spaps-sdk 1.10.0 → 1.10.2

package/dist/index.mjs

@@ -637,7 +637,7 @@ var SPAPSClient = class _SPAPSClient {
      * @param userId - Optional user ID override (secret key contexts only).
      */
     check: async (key, userId) => {
-      const q = new URLSearchParams({ key });
+      const q = new URLSearchParams({ entitlement_key: key });
       if (userId) q.append("user_id", userId);
       const res = await this.client.get(
         `/api/entitlements/check?${q.toString()}`,
@@ -651,7 +651,7 @@ var SPAPSClient = class _SPAPSClient {
      * Note: For publishable key contexts, only `resource_type=user` is permitted.
      * Non-user resource types will return a 403 error (enforced server-side).
      *
-     * @param resourceType - The resource type (e.g. "user", "company", "org", "system").
+     * @param resourceType - The resource type (e.g. "user", "company", "org", "system", "project").
      * @param resourceId - Optional specific resource ID.
      */
     listByResource: async (resourceType, resourceId) => {
@@ -722,6 +722,69 @@ var SPAPSClient = class _SPAPSClient {
       );
       return this.unwrapApiResponse(res, "Failed to create issue report");
     },
+    /**
+     * Upload one private pending screenshot attachment.
+     */
+    uploadAttachment: async (file, options) => {
+      if (typeof FormData === "undefined") {
+        throw new Error("FormData is required to upload issue report attachments");
+      }
+      const formData = new FormData();
+      const fileWithOptionalName = file;
+      const inferredFilename = typeof fileWithOptionalName.name === "string" ? fileWithOptionalName.name : void 0;
+      const filename = options?.filename ?? inferredFilename;
+      if (filename) {
+        formData.append("file", file, filename);
+      } else {
+        formData.append("file", file);
+      }
+      const res = await this.client.post(
+        "/api/v1/issue-reports/attachments",
+        formData,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to upload issue report attachment");
+    },
+    /**
+     * List non-deleted screenshot attachments for one issue report.
+     */
+    listAttachments: async (issueReportId) => {
+      const res = await this.client.get(
+        `/api/v1/issue-reports/${encodeURIComponent(issueReportId)}/attachments`,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to list issue report attachments");
+    },
+    /**
+     * Return a short-lived private attachment access URL.
+     */
+    getAttachmentAccess: async (attachmentId) => {
+      const res = await this.client.get(
+        `/api/v1/issue-reports/attachments/${encodeURIComponent(attachmentId)}/access`,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(
+        res,
+        "Failed to get issue report attachment access URL"
+      );
+    },
+    /**
+     * Return a short-lived private attachment access URL.
+     *
+     * @deprecated Use getAttachmentAccess(attachmentId).
+     */
+    getAttachmentAccessUrl: async (attachmentId) => {
+      return this.issueReporting.getAttachmentAccess(attachmentId);
+    },
+    /**
+     * Soft-delete one owned screenshot attachment.
+     */
+    deleteAttachment: async (attachmentId) => {
+      await this.client.delete(
+        `/api/v1/issue-reports/attachments/${encodeURIComponent(attachmentId)}`,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+    },
     /**
      * Create a short-lived voice transcription token for issue reporting.
      */
@@ -754,6 +817,82 @@ var SPAPSClient = class _SPAPSClient {
         this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
       );
       return this.unwrapApiResponse(res, "Failed to reply to issue report");
+    },
+    /**
+     * List the chronological, reporter-visible message thread for one owned
+     * issue report. Only active, reporter-visible rows are returned; retracted
+     * or superseded operator messages are excluded and raw audit payloads are
+     * never exposed. `needs_response` badges an open clarification request.
+     */
+    listMessages: async (issueReportId) => {
+      const res = await this.client.get(
+        `/api/v1/issue-reports/${issueReportId}/messages`,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to list issue report messages");
+    },
+    /**
+     * Submit a reporter clarification response on one owned issue report. This
+     * does NOT reopen a closed case (use `reply` for that). Idempotent on
+     * `idempotency_key`: same key + same body returns the existing message,
+     * same key + different body returns 409 ISSUE_REPORT_MESSAGE_CONFLICT.
+     */
+    submitMessage: async (issueReportId, payload) => {
+      const res = await this.client.post(
+        `/api/v1/issue-reports/${issueReportId}/messages`,
+        payload,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to submit issue report message");
+    },
+    /**
+     * Triage-operator message commands. These require a secret key context and a
+     * triage role/capability; publishable browser contexts are rejected by the
+     * server. Provide the secret key as the SDK's API key.
+     */
+    triage: {
+      /**
+       * List all projection rows for an app-scoped report (including corrected
+       * rows) for authorized triage operators.
