?: {
+        x: number;
+        y: number;
+        w: number;
+        h: number;
+    };
+    confidence: number;
+}
+export interface PdfDecodeBarcodesResult {
+    url: string;
+    pagesScanned: number;
+    codes: PdfBarcode[];
+}
+export interface PdfGraphicsPage {
+    page: number;
+    paths: number;
+    images: number;
+    textRuns: number;
+    colourSpaces: string[];
+}
+export interface PdfInspectGraphicsResult {
+    url: string;
+    pages: PdfGraphicsPage[];
+    spotColours: string[];
+    note: string;
 }
 /** The `_agent` trace attached to an agentic Responses result. */
 export interface ResponsesAgentTrace {

package/dist/types/collection.d.ts

@@ -153,3 +153,33 @@ export interface AppsConfigResponse extends Omit<AppConfigSettings, 'id' | 'apps
     /** Array of app catalog definitions for this collection. */
     apps: AppConfig[];
 }
+/**
+ * A user's access level on a collection. Access is stored in the collection's `roles` map
+ * (userId → level). Server-enforced tiers are `User` < `Admin` < `Owner`; `Reporter` / `Assigner`
+ * are legacy values still accepted but not part of the enforced hierarchy. `None` removes access.
+ */
+export type CollectionAccessLevel = 'Owner' | 'Admin' | 'Assigner' | 'Reporter' | 'User' | 'None';
+/** A user who has access to a collection (as returned by {@link collection.getUsers}). */
+export interface CollectionUser {
+    /** The user's id (auth uid). */
+    uid: string;
+    /** The user's access level on this collection. */
+    access: CollectionAccessLevel | string;
+    /** Display name, if known. */
+    name?: string;
+    /** Email address, if known. */
+    email?: string;
+}
+/** Input for {@link collection.inviteUser}. */
+export interface InviteUserInput {
+    /** Email address to invite. */
+    email: string;
+    /** Optional display name (used when creating a brand-new account). */
+    name?: string;
+    /** Access level to grant on the collection. Apply it with {@link collection.setUserAccess} after inviting. */
+    access: CollectionAccessLevel | string;
+    /** The login / auth-kit collection the account lives in (for branding + where the login is created). Default `'global'`. */
+    loginCollectionId?: string;
+    /** Origin used to build the branded invite link. Defaults to `window.location.origin` in the browser. */
+    consoleOrigin?: string;
+}

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.0.28  |  Generated: 2026-09-28T13:20:09.049Z
+Version: 2.0.30  |  Generated: 2026-09-29T17:13:26.956Z
 
 This is a concise summary of all available API functions and types.
 
@@ -1485,7 +1485,21 @@ interface PdfRenderArgs {
 **PdfExtractArgs** (interface)
 ```typescript
 interface PdfExtractArgs {
-  url: string; schema?: Record<string, any>; prompt?: string; maxPages?: number; dpi?: number
+  url: string; schema?: Record<string, any>; prompt?: string; maxPages?: number; dpi?: number; includeConfidence?: boolean; includeBoxes?: boolean
+}
+```
+
+**PdfDecodeBarcodesArgs** (interface)
+```typescript
+interface PdfDecodeBarcodesArgs {
+  url: string; page?: number; dpi?: number
+}
+```
+
+**PdfInspectGraphicsArgs** (interface)
+```typescript
+interface PdfInspectGraphicsArgs {
+  url: string; page?: number
 }
 ```
 
