@proveanything/smartlinks 2.0.29 → 2.0.30

package/dist/api/collection.d.ts

@@ -1,4 +1,4 @@
-import { CollectionResponse, CollectionCreateRequest, CollectionUpdateRequest, AppsConfigResponse, DomainTarget, HubAvailabilityResponse } from "../types/collection.js";
+import { CollectionResponse, CollectionCreateRequest, CollectionUpdateRequest, AppsConfigResponse, DomainTarget, HubAvailabilityResponse, CollectionUser, CollectionAccessLevel, InviteUserInput } from "../types/collection.js";
 export declare namespace collection {
     /**
      * Retrieves a single Collection by its ID.
@@ -170,4 +170,35 @@ export declare namespace collection {
      * @throws ErrorResponse if the request fails
      */
     function assignSN(collectionId: string, codeId: string, value: any): Promise<any>;
+    /**
+     * List the users with access to a collection, each with their access level (admin only). Access is
+     * stored in the collection's `roles` map (userId → level); this resolves each to name/email.
+     * GET /admin/collection/:collectionId/getUsers
+     * @param collectionId - Identifier of the collection
+     * @returns Promise resolving to the collection's users
+     */
+    function getUsers(collectionId: string): Promise<CollectionUser[]>;
+    /**
+     * Grant, change, or remove a user's access level on a collection (admin only). Pass `null` or
+     * `'None'` to remove access. The server enforces privilege-escalation rules — you cannot grant an
+     * access level above your own, nor change a user whose level is above yours.
+     * POST /admin/collection/:collectionId/updateUserAccess
+     * @param collectionId - Identifier of the collection
+     * @param userId - The user (auth uid) whose access to change
+     * @param access - The new access level, or `null` to remove access
+     */
+    function setUserAccess(collectionId: string, userId: string, access: CollectionAccessLevel | null): Promise<void>;
+    /**
+     * Invite a user to a collection by email (admin only). Creates or links their account in the login /
+     * auth-kit collection (`loginCollectionId`, default `'global'`) and emails them an invite (new account)
+     * or an added-to-collection notice (existing account); returns their `uid`. This does NOT grant access
+     * on its own — follow with {@link setUserAccess} to set their level (this mirrors the console flow).
+     * POST /user/inviteUser
+     * @param collectionId - The collection the user is being added to (the invite's target)
+     * @param input - Invite details (email, optional name, access level, login collection, origin)
+     * @returns Promise resolving to the invited user's `{ uid }`
+     */
+    function inviteUser(collectionId: string, input: InviteUserInput): Promise<{
+        uid: string;
+    }>;
 }

package/dist/api/collection.js

@@ -253,4 +253,54 @@ export var collection;
         return post(path, { value });
     }
     collection.assignSN = assignSN;
+    /**
+     * List the users with access to a collection, each with their access level (admin only). Access is
+     * stored in the collection's `roles` map (userId → level); this resolves each to name/email.
+     * GET /admin/collection/:collectionId/getUsers
+     * @param collectionId - Identifier of the collection
+     * @returns Promise resolving to the collection's users
+     */
+    async function getUsers(collectionId) {
+        return request(`/admin/collection/${encodeURIComponent(collectionId)}/getUsers`);
+    }
+    collection.getUsers = getUsers;
+    /**
+     * Grant, change, or remove a user's access level on a collection (admin only). Pass `null` or
+     * `'None'` to remove access. The server enforces privilege-escalation rules — you cannot grant an
+     * access level above your own, nor change a user whose level is above yours.
+     * POST /admin/collection/:collectionId/updateUserAccess
+     * @param collectionId - Identifier of the collection
+     * @param userId - The user (auth uid) whose access to change
+     * @param access - The new access level, or `null` to remove access
+     */
+    async function setUserAccess(collectionId, userId, access) {
+        await post(`/admin/collection/${encodeURIComponent(collectionId)}/updateUserAccess`, {
+            userId,
+            access: access !== null && access !== void 0 ? access : 'None'
+        });
+    }
+    collection.setUserAccess = setUserAccess;
+    /**
+     * Invite a user to a collection by email (admin only). Creates or links their account in the login /
+     * auth-kit collection (`loginCollectionId`, default `'global'`) and emails them an invite (new account)
+     * or an added-to-collection notice (existing account); returns their `uid`. This does NOT grant access
+     * on its own — follow with {@link setUserAccess} to set their level (this mirrors the console flow).
+     * POST /user/inviteUser
+     * @param collectionId - The collection the user is being added to (the invite's target)
+     * @param input - Invite details (email, optional name, access level, login collection, origin)
+     * @returns Promise resolving to the invited user's `{ uid }`
+     */
+    async function inviteUser(collectionId, input) {
+        var _a, _b;
+        const consoleOrigin = (_a = input.consoleOrigin) !== null && _a !== void 0 ? _a : (typeof window !== 'undefined' ? window.location.origin : undefined);
+        return post(`/user/inviteUser`, {
+            email: input.email.trim(),
+            name: input.name,
+            collectionId: (_b = input.loginCollectionId) !== null && _b !== void 0 ? _b : 'global',
+            targetCollectionId: collectionId,
+            accessLevel: input.access,
+            consoleOrigin
+        });
+    }
+    collection.inviteUser = inviteUser;
 })(collection || (collection = {}));

