spaps-sdk 1.10.1 → 1.11.0

package/CHANGELOG.md

@@ -8,6 +8,18 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 
 ### Added
 
+- Added browser-safe `entitlements.listCurrentUserProjects()` and `entitlements.checkCurrentUserProjectAccess(...)` helpers for project grant reads.
+
+## [1.10.2] - 2026-06-04
+
+### Added
+
+- Added `issueReporting.getAttachmentAccess(attachmentId)` as the canonical screenshot access helper while keeping `getAttachmentAccessUrl` as a backward-compatible alias.
+
+## [1.10.1] - 2026-05-16
+
+### Added
+
 - Added issue-reporting screenshot attachment helpers for private upload, list, access URL, delete, and attach-by-ID create/update/reply flows.
 
 ## [1.10.0] - 2026-05-11

package/PERMISSIONS.md

@@ -2,6 +2,27 @@
 
 Client-side permission checking and role management utilities for SPAPS applications.
 
+## Browser-Safe Project Access
+
+The SDK exposes read-only helpers for current-user project access:
+
+```typescript
+await spaps.entitlements.listCurrentUserProjects({
+  entitlementKey: 'pds.project.viewer'
+});
+
+await spaps.entitlements.checkCurrentUserProjectAccess({
+  projectId: 'project_123',
+  entitlementKey: 'pds.project.viewer'
+});
+```
+
+These helpers are safe for publishable-key browser contexts because SPAPS
+validates the JWT subject server-side. The SDK does not expose browser methods
+for account membership invitation, project grant, project revoke, or account
+capability mutation. Keep those operations in a trusted backend using a secret
+key and admin access token.
+
 ## 🚀 Quick Start
 
 ```typescript
@@ -387,4 +408,4 @@ interface PermissionCheckResult {
 4. **Role-based UI**: Show/hide features based on user permissions
 5. **Custom admin management**: Use custom admin lists for multi-tenant apps
 6. **Testing**: Test permission logic with various user states
-7. **Type safety**: Use TypeScript interfaces for better development experience
+7. **Type safety**: Use TypeScript interfaces for better development experience

package/README.md

@@ -23,7 +23,7 @@ This package targets `Node.js >=14`.
 
 | Need | Package gives you |
 | --- | --- |
-| One client for many SPAPS surfaces | `auth`, `payments`, `sessions`, `secureMessages`, `issueReporting`, `appLinks`, `email`, `entitlements`, `usage`, `skillEvals`, `dayrate`, `admin`, and `cfo` namespaces |
+| One client for many SPAPS surfaces | `auth`, `payments`, `sessions`, `secureMessages`, `issueReporting`, `appLinks`, `marketing`, `email`, `entitlements`, `usage`, `skillEvals`, `dayrate`, `admin`, and `cfo` namespaces |
 | Local development without extra config | Localhost URLs automatically enable local mode |
 | Browser and server usage | `publishableKey`, `secretKey`, or legacy `apiKey` support |
 | Shared contracts | Re-exports a large slice of `spaps-types` |
@@ -86,8 +86,9 @@ Relevant environment variables:
 | `secureMessages` | Secure-message create/list helpers |
 | `issueReporting` | Status, history, create, update, reply, voice-token, and private screenshot attachment flows |
 | `appLinks` | Authenticated create and public resolve helpers for application-scoped short links |
+| `marketing` | Browser-safe attribution/experiment event emission and server-side experiment results |
 | `email` | Template lookup, preview, and send helpers |
-| `entitlements` | User and resource entitlement queries |
+| `entitlements` | User/resource entitlement queries and browser-safe current-user project access reads |
 | `usage` | Secret-key usage authorization and immutable usage recording |
 | `skillEvals` | Paid blind skill-eval cases, review rooms, reviewer marks, insight inboxes, and controlled reveal |
 | `dayrate` | Availability, Stripe booking, x402 booking-hold, and checkout-status helpers |
@@ -96,6 +97,33 @@ Relevant environment variables:
 
 ## Common Patterns
 
+### Browser-Safe Project Access Reads
+
+Use a publishable key and an authenticated user JWT in browser code. These
+helpers only read project access for the current user; membership invitation,
+project grant, project revoke, and account capability mutation remain
+server-only operations.
+
+```ts
+const spaps = new SPAPSClient({
+  apiUrl: "https://api.example.test",
+  publishableKey: "spaps_pub_example",
+});
+
+spaps.setAccessToken(userAccessToken);
+
+const projects = await spaps.entitlements.listCurrentUserProjects({
+  entitlementKey: "pds.project.viewer",
+});
+
+const access = await spaps.entitlements.checkCurrentUserProjectAccess({
+  projectId: "project_123",
+  entitlementKey: "pds.project.viewer",
+});
+
+console.log(projects.count, access.has_access);
+```
+
 ### Typed Secure Messages
 