@@ -1524,6 +1538,8 @@ interface AiToolArgsMap {
   'pdf.inspect': PdfInspectArgs
   'pdf.render': PdfRenderArgs
   'pdf.extract': PdfExtractArgs
+  'pdf.decodeBarcodes': PdfDecodeBarcodesArgs
+  'pdf.inspectGraphics': PdfInspectGraphicsArgs
   'http.request': HttpRequestArgs
   'translate': TranslateArgs
 }
@@ -1613,10 +1629,45 @@ interface PdfRenderResult {
 }
 ```
 
+**PdfFieldMeta** (interface)
+```typescript
+interface PdfFieldMeta {
+  confidence?: number | null; source?: 'text' | 'vision' | 'inferred'; bbox?: { x: number; y: number; w: number; h: number; page: number }
+}
+```
+
 **PdfExtractResult** (interface)
 ```typescript
 interface PdfExtractResult {
-  url: string; method: 'text' | 'vision'; pagesRead: number; fields: Record<string, any>
+  url: string; method: 'text' | 'vision'; pagesRead: number; fields: Record<string, any>; fieldsMeta?: Record<string, PdfFieldMeta>
+}
+```
+
+**PdfBarcode** (interface)
+```typescript
+interface PdfBarcode {
+  type: string; format: string; value: string; page: number; bbox?: { x: number; y: number; w: number; h: number }; confidence: number
+}
+```
+
+**PdfDecodeBarcodesResult** (interface)
+```typescript
+interface PdfDecodeBarcodesResult {
+  url: string; pagesScanned: number; codes: PdfBarcode[]
+}
+```
+
+**PdfGraphicsPage** (interface)
+```typescript
+interface PdfGraphicsPage {
+  page: number; paths: number; images: number; textRuns: number; colourSpaces: string[]
+}
+```
+
+**PdfInspectGraphicsResult** (interface)
+```typescript
+interface PdfInspectGraphicsResult {
+  url: string; pages: PdfGraphicsPage[]; spotColours: string[]; note: string
 }
 ```
 
@@ -4660,6 +4711,27 @@ interface AppConfig {
 }
 ```
 
+**CollectionUser** (interface)
+```typescript
+interface CollectionUser {
+  uid: string
+  access: CollectionAccessLevel | string
+  name?: string
+  email?: string
+}
+```
+
+**InviteUserInput** (interface)
+```typescript
+interface InviteUserInput {
+  email: string
+  name?: string
+  access: CollectionAccessLevel | string
+  loginCollectionId?: string
+  consoleOrigin?: string
+}
+```
+
 **CollectionResponse** = `Collection`
 
 **CollectionCreateRequest** = `Omit<Collection, 'id' | 'shortId'>`
@@ -4668,6 +4740,8 @@ interface AppConfig {
 
 **DomainTarget** = `"smartlinks" | "hub"`
 
+**CollectionAccessLevel** = `'Owner' | 'Admin' | 'Assigner' | 'Reporter' | 'User' | 'None'`
+
 ### common
 
 **IdField** = `'userId' | 'contactId'`
@@ -10382,6 +10456,18 @@ Look up a serial number by code for a collection (admin only).
     value: any) → `Promise<any>`
 Assign a value to a serial number for a collection (admin only).
 
+**getUsers**(collectionId: string) → `Promise<CollectionUser[]>`
+List the users with access to a collection, each with their access level (admin only). Access is stored in the collection's `roles` map (userId → level); this resolves each to name/email. GET /admin/collection/:collectionId/getUsers
+
+**setUserAccess**(collectionId: string,
+    userId: string,
+    access: CollectionAccessLevel | null) → `Promise<void>`
+Grant, change, or remove a user's access level on a collection (admin only). Pass `null` or `'None'` to remove access. The server enforces privilege-escalation rules — you cannot grant an access level above your own, nor change a user whose level is above yours. POST /admin/collection/:collectionId/updateUserAccess
+
+**inviteUser**(collectionId: string,
+    input: InviteUserInput) → `Promise<`
+Invite a user to a collection by email (admin only). Creates or links their account in the login / auth-kit collection (`loginCollectionId`, default `'global'`) and emails them an invite (new account) or an added-to-collection notice (existing account); returns their `uid`. This does NOT grant access on its own — follow with {@link setUserAccess} to set their level (this mirrors the console flow). POST /user/inviteUser
+
 ### comms
 
 **getPushVapidPublicKey**(collectionId: string) → `Promise<import("../types/comms").PushVapidResponse>`

package/docs/ai.md

@@ -324,15 +324,40 @@ in `input`.
 | `image.searchStock` | Search real stock photos (Unsplash). |
 | `image.transform` | Resize / crop / rotate / grayscale / format-convert / compress → hosted URL. |
 | `pdf.create` | Render HTML → PDF → hosted URL. |
-| `pdf.fill` | Fill an AcroForm PDF's fields → hosted URL. |
-| `pdf.merge` | Merge several PDFs into one → hosted URL. |
+| `pdf.fill` | Fill an AcroForm PDF's fields (`{ field: value }`) → hosted URL. |
+| `pdf.merge` | Merge several PDFs into one, in order → hosted URL. |
+| `pdf.inspect` | Cheap, no-AI introspection: page count/sizes, which pages have a real text layer, raster present, and a routing hint (`text` vs `vision`). |
+| `pdf.render` | Rasterize one page to a PNG at a chosen DPI → hosted image URL (feed to vision, or screenshot a page). |
+| `pdf.extract` | PDF → typed JSON in one call (schema and/or prompt). Auto-routes text vs vision. Optional per-field `confidence`/`source` (`includeConfidence`) and `bbox` (`includeBoxes`) in `fieldsMeta`. |
+| `pdf.decodeBarcodes` | Deterministically decode barcodes/QR on a page (WASM, no AI) → value + symbology + page + bbox + confidence. Use this for barcode digits, never vision. |
+| `pdf.inspectGraphics` | Prepress inspection: per-page path/image/outlined-text counts + colour spaces, plus named SPOT colours (e.g. "PANTONE 871 C"). No AI. |
 | `http.request` | SSRF-guarded outbound HTTP(S) to a public URL (call a REST API). |
 | `translate` | Translate text into one or more languages (generic, model-based). |
 
