spaps-sdk 1.10.0 → 1.10.2

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import * as spaps_types from 'spaps-types';
-import { ResourceType, Entitlement, CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, IssueReportScope, IssueReportStatusResult, IssueReportStatus, IssueReportListResult, IssueReport, CreateIssueReportRequest, IssueReportingVoiceTokenResult, UpdateIssueReportRequest, ReplyIssueReportRequest, CreateAppLinkRequest, AppLink, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, X402ResourceStatusResponse, X402ActionResponse, X402ReceiptResponse, X402ReceiptListResponse, X402HandoffVerification, DayrateAvailabilityResponse, DayrateBookingRequest, DayrateBookingResponse, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayrateX402BookingRequest, DayrateX402BookingResponse, DayrateCheckoutStatusResponse, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlRecordRequest, UsageControlRecordResponse, Subscription, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
-export { AdminPermission, AdminRole, AdminUser, ApiResponse, AppLink, AuthResponse, CheckoutSession, CreateAppLinkRequest, CreateCryptoInvoiceRequest, CreateIssueReportRequest, CreatePriceRequest, CreateProductRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, DayrateAvailabilityResponse, DayrateAvailableSlot, DayrateBookingRequest, DayrateBookingResponse, DayrateCheckoutStatus, DayrateCheckoutStatusBooking, DayrateCheckoutStatusResponse, DayrateDayOfWeek, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayratePriceBreakdown, DayrateSlotType, DayrateX402BookingRequest, DayrateX402BookingResponse, Entitlement, IssueReport, IssueReportListResult, IssueReportStatus, IssueReportStatusResult, IssueReportTarget, IssueReportingInputMode, IssueReportingVoiceProvider, IssueReportingVoiceTokenResult, LinkedIssueReportCase, Price, Product, ProductSyncResult, ReplyIssueReportRequest, ResourceType, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateIssueReportRequest, UpdateProductRequest, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlDecision, UsageControlDimensions, UsageControlError, UsageControlErrorCode, UsageControlLedgerEvent, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlRecordStatus, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, X402ActionFreeResponse, X402ActionOutcome, X402ActionPendingResponse, X402ActionReplayedResponse, X402ActionResponse, X402ActionSettledResponse, X402ExecuteActionRequest, X402HandoffAuthorization, X402HandoffVerification, X402HandoffVerifyRequest, X402PaymentAccept, X402PaymentRequirement, X402ProjectionStatus, X402Receipt, X402ReceiptListResponse, X402ReceiptResponse, X402ReceiptStatus, X402Resource, X402ResourceStatus, X402ResourceStatusResponse, atomicToMoneyUnits, createSecureMessageRequestSchema, isX402PaymentRequired, isX402ResourceStatus, moneyUnitsToAtomic, roundHalfToPositiveInfinity, secureMessageMetadataSchema, secureMessageSchema, validatePositiveAmountAtomic } from 'spaps-types';
+import { ResourceType, Entitlement, CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, IssueReportScope, IssueReportStatusResult, IssueReportStatus, IssueReportListResult, IssueReport, CreateIssueReportRequest, IssueReportAttachmentOut, ListIssueReportAttachmentsResponse, IssueReportAttachmentAccessResponse, IssueReportingVoiceTokenResult, UpdateIssueReportRequest, ReplyIssueReportRequest, ListIssueReportMessagesResponse, CreateReporterMessageRequest, IssueReportMessage, CreateOperatorMessageRequest, RetractOperatorMessageRequest, CreateAppLinkRequest, AppLink, UpdateAppLinkRequest, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, X402ResourceStatusResponse, X402ActionResponse, X402ReceiptResponse, X402ReceiptListResponse, X402HandoffVerification, DayrateAvailabilityResponse, DayrateBookingRequest, DayrateBookingResponse, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayrateX402BookingRequest, DayrateX402BookingResponse, DayrateCheckoutStatusResponse, UsageControlFeaturesResponse, UsageControlStatusRequest, UsageControlStatusResponse, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, Subscription, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