 ```ts
@@ -149,7 +177,7 @@ const issue = await spaps.issueReporting.create({
   attachment_ids: [attachment.id],
 });
 
-const access = await spaps.issueReporting.getAttachmentAccessUrl(attachment.id);
+const access = await spaps.issueReporting.getAttachmentAccess(attachment.id);
 console.log(issue.id, access.expires_in_seconds);
 ```
 
@@ -174,6 +202,41 @@ const link = await spaps.appLinks.create({
 });
 
 console.log(`/${link.app_slug}/${link.username}/${link.slug}`);
+
+await spaps.appLinks.update(link.username, link.slug, {
+  metadata: { diagram_state: "pako:new-state" },
+});
+```
+
+### Marketing Events
+
+Use `marketing.emit` in the browser with a publishable key for anonymous
+attribution touches or experiment exposures. Use `marketing.getExperimentResults`
+from a trusted server or agent with a secret key to read revenue-backed results
+and the conservative stop signal.
+
+```ts
+const browserSpaps = new SPAPSClient({
+  apiUrl: "https://api.example.test",
+  publishableKey: "spaps_pub_example",
+});
+
+await browserSpaps.marketing.emit({
+  anon_id: "anon_01HY...",
+  event_type: "experiment_exposure",
+  experiment_id: "landing-hero-copy",
+  variant_id: "treatment",
+  dedupe_key: "landing-hero-copy:anon_01HY:treatment",
+  timestamp: new Date().toISOString(),
+});
+
+const serverSpaps = new SPAPSClient({
+  apiUrl: "https://api.example.test",
+  secretKey: process.env.SPAPS_SECRET_KEY,
+});
+
+const results = await serverSpaps.marketing.getExperimentResults("landing-hero-copy");
+console.log(results.decision.recommendation, results.decision.winner_variant_id);
 ```
 
 ### Server-Side Usage Control
@@ -448,7 +511,7 @@ npm run test:readme
 ## Metadata
 
 - `package_name`: `spaps-sdk`
-- `latest_version`: `1.10.0`
+- `latest_version`: `1.10.2`
 - `minimum_runtime`: `Node.js >=14.0.0`
 - `api_base_url`: `https://api.sweetpotato.dev`
 