package/dist/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.0.29  |  Generated: 2026-09-29T10:33:46.286Z
+Version: 2.0.30  |  Generated: 2026-09-29T17:13:26.956Z
 
 This is a concise summary of all available API functions and types.
 
@@ -4711,6 +4711,27 @@ interface AppConfig {
 }
 ```
 
+**CollectionUser** (interface)
+```typescript
+interface CollectionUser {
+  uid: string
+  access: CollectionAccessLevel | string
+  name?: string
+  email?: string
+}
+```
+
+**InviteUserInput** (interface)
+```typescript
+interface InviteUserInput {
+  email: string
+  name?: string
+  access: CollectionAccessLevel | string
+  loginCollectionId?: string
+  consoleOrigin?: string
+}
+```
+
 **CollectionResponse** = `Collection`
 
 **CollectionCreateRequest** = `Omit<Collection, 'id' | 'shortId'>`
@@ -4719,6 +4740,8 @@ interface AppConfig {
 
 **DomainTarget** = `"smartlinks" | "hub"`
 
+**CollectionAccessLevel** = `'Owner' | 'Admin' | 'Assigner' | 'Reporter' | 'User' | 'None'`
+
 ### common
 
 **IdField** = `'userId' | 'contactId'`
@@ -10433,6 +10456,18 @@ Look up a serial number by code for a collection (admin only).
     value: any) → `Promise<any>`
 Assign a value to a serial number for a collection (admin only).
 
+**getUsers**(collectionId: string) → `Promise<CollectionUser[]>`
+List the users with access to a collection, each with their access level (admin only). Access is stored in the collection's `roles` map (userId → level); this resolves each to name/email. GET /admin/collection/:collectionId/getUsers
+
+**setUserAccess**(collectionId: string,
+    userId: string,
+    access: CollectionAccessLevel | null) → `Promise<void>`
+Grant, change, or remove a user's access level on a collection (admin only). Pass `null` or `'None'` to remove access. The server enforces privilege-escalation rules — you cannot grant an access level above your own, nor change a user whose level is above yours. POST /admin/collection/:collectionId/updateUserAccess
+
+**inviteUser**(collectionId: string,
+    input: InviteUserInput) → `Promise<`
+Invite a user to a collection by email (admin only). Creates or links their account in the login / auth-kit collection (`loginCollectionId`, default `'global'`) and emails them an invite (new account) or an added-to-collection notice (existing account); returns their `uid`. This does NOT grant access on its own — follow with {@link setUserAccess} to set their level (this mirrors the console flow). POST /user/inviteUser
+
 ### comms
 
 **getPushVapidPublicKey**(collectionId: string) → `Promise<import("../types/comms").PushVapidResponse>`

package/dist/openapi.yaml

@@ -4334,6 +4334,35 @@ paths:
           description: Unauthorized
         404:
           description: Not found
+  /admin/collection/{collectionId}/getUsers:
+    get:
+      tags:
+        - collection
+      summary: List the users with access to a collection, each with their access level (admin only).
+      operationId: collection_getUsers
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: collectionId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/CollectionUser"
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
   /admin/collection/{collectionId}/hub:
     post:
       tags:
@@ -8694,6 +8723,38 @@ paths:
           application/json:
             schema:
               $ref: "#/components/schemas/TranslationUpdateRequest"
+  /admin/collection/{collectionId}/updateUserAccess:
+    post:
+      tags:
+        - collection
+      summary: "Grant, change, or remove a user's access level on a collection (admin only)."
+      operationId: collection_setUserAccess
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: collectionId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema: {}
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CollectionAccessLevel"