+export { AdminPermission, AdminRole, AdminUser, ApiResponse, AppLink, AuthResponse, CheckoutSession, CreateAppLinkRequest, CreateCryptoInvoiceRequest, CreateIssueReportRequest, CreateOperatorMessageRequest, CreatePriceRequest, CreateProductRequest, CreateReporterMessageRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, DayrateAvailabilityResponse, DayrateAvailableSlot, DayrateBookingRequest, DayrateBookingResponse, DayrateCheckoutStatus, DayrateCheckoutStatusBooking, DayrateCheckoutStatusResponse, DayrateDayOfWeek, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayratePriceBreakdown, DayrateSlotType, DayrateX402BookingRequest, DayrateX402BookingResponse, Entitlement, IssueReport, IssueReportAttachmentAccessResponse, IssueReportAttachmentOut, IssueReportListResult, IssueReportMessage, IssueReportStatus, IssueReportStatusResult, IssueReportTarget, IssueReportingInputMode, IssueReportingVoiceProvider, IssueReportingVoiceTokenResult, LinkedIssueReportCase, ListIssueReportAttachmentsResponse, ListIssueReportMessagesResponse, Price, Product, ProductSyncResult, ReplyIssueReportRequest, ResourceType, RetractOperatorMessageRequest, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateAppLinkRequest, UpdateIssueReportRequest, UpdateProductRequest, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlDecision, UsageControlDimensions, UsageControlError, UsageControlErrorCode, UsageControlFeaturesResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, UsageControlLedgerEvent, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlRecordStatus, UsageControlStatusRequest, UsageControlStatusResponse, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, X402ActionFreeResponse, X402ActionOutcome, X402ActionPendingResponse, X402ActionReplayedResponse, X402ActionResponse, X402ActionSettledResponse, X402ExecuteActionRequest, X402HandoffAuthorization, X402HandoffVerification, X402HandoffVerifyRequest, X402PaymentAccept, X402PaymentRequirement, X402ProjectionStatus, X402Receipt, X402ReceiptListResponse, X402ReceiptResponse, X402ReceiptStatus, X402Resource, X402ResourceStatus, X402ResourceStatusResponse, atomicToMoneyUnits, createSecureMessageRequestSchema, isX402PaymentRequired, isX402ResourceStatus, moneyUnitsToAtomic, roundHalfToPositiveInfinity, secureMessageMetadataSchema, secureMessageSchema, validatePositiveAmountAtomic } from 'spaps-types';
 
 /**
  * Permission checking utilities for SPAPS SDK
@@ -336,6 +336,73 @@ interface EmailTemplatePreview {
     html: string;
     text?: string;
 }
+type MarketingEventType = 'attribution_touch' | 'experiment_exposure';
+type MarketingExperimentRecommendation = 'continue' | 'continue_srm_warning' | 'stop_for_winner';
+type MarketingExperimentSrmStatus = 'pass' | 'warning' | 'not_applicable';
+interface MarketingEventIngestRequest {
+    application_id?: string;
+    anon_id: string;
+    event_type: MarketingEventType;
+    experiment_id?: string | null;
+    variant_id?: string | null;
+    variant?: string | null;
+    metadata?: Record<string, unknown> | null;
+    dedupe_key?: string | null;
+    timestamp?: string | null;
+    observed_at?: string | null;
+}
+interface MarketingEventIngestResponse {
+    id: string;
+    application_id: string;
+    anon_id: string;
+    event_type: MarketingEventType;
+    experiment_id?: string | null;
+    variant?: string | null;
+    dedupe_key: string;
+    ts: string;
+    created_at: string;
+}
+interface MarketingExperimentVariantResult {
+    variant_id: string | null;
+    exposures: number;
+    conversions: number;
+    conversion_rate: number;
+    revenue: Record<string, number>;
+}
+interface MarketingExperimentMinSampleDecision {
+    met: boolean;
+    min_exposures_per_variant: number;
+    min_total_conversions: number;
+    observed_min_exposures: number;
+    observed_total_conversions: number;
+}
+interface MarketingExperimentSrmDecision {
+    status: MarketingExperimentSrmStatus;
+    expected_share?: number | null;
+    max_share_ratio?: number | null;
+    min_share_ratio?: number | null;
+}
+interface MarketingExperimentEffectDecision {
+    leader_variant_id?: string | null;
+    runner_up_variant_id?: string | null;
+    absolute_lift?: number | null;
+    relative_lift?: number | null;
+}
+interface MarketingExperimentDecision {
+    decisive: boolean;
+    recommendation: MarketingExperimentRecommendation;
+    winner_variant_id?: string | null;
+    reason_codes: string[];
+    min_sample: MarketingExperimentMinSampleDecision;
+    srm: MarketingExperimentSrmDecision;
+    effect: MarketingExperimentEffectDecision;
+}
+interface MarketingExperimentResultsResponse {
+    application_id: string;
+    experiment_id: string;
+    variants: MarketingExperimentVariantResult[];
+    decision: MarketingExperimentDecision;
+}
 interface EntitlementListParams {
     /** Filter by entitlement key */
     key?: string;
@@ -360,6 +427,9 @@ interface IssueReportListParams {
 interface IssueReportStatusParams {
     scope?: SupportedIssueReportScope;
 }
+interface IssueReportAttachmentUploadOptions {
+    filename?: string;
+}
 declare class X402PaymentRequiredSDKError extends Error {
     readonly paymentRequiredHeader: string;
     readonly response: unknown;
@@ -705,7 +775,7 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
          * Note: For publishable key contexts, only `resource_type=user` is permitted.