+       */
+      listMessages: async (issueReportId) => {
+        const res = await this.client.get(
+          `/api/v1/issue-reports/triage/${issueReportId}/messages`,
+          this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+        );
+        return this.unwrapApiResponse(
+          res,
+          "Failed to list triage issue report messages"
+        );
+      },
+      /**
+       * Post a clarification_request or final_response reporter-visible message
+       * as a triage operator. Idempotent on `idempotency_key`; a key reused with
+       * a different body returns 409. A final_response can drive a terminal
+       * lifecycle transition via `resolve_case`; the internal resolution_note is
+       * never auto-displayed to reporters.
+       */
+      postMessage: async (issueReportId, payload) => {
+        const res = await this.client.post(
+          `/api/v1/issue-reports/triage/${issueReportId}/messages`,
+          payload,
+          this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+        );
+        return this.unwrapApiResponse(res, "Failed to post triage issue report message");
+      },
+      /**
+       * Retract an operator-authored message. The body is retained; the row's
+       * state is marked `retracted`. Retracting an already-retracted message is
+       * a safe no-op.
+       */
+      retractMessage: async (issueReportId, messageId, payload = {}) => {
+        const res = await this.client.post(
+          `/api/v1/issue-reports/triage/${issueReportId}/messages/${messageId}/retract`,
+          payload,
+          this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+        );
+        return this.unwrapApiResponse(res, "Failed to retract triage issue report message");
+      }
     }
   };
   /**
@@ -771,6 +910,17 @@ var SPAPSClient = class _SPAPSClient {
       );
       return this.unwrapApiResponse(res, "Failed to create app link");
     },
+    /**
+     * Update a short link owned by the authenticated user.
+     */
+    update: async (username, slug, payload) => {
+      const res = await this.client.patch(
+        `/api/v1/app-links/${encodeURIComponent(username)}/${encodeURIComponent(slug)}`,
+        payload,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to update app link");
+    },
     /**
      * Resolve a public short link for the active application.
      */
@@ -785,6 +935,58 @@ var SPAPSClient = class _SPAPSClient {
       return this.unwrapApiResponse(res, "Failed to get app link");
     }
   };
+  /**
+   * Marketing events and experiment results.
+   *
+   * Use a publishable key for browser-side event emission. Use a secret key
+   * from a trusted server or agent process when reading experiment results.
+   */
+  marketing = {
+    /**
+     * Emit one anonymous attribution touch or experiment exposure.
+     */
+    emit: async (payload) => {
+      if (payload.event_type === "experiment_exposure") {
+        if (!payload.experiment_id?.trim()) {
+          throw new Error("experiment_id is required for experiment_exposure events");
+        }
+        const variant = payload.variant_id ?? payload.variant;
+        if (!variant?.trim()) {
+          throw new Error("variant_id or variant is required for experiment_exposure events");
+        }
+      }
+      const res = await this.client.post("/api/marketing-events/ingest", payload);
+      return this.unwrapApiResponse(
+        res,
+        "Failed to emit marketing event"
+      );
+    },
+    /**
+     * Alias for emit(), matching the backend ingest endpoint language.
+     */
+    ingest: async (payload) => {
+      return this.marketing.emit(payload);
+    },
+    /**
+     * Read per-variant experiment results and the conservative stop signal.
+     */
+    getExperimentResults: async (experimentId) => {
+      const encodedExperimentId = encodeURIComponent(experimentId);
+      const res = await this.client.get(
+        `/api/marketing/experiments/${encodedExperimentId}/results`
+      );
+      return this.unwrapApiResponse(
+        res,
+        "Failed to get marketing experiment results"
+      );
+    },
+    /**
+     * Short alias for getExperimentResults().
+     */
+    getResults: async (experimentId) => {
+      return this.marketing.getExperimentResults(experimentId);
+    }
+  };
   static envVar(name) {
     if (typeof process !== "undefined" && process.env) {
       return process.env[name];
@@ -1260,9 +1462,9 @@ var SPAPSClient = class _SPAPSClient {
       const res = await this.client.post("/api/stripe/products/with-price", payload, { headers: { Authorization: `Bearer ${this.accessToken}` } });
       return this.unwrapApiResponse(res, "Failed to create product with price");
     },
-    createProductWithPriceSuperAdmin: async (productId, payload) => {
+    createProductWithPriceSuperAdmin: async (applicationId, payload) => {
       if (!this.accessToken) throw new Error("Authentication required. Please authenticate first.");
-      const res = await this.client.post(`/api/stripe/products/super-admin/${productId}/with-price`, payload, { headers: { Authorization: `Bearer ${this.accessToken}` } });
+      const res = await this.client.post(`/api/stripe/products/super-admin/${applicationId}/with-price`, payload, { headers: { Authorization: `Bearer ${this.accessToken}` } });
       return this.unwrapApiResponse(res, "Failed to create product with price (super admin)");
     },
     setDefaultPrice: async (productId, payload) => {
@@ -1590,6 +1792,25 @@ var SPAPSClient = class _SPAPSClient {
    * after work completes.
