@ptkl/sdk 1.14.0 → 1.16.0

package/dist/v0.9/api/users.d.ts

@@ -1,5 +1,5 @@
 import PlatformBaseClient from "./platformBaseClient";
-import { UserClaims, UserModel, Role, CreateRoleRequest, EditRoleRequest, RoleModel, Permission } from "../types/users";
+import { UserClaims, UserModel, Role, CreateRoleRequest, EditRoleRequest, RoleModel, Permission, Permissions } from "../types/users";
 import { AxiosResponse } from "axios";
 export default class Users extends PlatformBaseClient {
     auth(username: string, password: string, project: string): Promise<AxiosResponse<any>>;
@@ -28,9 +28,28 @@ export default class Users extends PlatformBaseClient {
      */
     editProfile(data: any): Promise<AxiosResponse<any>>;
     /**
-     * Get user permissions
+     * Get the current token's permissions.
+     *
+     * Returns the resolved permission set carried by the calling token. For a
+     * forge actor token this is the scoped intersection minted at launch time —
+     * see `getPrincipalPermissions()` for the underlying user's full set.
      */
-    getPermissions(): Promise<AxiosResponse<Permission[]>>;
+    getPermissions(): Promise<AxiosResponse<Permissions>>;
+    /**
+     * Get the FULL permissions of the user the current token is acting on behalf
+     * of (the "principal").
+     *
+     * When a forge app runs under an actor token, `getPermissions()` returns only
+     * the token's scoped permissions — the intersection of the app's declared
+     * runtime permissions and the user's permissions. This instead returns the
+     * complete permission set of the underlying user, so the app can check what
+     * that user is actually allowed to do, independent of what the app itself was
+     * granted. The token scope is unchanged: this exposes knowledge, not capability.
+     *
+     * For a normal user session (no actor token) it returns the caller's own
+     * permissions, identical to `getPermissions()`'s scope.
+     */
+    getPrincipalPermissions(): Promise<AxiosResponse<Permissions>>;
     /**
      * Get list of available permissions
      */

package/dist/v0.9/index.cjs.js

@@ -19550,11 +19550,32 @@ class Users extends PlatformBaseClient {
     }
     // Permissions & Roles
     /**
-     * Get user permissions
+     * Get the current token's permissions.
+     *
+     * Returns the resolved permission set carried by the calling token. For a
+     * forge actor token this is the scoped intersection minted at launch time —
+     * see `getPrincipalPermissions()` for the underlying user's full set.
      */
     async getPermissions() {
         return await this.client.get("/v1/user/role/permissions");
     }
+    /**
+     * Get the FULL permissions of the user the current token is acting on behalf
+     * of (the "principal").
+     *
+     * When a forge app runs under an actor token, `getPermissions()` returns only
+     * the token's scoped permissions — the intersection of the app's declared
+     * runtime permissions and the user's permissions. This instead returns the
+     * complete permission set of the underlying user, so the app can check what
+     * that user is actually allowed to do, independent of what the app itself was
+     * granted. The token scope is unchanged: this exposes knowledge, not capability.
+     *
+     * For a normal user session (no actor token) it returns the caller's own
+     * permissions, identical to `getPermissions()`'s scope.
+     */
+    async getPrincipalPermissions() {
+        return await this.client.get("/v1/user/role/principal-permissions");
+    }
     /**
      * Get list of available permissions
      */
@@ -20258,6 +20279,7 @@ class IntegrationsBaseClient extends BaseClient {
             // @ts-ignore
             env = env !== null && env !== void 0 ? env : __global_env__ === null || __global_env__ === void 0 ? void 0 : __global_env__.PROJECT_ENV;
             token = token !== null && token !== void 0 ? token : __global_env__ === null || __global_env__ === void 0 ? void 0 : __global_env__.PROJECT_API_TOKEN;
+            project_uuid = __global_env__ === null || __global_env__ === void 0 ? void 0 : __global_env__.PROJECT_UUID;
             if (isBrowser) {
                 if (sessionStorage.getItem('protokol_context') === 'forge') {
                     headers['X-Project-Env'] = (_b = sessionStorage.getItem('forge_app_env')) !== null && _b !== void 0 ? _b : 'dev';
@@ -21122,36 +21144,41 @@ class VPFR extends IntegrationsBaseClient {
 }
 