          * Non-user resource types will return a 403 error (enforced server-side).
          *
-         * @param resourceType - The resource type (e.g. "user", "company", "org", "system").
+         * @param resourceType - The resource type (e.g. "user", "company", "org", "system", "project").
          * @param resourceId - Optional specific resource ID.
          */
         listByResource: (resourceType: ResourceType, resourceId?: string) => Promise<Entitlement[]>;
@@ -730,6 +800,28 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
          * Create a new canonical issue report.
          */
         create: (payload: CreateIssueReportRequest) => Promise<IssueReport>;
+        /**
+         * Upload one private pending screenshot attachment.
+         */
+        uploadAttachment: (file: Blob, options?: IssueReportAttachmentUploadOptions) => Promise<IssueReportAttachmentOut>;
+        /**
+         * List non-deleted screenshot attachments for one issue report.
+         */
+        listAttachments: (issueReportId: string) => Promise<ListIssueReportAttachmentsResponse>;
+        /**
+         * Return a short-lived private attachment access URL.
+         */
+        getAttachmentAccess: (attachmentId: string) => Promise<IssueReportAttachmentAccessResponse>;
+        /**
+         * Return a short-lived private attachment access URL.
+         *
+         * @deprecated Use getAttachmentAccess(attachmentId).
+         */
+        getAttachmentAccessUrl: (attachmentId: string) => Promise<IssueReportAttachmentAccessResponse>;
+        /**
+         * Soft-delete one owned screenshot attachment.
+         */
+        deleteAttachment: (attachmentId: string) => Promise<void>;
         /**
          * Create a short-lived voice transcription token for issue reporting.
          */
@@ -742,6 +834,46 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
          * Reply to a resolved or ignored issue report and reopen the linked case.
          */
         reply: (issueReportId: string, payload: ReplyIssueReportRequest) => Promise<IssueReport>;
+        /**
+         * List the chronological, reporter-visible message thread for one owned
+         * issue report. Only active, reporter-visible rows are returned; retracted
+         * or superseded operator messages are excluded and raw audit payloads are
+         * never exposed. `needs_response` badges an open clarification request.
+         */
+        listMessages: (issueReportId: string) => Promise<ListIssueReportMessagesResponse>;
+        /**
+         * Submit a reporter clarification response on one owned issue report. This
+         * does NOT reopen a closed case (use `reply` for that). Idempotent on
+         * `idempotency_key`: same key + same body returns the existing message,
+         * same key + different body returns 409 ISSUE_REPORT_MESSAGE_CONFLICT.
+         */
+        submitMessage: (issueReportId: string, payload: CreateReporterMessageRequest) => Promise<IssueReportMessage>;
+        /**
+         * Triage-operator message commands. These require a secret key context and a
+         * triage role/capability; publishable browser contexts are rejected by the
+         * server. Provide the secret key as the SDK's API key.
+         */
+        triage: {
+            /**
+             * List all projection rows for an app-scoped report (including corrected
+             * rows) for authorized triage operators.
+             */
+            listMessages: (issueReportId: string) => Promise<ListIssueReportMessagesResponse>;
+            /**
+             * Post a clarification_request or final_response reporter-visible message
+             * as a triage operator. Idempotent on `idempotency_key`; a key reused with
+             * a different body returns 409. A final_response can drive a terminal
+             * lifecycle transition via `resolve_case`; the internal resolution_note is
+             * never auto-displayed to reporters.
+             */
+            postMessage: (issueReportId: string, payload: CreateOperatorMessageRequest) => Promise<IssueReportMessage>;
+            /**
+             * Retract an operator-authored message. The body is retained; the row's
+             * state is marked `retracted`. Retracting an already-retracted message is
+             * a safe no-op.