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import * as spaps_types from 'spaps-types';
-import { ResourceType, Entitlement, CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, IssueReportScope, IssueReportStatusResult, IssueReportStatus, IssueReportListResult, IssueReport, CreateIssueReportRequest, IssueReportAttachmentOut, ListIssueReportAttachmentsResponse, IssueReportAttachmentAccessResponse, IssueReportingVoiceTokenResult, UpdateIssueReportRequest, ReplyIssueReportRequest, CreateAppLinkRequest, AppLink, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, X402ResourceStatusResponse, X402ActionResponse, X402ReceiptResponse, X402ReceiptListResponse, X402HandoffVerification, DayrateAvailabilityResponse, DayrateBookingRequest, DayrateBookingResponse, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayrateX402BookingRequest, DayrateX402BookingResponse, DayrateCheckoutStatusResponse, UsageControlFeaturesResponse, UsageControlStatusRequest, UsageControlStatusResponse, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, Subscription, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
-export { AdminPermission, AdminRole, AdminUser, ApiResponse, AppLink, AuthResponse, CheckoutSession, CreateAppLinkRequest, CreateCryptoInvoiceRequest, CreateIssueReportRequest, CreatePriceRequest, CreateProductRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, DayrateAvailabilityResponse, DayrateAvailableSlot, DayrateBookingRequest, DayrateBookingResponse, DayrateCheckoutStatus, DayrateCheckoutStatusBooking, DayrateCheckoutStatusResponse, DayrateDayOfWeek, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayratePriceBreakdown, DayrateSlotType, DayrateX402BookingRequest, DayrateX402BookingResponse, Entitlement, IssueReport, IssueReportAttachmentAccessResponse, IssueReportAttachmentOut, IssueReportListResult, IssueReportStatus, IssueReportStatusResult, IssueReportTarget, IssueReportingInputMode, IssueReportingVoiceProvider, IssueReportingVoiceTokenResult, LinkedIssueReportCase, ListIssueReportAttachmentsResponse, Price, Product, ProductSyncResult, ReplyIssueReportRequest, ResourceType, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateIssueReportRequest, UpdateProductRequest, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlDecision, UsageControlDimensions, UsageControlError, UsageControlErrorCode, UsageControlFeaturesResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, UsageControlLedgerEvent, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlRecordStatus, UsageControlStatusRequest, UsageControlStatusResponse, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, X402ActionFreeResponse, X402ActionOutcome, X402ActionPendingResponse, X402ActionReplayedResponse, X402ActionResponse, X402ActionSettledResponse, X402ExecuteActionRequest, X402HandoffAuthorization, X402HandoffVerification, X402HandoffVerifyRequest, X402PaymentAccept, X402PaymentRequirement, X402ProjectionStatus, X402Receipt, X402ReceiptListResponse, X402ReceiptResponse, X402ReceiptStatus, X402Resource, X402ResourceStatus, X402ResourceStatusResponse, atomicToMoneyUnits, createSecureMessageRequestSchema, isX402PaymentRequired, isX402ResourceStatus, moneyUnitsToAtomic, roundHalfToPositiveInfinity, secureMessageMetadataSchema, secureMessageSchema, validatePositiveAmountAtomic } from 'spaps-types';