+**Working with PDFs.** The PDF tools split into *read/analyse* and *produce*:
+
+- **Read a whole PDF as text** → `document.read` (Firecrawl; good for prose/decks).
+- **Turn a PDF into structured fields** → `pdf.extract` (give it a JSON schema and/or a prompt; it
+  returns typed JSON). It routes itself, but you can drive the route yourself: call `pdf.inspect`
+  first (deterministic, no AI) to see whether each page has a real text layer, then `pdf.extract`
+  (cheap text path) or `pdf.render` → `image.describe`/vision for curve-only or raster artwork.
+- **Zoom in on small print** (INCI/allergen lists) → `pdf.render` at a high DPI (e.g. 300), then read
+  the PNG with vision.
+- **Barcodes / QR** → `pdf.decodeBarcodes` (deterministic WASM decode) — never trust vision for barcode
+  digits; it hallucinates them.
+- **Prepress / print QA** (spot colours, colour spaces, vector vs raster) → `pdf.inspectGraphics`.
+- **A review UI that flags guessed fields** → `pdf.extract` with `includeConfidence` (per-field
+  confidence + source) and `includeBoxes` (per-field bbox on text-native pages) in `fieldsMeta`.
+- **Produce a PDF** → `pdf.create` (HTML → PDF), `pdf.fill` (populate an AcroForm's fields),
+  `pdf.merge` (combine several). These return a hosted `hostedUrl`.
+
+Every tool is also directly callable without the model loop via `ai.tools.run(collectionId, name,
+args)` — e.g. render a page or extract fields straight from a UI, no agent round-trip.
+
 Discover tools two ways:
 - **Design time (typed):** import `BUILTIN_AI_TOOLS`, `AI_TOOL_NAMES`, and the per-tool arg types
-  (`WebSearchArgs`, `DataExtractArgs`, …) from the SDK. This is the core set — stable, versioned,
-  documented here.
+  (`WebSearchArgs`, `DataExtractArgs`, `PdfExtractArgs`, …) from the SDK. This is the core set —
+  stable, versioned, documented here.
 - **Runtime (live):** `await ai.catalog(collectionId)` returns the registry as the server sees it,
   including any future app-contributed tools. The built-in set above is always present.
 

package/docs/server-functions.md

@@ -400,6 +400,12 @@ Prefer the platform primitives above over a dependency; when you do need one, pi
 | Schema validation of inputs | no | `zod` |
 | JWT (sign/verify for a third-party API) | Web Crypto can, verbosely | `jose` |
 | Hash / HMAC / encrypt | **native** — `crypto.subtle` | — |
+| PDF **text** extraction (cheap first-pass, no AI) | no | `unpdf` — a serverless/WASM pdf.js build with no Node deps; `import { extractText } from 'unpdf'`. Text only. |
+
+> **PDFs in a server function:** for a cheap text-layer check use `unpdf` (edge-safe, WASM). For
+> anything heavier — rendering pages, vision extraction, **barcode/QR decode**, or prepress/spot-colour
+> inspection — call the platform tools `pdf.render` / `pdf.extract` / `pdf.decodeBarcodes` /
+> `pdf.inspectGraphics` via `ai.tools.run`; those run in the full platform runtime, not the sandbox.
 