+             */
+            retractMessage: (issueReportId: string, messageId: string, payload?: RetractOperatorMessageRequest) => Promise<IssueReportMessage>;
+        };
     };
     /**
      * Application-scoped short links for browser apps that need stable public URLs.
@@ -751,6 +883,10 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
          * Create a short link owned by the authenticated user.
          */
         create: (payload: CreateAppLinkRequest) => Promise<AppLink>;
+        /**
+         * Update a short link owned by the authenticated user.
+         */
+        update: (username: string, slug: string, payload: UpdateAppLinkRequest) => Promise<AppLink>;
         /**
          * Resolve a public short link for the active application.
          */
@@ -758,6 +894,30 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
             track?: boolean;
         }) => Promise<AppLink>;
     };
+    /**
+     * Marketing events and experiment results.
+     *
+     * Use a publishable key for browser-side event emission. Use a secret key
+     * from a trusted server or agent process when reading experiment results.
+     */
+    marketing: {
+        /**
+         * Emit one anonymous attribution touch or experiment exposure.
+         */
+        emit: (payload: MarketingEventIngestRequest) => Promise<MarketingEventIngestResponse>;
+        /**
+         * Alias for emit(), matching the backend ingest endpoint language.
+         */
+        ingest: (payload: MarketingEventIngestRequest) => Promise<MarketingEventIngestResponse>;
+        /**
+         * Read per-variant experiment results and the conservative stop signal.
+         */
+        getExperimentResults: (experimentId: string) => Promise<MarketingExperimentResultsResponse>;
+        /**
+         * Short alias for getExperimentResults().
+         */
+        getResults: (experimentId: string) => Promise<MarketingExperimentResultsResponse>;
+    };
     private static envVar;
     constructor(config?: SPAPSConfig);
     /** Raw API request helper that returns an ApiResponse-like shape */
@@ -963,7 +1123,7 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
         updateProductSuperAdmin: (productId: string, updates: any) => Promise<any>;
         deleteProductSuperAdmin: (productId: string) => Promise<any>;
         createProductWithPrice: (payload: any) => Promise<any>;
-        createProductWithPriceSuperAdmin: (productId: string, payload: any) => Promise<any>;
+        createProductWithPriceSuperAdmin: (applicationId: string, payload: any) => Promise<any>;
         setDefaultPrice: (productId: string, payload: {
             price_id: string;
         }) => Promise<any>;
@@ -1099,6 +1259,14 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
      * after work completes.
      */
     usage: {
+        /**
+         * List active usage feature definitions for this application.
+         */
+        listFeatures: () => Promise<UsageControlFeaturesResponse>;
+        /**
+         * Fetch current window usage status without creating an authorization.
+         */
+        getStatus: (query: UsageControlStatusRequest) => Promise<UsageControlStatusResponse>;
         /**
          * Authorize proposed usage before a downstream job, inference, or action runs.
          */
@@ -1107,16 +1275,28 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
          * Record immutable usage after work completes.
          */
         record: (payload: UsageControlRecordRequest) => Promise<UsageControlRecordResponse>;
+        /**
+         * List usage events in deterministic newest-first order.
+         */
+        listHistory: (query?: UsageControlHistoryRequest) => Promise<UsageControlHistoryResponse>;
     };
     createCheckoutSession(priceId: string, successUrl: string, cancelUrl?: string): Promise<{
         data: CheckoutSession;
     }>;
-    getSubscription(): Promise<{
+    getSubscription(subscriptionId?: string): Promise<{
+        data: Subscription | Subscription[];
+    }>;
+    cancelSubscription(subscriptionId?: string, options?: {
+        immediately?: boolean;
+    }): Promise<{
         data: Subscription;
     }>;
-    cancelSubscription(): Promise<void>;
     authorizeUsage(payload: UsageControlAuthorizeRequest): Promise<UsageControlAuthorizeResponse>;
     recordUsage(payload: UsageControlRecordRequest): Promise<UsageControlRecordResponse>;
+    getUsageStatus(query: UsageControlStatusRequest): Promise<UsageControlStatusResponse>;