 class Payments extends IntegrationsBaseClient {
+    // FIXME: No backend route exists for listing/searching transactions (neither
+    // monri.route.ts nor wspay.route.ts under karadjordje/src/routes/v1/payments/
+    // expose a "list" endpoint). This method's URL is left as-is (still broken)
+    // rather than being "fixed" to another guessed path that would still 404.
+    // Do not call this method until a corresponding backend route is added.
     async getTransactions(userId, params) {
         return await this.client.get(`/karadjordje/v1/payment/${userId}/list`, {
             params,
         });
     }
-    async getTransaction(provider, userId, transactionId) {
-        return await this.client.get(`/karadjordje/v1/payment/${provider}/${userId}/getTransaction`, {
+    async getTransaction(provider, transactionId) {
+        return await this.client.get(`/karadjordje/v1/payment/${provider}/getTransaction`, {
             params: { transactionId },
         });
     }
     async settings(provider) {
         return await this.client.get(`/karadjordje/v1/payment/${provider}/settings`);
     }
-    async deactivatePaymentLink(provider, user, transactionId) {
-        return await this.client.post(`/karadjordje/v1/payment/${provider}/${user}/deactivate/${transactionId}`);
+    async deactivatePaymentLink(provider, transactionId) {
+        return await this.client.post(`/karadjordje/v1/payment/${provider}/deactivate/${transactionId}`);
     }
-    async voidTransaction(provider, user, transactionId) {
-        return await this.client.post(`/karadjordje/v1/payment/${provider}/${user}/void/${transactionId}`);
+    async voidTransaction(provider, transactionId) {
+        return await this.client.post(`/karadjordje/v1/payment/${provider}/void/${transactionId}`);
     }
-    async refund(provider, user, transactionId) {
-        return await this.client.post(`/karadjordje/v1/payment/${provider}/${user}/refund/${transactionId}`);
+    async refund(provider, transactionId) {
+        return await this.client.post(`/karadjordje/v1/payment/${provider}/refund/${transactionId}`);
     }
-    async getPaymentLink(provider, user, options) {
-        return await this.client.post(`/karadjordje/v1/payment/${provider}/${user}/getPaymentLink`, options);
+    async getPaymentLink(provider, options) {
+        return await this.client.post(`/karadjordje/v1/payment/${provider}/getPaymentLink`, options);
     }
-    async getTokenRequestLink(provider, user, options) {
-        return await this.client.post(`/karadjordje/v1/payment/${provider}/${user}/getTokenRequestLink`, options);
+    async getTokenRequestLink(provider, options) {
+        return await this.client.post(`/karadjordje/v1/payment/${provider}/getTokenRequestLink`, options);
     }
-    async directPayUsingToken(provider, user, options) {
-        return await this.client.post(`/karadjordje/v1/payment/${provider}/${user}/directPayUsingToken`, options);
+    async directPayUsingToken(provider, options) {
+        return await this.client.post(`/karadjordje/v1/payment/${provider}/directPayUsingToken`, options);
     }
 }
 

package/dist/v0.9/index.esm.js

@@ -581,11 +581,32 @@ class Users extends PlatformBaseClient {
     }
     // Permissions & Roles
     /**
-     * Get user permissions
+     * Get the current token's permissions.
+     *
+     * Returns the resolved permission set carried by the calling token. For a
+     * forge actor token this is the scoped intersection minted at launch time —
+     * see `getPrincipalPermissions()` for the underlying user's full set.
      */
     async getPermissions() {
         return await this.client.get("/v1/user/role/permissions");
     }
+    /**
+     * Get the FULL permissions of the user the current token is acting on behalf
+     * of (the "principal").
+     *
+     * When a forge app runs under an actor token, `getPermissions()` returns only
+     * the token's scoped permissions — the intersection of the app's declared
+     * runtime permissions and the user's permissions. This instead returns the
+     * complete permission set of the underlying user, so the app can check what
+     * that user is actually allowed to do, independent of what the app itself was
+     * granted. The token scope is unchanged: this exposes knowledge, not capability.
+     *
+     * For a normal user session (no actor token) it returns the caller's own
+     * permissions, identical to `getPermissions()`'s scope.
+     */
+    async getPrincipalPermissions() {
+        return await this.client.get("/v1/user/role/principal-permissions");
+    }
     /**
      * Get list of available permissions
      */
@@ -1289,6 +1310,7 @@ class IntegrationsBaseClient extends BaseClient {
             // @ts-ignore
             env = env !== null && env !== void 0 ? env : __global_env__ === null || __global_env__ === void 0 ? void 0 : __global_env__.PROJECT_ENV;
             token = token !== null && token !== void 0 ? token : __global_env__ === null || __global_env__ === void 0 ? void 0 : __global_env__.PROJECT_API_TOKEN;
+            project_uuid = __global_env__ === null || __global_env__ === void 0 ? void 0 : __global_env__.PROJECT_UUID;
             if (isBrowser) {
                 if (sessionStorage.getItem('protokol_context') === 'forge') {
                     headers['X-Project-Env'] = (_b = sessionStorage.getItem('forge_app_env')) !== null && _b !== void 0 ? _b : 'dev';
@@ -2153,36 +2175,41 @@ class VPFR extends IntegrationsBaseClient {
 }
 