 **The common actions, and how to do each:**
 

package/openapi.yaml

@@ -4334,6 +4334,35 @@ paths:
           description: Unauthorized
         404:
           description: Not found
+  /admin/collection/{collectionId}/getUsers:
+    get:
+      tags:
+        - collection
+      summary: List the users with access to a collection, each with their access level (admin only).
+      operationId: collection_getUsers
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: collectionId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/CollectionUser"
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
   /admin/collection/{collectionId}/hub:
     post:
       tags:
@@ -8694,6 +8723,38 @@ paths:
           application/json:
             schema:
               $ref: "#/components/schemas/TranslationUpdateRequest"
+  /admin/collection/{collectionId}/updateUserAccess:
+    post:
+      tags:
+        - collection
+      summary: "Grant, change, or remove a user's access level on a collection (admin only)."
+      operationId: collection_setUserAccess
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: collectionId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema: {}
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CollectionAccessLevel"
   /admin/collection/{encodedCollectionId}/comm/send:
     post:
       tags:
@@ -17064,6 +17125,22 @@ components:
           additionalProperties: true
       required:
         - url
+    PdfDecodeBarcodesArgs:
+      type: object
+      properties:
+        url:
+          type: object
+          additionalProperties: true
+      required:
+        - url
+    PdfInspectGraphicsArgs:
+      type: object
+      properties:
+        url:
+          type: object
+          additionalProperties: true
+      required:
+        - url
     HttpRequestArgs:
       type: object
       properties:
@@ -17125,6 +17202,10 @@ components:
           $ref: "#/components/schemas/PdfRenderArgs"
         pdf.extract:
           $ref: "#/components/schemas/PdfExtractArgs"
+        pdf.decodeBarcodes:
+          $ref: "#/components/schemas/PdfDecodeBarcodesArgs"
+        pdf.inspectGraphics:
+          $ref: "#/components/schemas/PdfInspectGraphicsArgs"
         http.request:
           $ref: "#/components/schemas/HttpRequestArgs"
         translate:
@@ -17148,6 +17229,8 @@ components:
         - pdf.inspect
         - pdf.render
         - pdf.extract
+        - pdf.decodeBarcodes
+        - pdf.inspectGraphics
         - http.request
         - translate
     WebSearchResultItem:
@@ -17256,6 +17339,12 @@ components:
           additionalProperties: true
       required:
         - url
+    PdfFieldMeta:
+      type: object
+      properties:
+        confidence:
+          type: object
+          additionalProperties: true
     PdfExtractResult:
       type: object
       properties:
@@ -17266,6 +17355,42 @@ components:
             - vision
       required:
         - url
+    PdfBarcode:
+      type: object
+      properties:
+        type:
+          type: object
+          additionalProperties: true
+      required:
+        - type
+    PdfDecodeBarcodesResult:
+      type: object
+      properties:
+        url:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
+      required:
+        - url
+    PdfGraphicsPage:
+      type: object
+      properties:
+        page:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
+      required:
+        - page
+    PdfInspectGraphicsResult:
+      type: object
+      properties:
+        url:
+          type: object
+          additionalProperties: true
+      required:
+        - url
     ResponsesAgentTrace:
       type: object
       properties:
@@ -17347,6 +17472,8 @@ components:
         - pdf.inspect
         - pdf.render
         - pdf.extract
+        - pdf.decodeBarcodes
+        - pdf.inspectGraphics
         - http.request
         - translate
     AgentStreamEvent:
@@ -22643,6 +22770,38 @@ components:
             $ref: "#/components/schemas/AppConfig"
       required:
         - apps
+    CollectionUser:
+      type: object
+      properties:
+        uid:
+          type: string
+        access:
+          type: object
+          additionalProperties: true
+        name:
+          type: string
+        email:
+          type: string
+      required:
+        - uid
+        - access
+    InviteUserInput:
+      type: object
+      properties:
+        email:
+          type: string
+        name:
+          type: string
+        access:
+          type: object
+          additionalProperties: true
+        loginCollectionId:
+          type: string
+        consoleOrigin:
+          type: string
+      required:
+        - email
+        - access
     CollectionResponse:
       $ref: "#/components/schemas/Collection"
     CollectionCreateRequest:
@@ -22652,6 +22811,15 @@ components:
     DomainTarget:
       type: object
       additionalProperties: true
+    CollectionAccessLevel:
+      type: string
+      enum:
+        - Owner
+        - Admin
+        - Assigner
+        - Reporter
+        - User
+        - None
     IdField:
       type: string
       enum:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proveanything/smartlinks",
-  "version": "2.0.28",
+  "version": "2.0.30",
   "description": "Official JavaScript/TypeScript SDK for the Smartlinks API",
   "type": "module",
   "main": "dist/index.js",