+    listUsageHistory(query?: UsageControlHistoryRequest): Promise<UsageControlHistoryResponse>;
+    emitMarketingEvent(payload: MarketingEventIngestRequest): Promise<MarketingEventIngestResponse>;
+    getMarketingExperimentResults(experimentId: string): Promise<MarketingExperimentResultsResponse>;
     private createSecureMessage;
     private listSecureMessages;
     /**
@@ -1298,4 +1478,4 @@ declare function createServerClient(secretKey: string, options?: Omit<SPAPSConfi
  */
 declare function detectKeyType(key: string): ApiKeyType | null;
 
-export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, type CreateSkillEvalCaseRequest, type CreateSkillEvalGovernanceSnapshotRequest, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type HeaderProvider, type ImportSkillEvalGovernanceOutcomeRequest, type IssueReportListParams, type IssueReportStatusParams, type PermissionCheckResult, PermissionChecker, type RespondToSkillEvalReviewRequest, type RevealSkillEvalEvidenceRequest, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type SPAPSEnvelope, type SkillEvalAccessMode, type SkillEvalActorAccess, type SkillEvalCandidateInput, type SkillEvalCandidateResponse, type SkillEvalCasePolicy, type SkillEvalCaseResponse, type SkillEvalConfidence, type SkillEvalCreateOptions, type SkillEvalDisclosurePolicy, type SkillEvalEligibilitySource, type SkillEvalGovernanceOutcomeResult, type SkillEvalGovernancePurpose, type SkillEvalGovernanceSnapshotResult, type SkillEvalInsight, type SkillEvalInsightsResponse, type SkillEvalModelEffort, type SkillEvalMutationOptions, type SkillEvalPosterResponse, type SkillEvalPosterResponseResult, type SkillEvalRevealField, type SkillEvalRevealResult, type SkillEvalReviewMarkInput, type SkillEvalReviewMarkKind, type SkillEvalReviewResponse, type SkillEvalReviewRoom, type SkillEvalReviewerEligibilityInput, type SkillEvalRewardEvent, type SubmitSkillEvalReviewRequest, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, type X402ExecuteActionOptions, X402PaymentRequiredSDKError, type X402ReceiptListParams, type X402VerifyHandoffOptions, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, isEnvelope, isErrorEnvelope, isSuccessEnvelope, unwrapEnvelope, unwrapNestedData, verifyCryptoWebhookSignature };
+export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, type CreateSkillEvalCaseRequest, type CreateSkillEvalGovernanceSnapshotRequest, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type HeaderProvider, type ImportSkillEvalGovernanceOutcomeRequest, type IssueReportAttachmentUploadOptions, type IssueReportListParams, type IssueReportStatusParams, type MarketingEventIngestRequest, type MarketingEventIngestResponse, type MarketingEventType, type MarketingExperimentDecision, type MarketingExperimentEffectDecision, type MarketingExperimentMinSampleDecision, type MarketingExperimentRecommendation, type MarketingExperimentResultsResponse, type MarketingExperimentSrmDecision, type MarketingExperimentSrmStatus, type MarketingExperimentVariantResult, type PermissionCheckResult, PermissionChecker, type RespondToSkillEvalReviewRequest, type RevealSkillEvalEvidenceRequest, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type SPAPSEnvelope, type SkillEvalAccessMode, type SkillEvalActorAccess, type SkillEvalCandidateInput, type SkillEvalCandidateResponse, type SkillEvalCasePolicy, type SkillEvalCaseResponse, type SkillEvalConfidence, type SkillEvalCreateOptions, type SkillEvalDisclosurePolicy, type SkillEvalEligibilitySource, type SkillEvalGovernanceOutcomeResult, type SkillEvalGovernancePurpose, type SkillEvalGovernanceSnapshotResult, type SkillEvalInsight, type SkillEvalInsightsResponse, type SkillEvalModelEffort, type SkillEvalMutationOptions, type SkillEvalPosterResponse, type SkillEvalPosterResponseResult, type SkillEvalRevealField, type SkillEvalRevealResult, type SkillEvalReviewMarkInput, type SkillEvalReviewMarkKind, type SkillEvalReviewResponse, type SkillEvalReviewRoom, type SkillEvalReviewerEligibilityInput, type SkillEvalRewardEvent, type SubmitSkillEvalReviewRequest, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, type X402ExecuteActionOptions, X402PaymentRequiredSDKError, type X402ReceiptListParams, type X402VerifyHandoffOptions, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, isEnvelope, isErrorEnvelope, isSuccessEnvelope, unwrapEnvelope, unwrapNestedData, verifyCryptoWebhookSignature };

package/dist/index.js

@@ -672,7 +672,7 @@ var SPAPSClient = class _SPAPSClient {
      * @param userId - Optional user ID override (secret key contexts only).