    */
   usage = {
+    /**
+     * List active usage feature definitions for this application.
+     */
+    listFeatures: async () => {
+      const res = await this.client.get("/api/usage/features");
+      return this.unwrapApiResponse(res, "Failed to list usage features");
+    },
+    /**
+     * Fetch current window usage status without creating an authorization.
+     */
+    getStatus: async (query) => {
+      const q = new URLSearchParams();
+      q.set("feature_key", query.feature_key);
+      q.set("resource_type", query.resource_type);
+      if (query.resource_id) q.set("resource_id", query.resource_id);
+      if (query.subject_user_id) q.set("subject_user_id", query.subject_user_id);
+      const res = await this.client.get(`/api/usage/status?${q.toString()}`);
+      return this.unwrapApiResponse(res, "Failed to get usage status");
+    },
     /**
      * Authorize proposed usage before a downstream job, inference, or action runs.
      */
@@ -1603,21 +1824,43 @@ var SPAPSClient = class _SPAPSClient {
     record: async (payload) => {
       const res = await this.client.post("/api/usage/record", payload);
       return this.unwrapApiResponse(res, "Failed to record usage");
+    },
+    /**
+     * List usage events in deterministic newest-first order.
+     */
+    listHistory: async (query = {}) => {
+      const q = new URLSearchParams();
+      if (query.feature_key) q.set("feature_key", query.feature_key);
+      if (query.resource_type) q.set("resource_type", query.resource_type);
+      if (query.resource_id) q.set("resource_id", query.resource_id);
+      if (query.subject_user_id) q.set("subject_user_id", query.subject_user_id);
+      if (query.limit) q.set("limit", String(query.limit));
+      if (typeof query.offset === "number") q.set("offset", String(query.offset));
+      const suffix = q.toString() ? `?${q.toString()}` : "";
+      const res = await this.client.get(`/api/usage/history${suffix}`);
+      return this.unwrapApiResponse(res, "Failed to list usage history");
     }
   };
   // Stripe Methods
   async createCheckoutSession(priceId, successUrl, cancelUrl) {
-    return this.client.post("/api/stripe/create-checkout-session", {
-      price_id: priceId,
+    return this.client.post("/api/stripe/checkout-sessions", {
+      mode: "payment",
+      line_items: [{ price_id: priceId, quantity: 1 }],
       success_url: successUrl,
-      cancel_url: cancelUrl
+      cancel_url: cancelUrl ?? successUrl
     });
   }
-  async getSubscription() {
-    return this.client.get("/api/stripe/subscription");
+  async getSubscription(subscriptionId) {
+    if (subscriptionId) {
+      return this.client.get(`/api/stripe/subscription/${subscriptionId}`);
+    }
+    return this.client.get("/api/stripe/subscriptions");
   }
-  async cancelSubscription() {
-    await this.client.delete("/api/stripe/subscription");
+  async cancelSubscription(subscriptionId, options = {}) {
+    if (!subscriptionId) {
+      throw new Error("subscriptionId is required to cancel a subscription.");
+    }
+    return this.client.post(`/api/stripe/subscription/${subscriptionId}/cancel`, options);
   }
   // Usage Methods
   async authorizeUsage(payload) {
@@ -1626,6 +1869,18 @@ var SPAPSClient = class _SPAPSClient {
   async recordUsage(payload) {
     return this.usage.record(payload);
   }
+  async getUsageStatus(query) {
+    return this.usage.getStatus(query);
+  }
+  async listUsageHistory(query = {}) {
+    return this.usage.listHistory(query);
+  }
+  async emitMarketingEvent(payload) {
+    return this.marketing.emit(payload);
+  }
+  async getMarketingExperimentResults(experimentId) {
+    return this.marketing.getExperimentResults(experimentId);
+  }
   // Secure Messaging Methods
   async createSecureMessage(payload) {
     const response = await this.client.post("/api/secure-messages", payload);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spaps-sdk",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "description": "Sweet Potato Authentication & Payment Service SDK - Zero-config client with built-in permission checking, role-based access control, and dayrate scheduling",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -51,7 +51,7 @@
   "dependencies": {
     "axios": "^1.15.1",
     "cross-fetch": "^4.0.0",
-    "spaps-types": "^1.3.0"
+    "spaps-types": "^1.4.2"
   },
   "devDependencies": {
     "@types/node": "^20.10.0",
@@ -81,4 +81,4 @@
   "engines": {
     "node": ">=14.0.0"
   }
-}
+}