 class Payments extends IntegrationsBaseClient {
+    // FIXME: No backend route exists for listing/searching transactions (neither
+    // monri.route.ts nor wspay.route.ts under karadjordje/src/routes/v1/payments/
+    // expose a "list" endpoint). This method's URL is left as-is (still broken)
+    // rather than being "fixed" to another guessed path that would still 404.
+    // Do not call this method until a corresponding backend route is added.
     async getTransactions(userId, params) {
         return await this.client.get(`/karadjordje/v1/payment/${userId}/list`, {
             params,
         });
     }
-    async getTransaction(provider, userId, transactionId) {
-        return await this.client.get(`/karadjordje/v1/payment/${provider}/${userId}/getTransaction`, {
+    async getTransaction(provider, transactionId) {
+        return await this.client.get(`/karadjordje/v1/payment/${provider}/getTransaction`, {
             params: { transactionId },
         });
     }
     async settings(provider) {
         return await this.client.get(`/karadjordje/v1/payment/${provider}/settings`);
     }
-    async deactivatePaymentLink(provider, user, transactionId) {
-        return await this.client.post(`/karadjordje/v1/payment/${provider}/${user}/deactivate/${transactionId}`);
+    async deactivatePaymentLink(provider, transactionId) {
+        return await this.client.post(`/karadjordje/v1/payment/${provider}/deactivate/${transactionId}`);
     }
-    async voidTransaction(provider, user, transactionId) {
-        return await this.client.post(`/karadjordje/v1/payment/${provider}/${user}/void/${transactionId}`);
+    async voidTransaction(provider, transactionId) {
+        return await this.client.post(`/karadjordje/v1/payment/${provider}/void/${transactionId}`);
     }
-    async refund(provider, user, transactionId) {
-        return await this.client.post(`/karadjordje/v1/payment/${provider}/${user}/refund/${transactionId}`);
+    async refund(provider, transactionId) {
+        return await this.client.post(`/karadjordje/v1/payment/${provider}/refund/${transactionId}`);
     }
-    async getPaymentLink(provider, user, options) {
-        return await this.client.post(`/karadjordje/v1/payment/${provider}/${user}/getPaymentLink`, options);
+    async getPaymentLink(provider, options) {
+        return await this.client.post(`/karadjordje/v1/payment/${provider}/getPaymentLink`, options);
     }
-    async getTokenRequestLink(provider, user, options) {
-        return await this.client.post(`/karadjordje/v1/payment/${provider}/${user}/getTokenRequestLink`, options);
+    async getTokenRequestLink(provider, options) {
+        return await this.client.post(`/karadjordje/v1/payment/${provider}/getTokenRequestLink`, options);
     }
-    async directPayUsingToken(provider, user, options) {
-        return await this.client.post(`/karadjordje/v1/payment/${provider}/${user}/directPayUsingToken`, options);
+    async directPayUsingToken(provider, options) {
+        return await this.client.post(`/karadjordje/v1/payment/${provider}/directPayUsingToken`, options);
     }
 }
 

package/dist/v0.9/types/component.d.ts

@@ -409,6 +409,7 @@ type SetupData = {
     is_public?: boolean;
     icon?: string;
     settings?: Settings;
+    force_override?: boolean;
 };
 type ComponentCreateResponse = ComponentListItem;
 export { FindParams, FindOptions, FindResponse, FindAdvancedParams, FindAggregateParams, Model, UpdateOptions, ModifyOptions, UpdateOperators, UpdateAggregate, ModelUpdateData, ComponentOptions, ComponentListResponse, ComponentListItem, ComponentLabel, ComponentWorkspace, StreamCallback, StreamHandler, AggregateChainable, UpdateManyOptions, CreateManyOptions, Settings, SettingsField, FieldRoles, FieldConstraints, Context, Preset, PresetContext, Filters, Function, Extension, Policy, FieldAccessConfig, TemplatesDist, SetupData, ComponentCreateResponse, };

package/dist/v0.9/types/users.d.ts

@@ -65,3 +65,13 @@ export interface Permission {
     action: string;
     role_uuid: string;
 }
+/**
+ * Resolved RBAC permission set for a user on the current project.
+ * Matches the dashboard `models.Permissions` response shape returned by
+ * `GET /v1/user/role/permissions` and `GET /v1/user/role/principal-permissions`.
+ */
+export interface Permissions {
+    is_admin: boolean;
+    roles: string[];
+    permissions: string[];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ptkl/sdk",
-  "version": "1.14.0",
+  "version": "1.16.0",
   "scripts": {
     "build": "rollup -c",
     "build:monaco": "npm run build && node scripts/generate-monaco-types.cjs",