      */
     check: async (key, userId) => {
-      const q = new URLSearchParams({ key });
+      const q = new URLSearchParams({ entitlement_key: key });
       if (userId) q.append("user_id", userId);
       const res = await this.client.get(
         `/api/entitlements/check?${q.toString()}`,
@@ -686,7 +686,7 @@ var SPAPSClient = class _SPAPSClient {
      * Note: For publishable key contexts, only `resource_type=user` is permitted.
      * Non-user resource types will return a 403 error (enforced server-side).
      *
-     * @param resourceType - The resource type (e.g. "user", "company", "org", "system").
+     * @param resourceType - The resource type (e.g. "user", "company", "org", "system", "project").
      * @param resourceId - Optional specific resource ID.
      */
     listByResource: async (resourceType, resourceId) => {
@@ -757,6 +757,69 @@ var SPAPSClient = class _SPAPSClient {
       );
       return this.unwrapApiResponse(res, "Failed to create issue report");
     },
+    /**
+     * Upload one private pending screenshot attachment.
+     */
+    uploadAttachment: async (file, options) => {
+      if (typeof FormData === "undefined") {
+        throw new Error("FormData is required to upload issue report attachments");
+      }
+      const formData = new FormData();
+      const fileWithOptionalName = file;
+      const inferredFilename = typeof fileWithOptionalName.name === "string" ? fileWithOptionalName.name : void 0;
+      const filename = options?.filename ?? inferredFilename;
+      if (filename) {
+        formData.append("file", file, filename);
+      } else {
+        formData.append("file", file);
+      }
+      const res = await this.client.post(
+        "/api/v1/issue-reports/attachments",
+        formData,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to upload issue report attachment");
+    },
+    /**
+     * List non-deleted screenshot attachments for one issue report.
+     */
+    listAttachments: async (issueReportId) => {
+      const res = await this.client.get(
+        `/api/v1/issue-reports/${encodeURIComponent(issueReportId)}/attachments`,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to list issue report attachments");
+    },
+    /**
+     * Return a short-lived private attachment access URL.
+     */
+    getAttachmentAccess: async (attachmentId) => {
+      const res = await this.client.get(
+        `/api/v1/issue-reports/attachments/${encodeURIComponent(attachmentId)}/access`,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(
+        res,
+        "Failed to get issue report attachment access URL"
+      );
+    },
+    /**
+     * Return a short-lived private attachment access URL.
+     *
+     * @deprecated Use getAttachmentAccess(attachmentId).
+     */
+    getAttachmentAccessUrl: async (attachmentId) => {
+      return this.issueReporting.getAttachmentAccess(attachmentId);
+    },
+    /**
+     * Soft-delete one owned screenshot attachment.
+     */
+    deleteAttachment: async (attachmentId) => {
+      await this.client.delete(
+        `/api/v1/issue-reports/attachments/${encodeURIComponent(attachmentId)}`,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+    },
     /**
      * Create a short-lived voice transcription token for issue reporting.
      */
@@ -789,6 +852,82 @@ var SPAPSClient = class _SPAPSClient {
         this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
       );
       return this.unwrapApiResponse(res, "Failed to reply to issue report");
+    },
+    /**
+     * List the chronological, reporter-visible message thread for one owned
+     * issue report. Only active, reporter-visible rows are returned; retracted
+     * or superseded operator messages are excluded and raw audit payloads are
+     * never exposed. `needs_response` badges an open clarification request.
+     */
+    listMessages: async (issueReportId) => {
+      const res = await this.client.get(
+        `/api/v1/issue-reports/${issueReportId}/messages`,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to list issue report messages");
+    },
+    /**
+     * Submit a reporter clarification response on one owned issue report. This
+     * does NOT reopen a closed case (use `reply` for that). Idempotent on
+     * `idempotency_key`: same key + same body returns the existing message,
+     * same key + different body returns 409 ISSUE_REPORT_MESSAGE_CONFLICT.
+     */
+    submitMessage: async (issueReportId, payload) => {
+      const res = await this.client.post(
+        `/api/v1/issue-reports/${issueReportId}/messages`,
+        payload,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to submit issue report message");
+    },
+    /**
+     * Triage-operator message commands. These require a secret key context and a
+     * triage role/capability; publishable browser contexts are rejected by the
+     * server. Provide the secret key as the SDK's API key.
+     */
+    triage: {
+      /**
+       * List all projection rows for an app-scoped report (including corrected
+       * rows) for authorized triage operators.