+import { ResourceType, Entitlement, CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, ListProjectGrantsResponse, ProjectAccessCheckResponse, IssueReportScope, IssueReportStatusResult, IssueReportStatus, IssueReportListResult, IssueReport, CreateIssueReportRequest, IssueReportAttachmentOut, ListIssueReportAttachmentsResponse, IssueReportAttachmentAccessResponse, IssueReportingVoiceTokenResult, UpdateIssueReportRequest, ReplyIssueReportRequest, ListIssueReportMessagesResponse, CreateReporterMessageRequest, IssueReportMessage, CreateOperatorMessageRequest, RetractOperatorMessageRequest, CreateAppLinkRequest, AppLink, UpdateAppLinkRequest, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, X402ResourceStatusResponse, X402ActionResponse, X402ReceiptResponse, X402ReceiptListResponse, X402HandoffVerification, DayrateAvailabilityResponse, DayrateBookingRequest, DayrateBookingResponse, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayrateX402BookingRequest, DayrateX402BookingResponse, DayrateCheckoutStatusResponse, UsageControlFeaturesResponse, UsageControlStatusRequest, UsageControlStatusResponse, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, Subscription, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
+export { AdminPermission, AdminRole, AdminUser, ApiResponse, AppLink, AuthResponse, CheckoutSession, CreateAppLinkRequest, CreateCryptoInvoiceRequest, CreateIssueReportRequest, CreateOperatorMessageRequest, CreatePriceRequest, CreateProductRequest, CreateReporterMessageRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, DayrateAvailabilityResponse, DayrateAvailableSlot, DayrateBookingRequest, DayrateBookingResponse, DayrateCheckoutStatus, DayrateCheckoutStatusBooking, DayrateCheckoutStatusResponse, DayrateDayOfWeek, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayratePriceBreakdown, DayrateSlotType, DayrateX402BookingRequest, DayrateX402BookingResponse, Entitlement, IssueReport, IssueReportAttachmentAccessResponse, IssueReportAttachmentOut, IssueReportListResult, IssueReportMessage, IssueReportStatus, IssueReportStatusResult, IssueReportTarget, IssueReportingInputMode, IssueReportingVoiceProvider, IssueReportingVoiceTokenResult, LinkedIssueReportCase, ListIssueReportAttachmentsResponse, ListIssueReportMessagesResponse, ListProjectGrantsResponse, Price, Product, ProductSyncResult, ProjectAccessCheckResponse, ProjectGrant, ProjectGrantStatus, ReplyIssueReportRequest, ResourceType, RetractOperatorMessageRequest, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateAppLinkRequest, UpdateIssueReportRequest, UpdateProductRequest, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlDecision, UsageControlDimensions, UsageControlError, UsageControlErrorCode, UsageControlFeaturesResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, UsageControlLedgerEvent, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlRecordStatus, UsageControlStatusRequest, UsageControlStatusResponse, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, X402ActionFreeResponse, X402ActionOutcome, X402ActionPendingResponse, X402ActionReplayedResponse, X402ActionResponse, X402ActionSettledResponse, X402ExecuteActionRequest, X402HandoffAuthorization, X402HandoffVerification, X402HandoffVerifyRequest, X402PaymentAccept, X402PaymentRequirement, X402ProjectionStatus, X402Receipt, X402ReceiptListResponse, X402ReceiptResponse, X402ReceiptStatus, X402Resource, X402ResourceStatus, X402ResourceStatusResponse, atomicToMoneyUnits, createSecureMessageRequestSchema, isX402PaymentRequired, isX402ResourceStatus, moneyUnitsToAtomic, roundHalfToPositiveInfinity, secureMessageMetadataSchema, secureMessageSchema, validatePositiveAmountAtomic } from 'spaps-types';
 