   /admin/collection/{encodedCollectionId}/comm/send:
     post:
       tags:
@@ -22709,6 +22770,38 @@ components:
             $ref: "#/components/schemas/AppConfig"
       required:
         - apps
+    CollectionUser:
+      type: object
+      properties:
+        uid:
+          type: string
+        access:
+          type: object
+          additionalProperties: true
+        name:
+          type: string
+        email:
+          type: string
+      required:
+        - uid
+        - access
+    InviteUserInput:
+      type: object
+      properties:
+        email:
+          type: string
+        name:
+          type: string
+        access:
+          type: object
+          additionalProperties: true
+        loginCollectionId:
+          type: string
+        consoleOrigin:
+          type: string
+      required:
+        - email
+        - access
     CollectionResponse:
       $ref: "#/components/schemas/Collection"
     CollectionCreateRequest:
@@ -22718,6 +22811,15 @@ components:
     DomainTarget:
       type: object
       additionalProperties: true
+    CollectionAccessLevel:
+      type: string
+      enum:
+        - Owner
+        - Admin
+        - Assigner
+        - Reporter
+        - User
+        - None
     IdField:
       type: string
       enum:

package/dist/types/collection.d.ts

@@ -153,3 +153,33 @@ export interface AppsConfigResponse extends Omit<AppConfigSettings, 'id' | 'apps
     /** Array of app catalog definitions for this collection. */
     apps: AppConfig[];
 }
+/**
+ * A user's access level on a collection. Access is stored in the collection's `roles` map
+ * (userId → level). Server-enforced tiers are `User` < `Admin` < `Owner`; `Reporter` / `Assigner`
+ * are legacy values still accepted but not part of the enforced hierarchy. `None` removes access.
+ */
+export type CollectionAccessLevel = 'Owner' | 'Admin' | 'Assigner' | 'Reporter' | 'User' | 'None';
+/** A user who has access to a collection (as returned by {@link collection.getUsers}). */
+export interface CollectionUser {
+    /** The user's id (auth uid). */
+    uid: string;
+    /** The user's access level on this collection. */
+    access: CollectionAccessLevel | string;
+    /** Display name, if known. */
+    name?: string;
+    /** Email address, if known. */
+    email?: string;
+}
+/** Input for {@link collection.inviteUser}. */
+export interface InviteUserInput {
+    /** Email address to invite. */
+    email: string;
+    /** Optional display name (used when creating a brand-new account). */
+    name?: string;
+    /** Access level to grant on the collection. Apply it with {@link collection.setUserAccess} after inviting. */
+    access: CollectionAccessLevel | string;
+    /** The login / auth-kit collection the account lives in (for branding + where the login is created). Default `'global'`. */
+    loginCollectionId?: string;
+    /** Origin used to build the branded invite link. Defaults to `window.location.origin` in the browser. */
+    consoleOrigin?: string;
+}

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.0.29  |  Generated: 2026-09-29T10:33:46.286Z
+Version: 2.0.30  |  Generated: 2026-09-29T17:13:26.956Z
 
 This is a concise summary of all available API functions and types.
 
@@ -4711,6 +4711,27 @@ interface AppConfig {
 }
 ```
 
+**CollectionUser** (interface)
+```typescript
+interface CollectionUser {
+  uid: string
+  access: CollectionAccessLevel | string
+  name?: string
+  email?: string
+}
+```
+
+**InviteUserInput** (interface)
+```typescript
+interface InviteUserInput {
+  email: string
+  name?: string
+  access: CollectionAccessLevel | string
+  loginCollectionId?: string
+  consoleOrigin?: string
+}
+```
+
 **CollectionResponse** = `Collection`
 