+       */
+      listMessages: async (issueReportId) => {
+        const res = await this.client.get(
+          `/api/v1/issue-reports/triage/${issueReportId}/messages`,
+          this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+        );
+        return this.unwrapApiResponse(
+          res,
+          "Failed to list triage issue report messages"
+        );
+      },
+      /**
+       * Post a clarification_request or final_response reporter-visible message
+       * as a triage operator. Idempotent on `idempotency_key`; a key reused with
+       * a different body returns 409. A final_response can drive a terminal
+       * lifecycle transition via `resolve_case`; the internal resolution_note is
+       * never auto-displayed to reporters.
+       */
+      postMessage: async (issueReportId, payload) => {
+        const res = await this.client.post(
+          `/api/v1/issue-reports/triage/${issueReportId}/messages`,
+          payload,
+          this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+        );
+        return this.unwrapApiResponse(res, "Failed to post triage issue report message");
+      },
+      /**
+       * Retract an operator-authored message. The body is retained; the row's
+       * state is marked `retracted`. Retracting an already-retracted message is
+       * a safe no-op.
+       */
+      retractMessage: async (issueReportId, messageId, payload = {}) => {
+        const res = await this.client.post(
+          `/api/v1/issue-reports/triage/${issueReportId}/messages/${messageId}/retract`,
+          payload,
+          this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+        );
+        return this.unwrapApiResponse(res, "Failed to retract triage issue report message");
+      }
     }
   };
   /**
@@ -806,6 +945,17 @@ var SPAPSClient = class _SPAPSClient {
       );
       return this.unwrapApiResponse(res, "Failed to create app link");
     },
+    /**
+     * Update a short link owned by the authenticated user.
+     */
+    update: async (username, slug, payload) => {
+      const res = await this.client.patch(
+        `/api/v1/app-links/${encodeURIComponent(username)}/${encodeURIComponent(slug)}`,
+        payload,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to update app link");
+    },
     /**
      * Resolve a public short link for the active application.
      */
@@ -820,6 +970,58 @@ var SPAPSClient = class _SPAPSClient {
       return this.unwrapApiResponse(res, "Failed to get app link");
     }
   };
+  /**
+   * Marketing events and experiment results.
+   *
+   * Use a publishable key for browser-side event emission. Use a secret key
+   * from a trusted server or agent process when reading experiment results.
+   */
+  marketing = {
+    /**
+     * Emit one anonymous attribution touch or experiment exposure.
+     */
+    emit: async (payload) => {
+      if (payload.event_type === "experiment_exposure") {
+        if (!payload.experiment_id?.trim()) {
+          throw new Error("experiment_id is required for experiment_exposure events");
+        }
+        const variant = payload.variant_id ?? payload.variant;
+        if (!variant?.trim()) {
+          throw new Error("variant_id or variant is required for experiment_exposure events");
+        }
+      }
+      const res = await this.client.post("/api/marketing-events/ingest", payload);
+      return this.unwrapApiResponse(
+        res,
+        "Failed to emit marketing event"
+      );
+    },
+    /**
+     * Alias for emit(), matching the backend ingest endpoint language.
+     */
+    ingest: async (payload) => {
+      return this.marketing.emit(payload);
+    },
+    /**
+     * Read per-variant experiment results and the conservative stop signal.
+     */
+    getExperimentResults: async (experimentId) => {
+      const encodedExperimentId = encodeURIComponent(experimentId);
+      const res = await this.client.get(
+        `/api/marketing/experiments/${encodedExperimentId}/results`
+      );
+      return this.unwrapApiResponse(
+        res,
+        "Failed to get marketing experiment results"
+      );
+    },
+    /**
+     * Short alias for getExperimentResults().
+     */
+    getResults: async (experimentId) => {
+      return this.marketing.getExperimentResults(experimentId);
+    }
+  };
   static envVar(name) {
     if (typeof process !== "undefined" && process.env) {
       return process.env[name];
@@ -1295,9 +1497,9 @@ var SPAPSClient = class _SPAPSClient {
       const res = await this.client.post("/api/stripe/products/with-price", payload, { headers: { Authorization: `Bearer ${this.accessToken}` } });
       return this.unwrapApiResponse(res, "Failed to create product with price");
     },
-    createProductWithPriceSuperAdmin: async (productId, payload) => {
+    createProductWithPriceSuperAdmin: async (applicationId, payload) => {
       if (!this.accessToken) throw new Error("Authentication required. Please authenticate first.");
-      const res = await this.client.post(`/api/stripe/products/super-admin/${productId}/with-price`, payload, { headers: { Authorization: `Bearer ${this.accessToken}` } });
+      const res = await this.client.post(`/api/stripe/products/super-admin/${applicationId}/with-price`, payload, { headers: { Authorization: `Bearer ${this.accessToken}` } });
       return this.unwrapApiResponse(res, "Failed to create product with price (super admin)");
     },
     setDefaultPrice: async (productId, payload) => {
@@ -1625,6 +1827,25 @@ var SPAPSClient = class _SPAPSClient {
    * after work completes.