 **CollectionCreateRequest** = `Omit<Collection, 'id' | 'shortId'>`
@@ -4719,6 +4740,8 @@ interface AppConfig {
 
 **DomainTarget** = `"smartlinks" | "hub"`
 
+**CollectionAccessLevel** = `'Owner' | 'Admin' | 'Assigner' | 'Reporter' | 'User' | 'None'`
+
 ### common
 
 **IdField** = `'userId' | 'contactId'`
@@ -10433,6 +10456,18 @@ Look up a serial number by code for a collection (admin only).
     value: any) → `Promise<any>`
 Assign a value to a serial number for a collection (admin only).
 
+**getUsers**(collectionId: string) → `Promise<CollectionUser[]>`
+List the users with access to a collection, each with their access level (admin only). Access is stored in the collection's `roles` map (userId → level); this resolves each to name/email. GET /admin/collection/:collectionId/getUsers
+
+**setUserAccess**(collectionId: string,
+    userId: string,
+    access: CollectionAccessLevel | null) → `Promise<void>`
+Grant, change, or remove a user's access level on a collection (admin only). Pass `null` or `'None'` to remove access. The server enforces privilege-escalation rules — you cannot grant an access level above your own, nor change a user whose level is above yours. POST /admin/collection/:collectionId/updateUserAccess
+
+**inviteUser**(collectionId: string,
+    input: InviteUserInput) → `Promise<`
+Invite a user to a collection by email (admin only). Creates or links their account in the login / auth-kit collection (`loginCollectionId`, default `'global'`) and emails them an invite (new account) or an added-to-collection notice (existing account); returns their `uid`. This does NOT grant access on its own — follow with {@link setUserAccess} to set their level (this mirrors the console flow). POST /user/inviteUser
+
 ### comms
 
 **getPushVapidPublicKey**(collectionId: string) → `Promise<import("../types/comms").PushVapidResponse>`

package/openapi.yaml

@@ -4334,6 +4334,35 @@ paths:
           description: Unauthorized
         404:
           description: Not found
+  /admin/collection/{collectionId}/getUsers:
+    get:
+      tags:
+        - collection
+      summary: List the users with access to a collection, each with their access level (admin only).
+      operationId: collection_getUsers
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: collectionId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/CollectionUser"
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
   /admin/collection/{collectionId}/hub:
     post:
       tags:
@@ -8694,6 +8723,38 @@ paths:
           application/json:
             schema:
               $ref: "#/components/schemas/TranslationUpdateRequest"
+  /admin/collection/{collectionId}/updateUserAccess:
+    post:
+      tags:
+        - collection
+      summary: "Grant, change, or remove a user's access level on a collection (admin only)."
+      operationId: collection_setUserAccess
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: collectionId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema: {}
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CollectionAccessLevel"
   /admin/collection/{encodedCollectionId}/comm/send:
     post:
       tags:
@@ -22709,6 +22770,38 @@ components:
             $ref: "#/components/schemas/AppConfig"
       required:
         - apps
+    CollectionUser:
+      type: object
+      properties:
+        uid:
+          type: string
+        access:
+          type: object
+          additionalProperties: true
+        name:
+          type: string
+        email:
+          type: string
+      required:
+        - uid
+        - access
+    InviteUserInput:
+      type: object
+      properties:
+        email:
+          type: string
+        name:
+          type: string
+        access:
+          type: object
+          additionalProperties: true
+        loginCollectionId:
+          type: string
+        consoleOrigin:
+          type: string
+      required:
+        - email
+        - access
     CollectionResponse:
       $ref: "#/components/schemas/Collection"
     CollectionCreateRequest:
@@ -22718,6 +22811,15 @@ components:
     DomainTarget:
       type: object
       additionalProperties: true
+    CollectionAccessLevel:
+      type: string
+      enum:
+        - Owner
+        - Admin
+        - Assigner
+        - Reporter
+        - User
+        - None
     IdField:
       type: string
       enum:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proveanything/smartlinks",
-  "version": "2.0.29",
+  "version": "2.0.30",
   "description": "Official JavaScript/TypeScript SDK for the Smartlinks API",
   "type": "module",
   "main": "dist/index.js",