    */
   usage = {
+    /**
+     * List active usage feature definitions for this application.
+     */
+    listFeatures: async () => {
+      const res = await this.client.get("/api/usage/features");
+      return this.unwrapApiResponse(res, "Failed to list usage features");
+    },
+    /**
+     * Fetch current window usage status without creating an authorization.
+     */
+    getStatus: async (query) => {
+      const q = new URLSearchParams();
+      q.set("feature_key", query.feature_key);
+      q.set("resource_type", query.resource_type);
+      if (query.resource_id) q.set("resource_id", query.resource_id);
+      if (query.subject_user_id) q.set("subject_user_id", query.subject_user_id);
+      const res = await this.client.get(`/api/usage/status?${q.toString()}`);
+      return this.unwrapApiResponse(res, "Failed to get usage status");
+    },
     /**
      * Authorize proposed usage before a downstream job, inference, or action runs.
      */
@@ -1638,21 +1859,43 @@ var SPAPSClient = class _SPAPSClient {
     record: async (payload) => {
       const res = await this.client.post("/api/usage/record", payload);
       return this.unwrapApiResponse(res, "Failed to record usage");
+    },
+    /**
+     * List usage events in deterministic newest-first order.
+     */
+    listHistory: async (query = {}) => {
+      const q = new URLSearchParams();
+      if (query.feature_key) q.set("feature_key", query.feature_key);
+      if (query.resource_type) q.set("resource_type", query.resource_type);
+      if (query.resource_id) q.set("resource_id", query.resource_id);
+      if (query.subject_user_id) q.set("subject_user_id", query.subject_user_id);
+      if (query.limit) q.set("limit", String(query.limit));
+      if (typeof query.offset === "number") q.set("offset", String(query.offset));
+      const suffix = q.toString() ? `?${q.toString()}` : "";
+      const res = await this.client.get(`/api/usage/history${suffix}`);
+      return this.unwrapApiResponse(res, "Failed to list usage history");
     }
   };
   // Stripe Methods
   async createCheckoutSession(priceId, successUrl, cancelUrl) {
-    return this.client.post("/api/stripe/create-checkout-session", {
-      price_id: priceId,
+    return this.client.post("/api/stripe/checkout-sessions", {
+      mode: "payment",
+      line_items: [{ price_id: priceId, quantity: 1 }],
       success_url: successUrl,
-      cancel_url: cancelUrl
+      cancel_url: cancelUrl ?? successUrl
     });
   }
-  async getSubscription() {
-    return this.client.get("/api/stripe/subscription");
+  async getSubscription(subscriptionId) {
+    if (subscriptionId) {
+      return this.client.get(`/api/stripe/subscription/${subscriptionId}`);
+    }
+    return this.client.get("/api/stripe/subscriptions");
   }
-  async cancelSubscription() {
-    await this.client.delete("/api/stripe/subscription");
+  async cancelSubscription(subscriptionId, options = {}) {
+    if (!subscriptionId) {
+      throw new Error("subscriptionId is required to cancel a subscription.");
+    }
+    return this.client.post(`/api/stripe/subscription/${subscriptionId}/cancel`, options);
   }
   // Usage Methods
   async authorizeUsage(payload) {
@@ -1661,6 +1904,18 @@ var SPAPSClient = class _SPAPSClient {
   async recordUsage(payload) {
     return this.usage.record(payload);
   }
+  async getUsageStatus(query) {
+    return this.usage.getStatus(query);
+  }
+  async listUsageHistory(query = {}) {
+    return this.usage.listHistory(query);
+  }
+  async emitMarketingEvent(payload) {
+    return this.marketing.emit(payload);
+  }
+  async getMarketingExperimentResults(experimentId) {
+    return this.marketing.getExperimentResults(experimentId);
+  }
   // Secure Messaging Methods
   async createSecureMessage(payload) {
     const response = await this.client.post("/api/secure-messages", payload);