 /**
  * Permission checking utilities for SPAPS SDK
@@ -336,6 +336,73 @@ interface EmailTemplatePreview {
     html: string;
     text?: string;
 }
+type MarketingEventType = 'attribution_touch' | 'experiment_exposure';
+type MarketingExperimentRecommendation = 'continue' | 'continue_srm_warning' | 'stop_for_winner';
+type MarketingExperimentSrmStatus = 'pass' | 'warning' | 'not_applicable';
+interface MarketingEventIngestRequest {
+    application_id?: string;
+    anon_id: string;
+    event_type: MarketingEventType;
+    experiment_id?: string | null;
+    variant_id?: string | null;
+    variant?: string | null;
+    metadata?: Record<string, unknown> | null;
+    dedupe_key?: string | null;
+    timestamp?: string | null;
+    observed_at?: string | null;
+}
+interface MarketingEventIngestResponse {
+    id: string;
+    application_id: string;
+    anon_id: string;
+    event_type: MarketingEventType;
+    experiment_id?: string | null;
+    variant?: string | null;
+    dedupe_key: string;
+    ts: string;
+    created_at: string;
+}
+interface MarketingExperimentVariantResult {
+    variant_id: string | null;
+    exposures: number;
+    conversions: number;
+    conversion_rate: number;
+    revenue: Record<string, number>;
+}
+interface MarketingExperimentMinSampleDecision {
+    met: boolean;
+    min_exposures_per_variant: number;
+    min_total_conversions: number;
+    observed_min_exposures: number;
+    observed_total_conversions: number;
+}
+interface MarketingExperimentSrmDecision {
+    status: MarketingExperimentSrmStatus;
+    expected_share?: number | null;
+    max_share_ratio?: number | null;
+    min_share_ratio?: number | null;
+}
+interface MarketingExperimentEffectDecision {
+    leader_variant_id?: string | null;
+    runner_up_variant_id?: string | null;
+    absolute_lift?: number | null;
+    relative_lift?: number | null;
+}
+interface MarketingExperimentDecision {
+    decisive: boolean;
+    recommendation: MarketingExperimentRecommendation;
+    winner_variant_id?: string | null;
+    reason_codes: string[];
+    min_sample: MarketingExperimentMinSampleDecision;
+    srm: MarketingExperimentSrmDecision;
+    effect: MarketingExperimentEffectDecision;
+}
+interface MarketingExperimentResultsResponse {
+    application_id: string;
+    experiment_id: string;
+    variants: MarketingExperimentVariantResult[];
+    decision: MarketingExperimentDecision;
+}
 interface EntitlementListParams {
     /** Filter by entitlement key */
     key?: string;
@@ -350,6 +417,22 @@ interface EntitlementCheckResult {
     /** The matching entitlement, if any */
     entitlement?: Entitlement;
 }
+interface CurrentUserProjectGrantListParams {
+    /** Filter to one project entitlement key, such as "pds.project.viewer" */
+    entitlementKey?: string;
+    /** Maximum number of project grants to return */
+    limit?: number;
+    /** Zero-based item offset */
+    offset?: number;
+    /** Opaque pagination cursor */
+    cursor?: string;
+}
+interface CurrentUserProjectAccessParams {
+    /** Project to check */
+    projectId: string;
+    /** Project entitlement key to check, such as "pds.project.viewer" */
+    entitlementKey: string;
+}
 type SupportedIssueReportScope = Extract<IssueReportScope, 'mine'>;
 interface IssueReportListParams {
     status?: IssueReportStatus;
@@ -631,6 +714,7 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
     private headerProvider?;
     private unwrapApiResponse;
     private skillEvalMutationConfig;
+    private requireCurrentUserIdFromAccessToken;
     private isAxiosResponse;
     private isResponseLikeWithData;
     private isApiResponse;
@@ -708,10 +792,24 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
          * Note: For publishable key contexts, only `resource_type=user` is permitted.
          * Non-user resource types will return a 403 error (enforced server-side).
          *
-         * @param resourceType - The resource type (e.g. "user", "company", "org", "system").
+         * @param resourceType - The resource type (e.g. "user", "company", "org", "system", "project").
          * @param resourceId - Optional specific resource ID.
          */
         listByResource: (resourceType: ResourceType, resourceId?: string) => Promise<Entitlement[]>;
+        /**
+         * List project grants for the authenticated user.
+         *
+         * Browser/publishable-key contexts are safe here because the server requires
+         * the JWT subject to match the path user id.
+         */
+        listCurrentUserProjects: (params?: CurrentUserProjectGrantListParams) => Promise<ListProjectGrantsResponse>;
+        /**
+         * Check whether the authenticated user has one project entitlement.
+         *
+         * The helper does not accept user/email overrides; publishable-key callers
+         * are scoped by the server to the JWT identity.
+         */
+        checkCurrentUserProjectAccess: (params: CurrentUserProjectAccessParams) => Promise<ProjectAccessCheckResponse>;
     };
     /**
      * Issue reporting namespace for authenticated end-user issue flows.
@@ -744,6 +842,12 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
         /**
          * Return a short-lived private attachment access URL.
          */
+        getAttachmentAccess: (attachmentId: string) => Promise<IssueReportAttachmentAccessResponse>;
+        /**
+         * Return a short-lived private attachment access URL.
+         *
+         * @deprecated Use getAttachmentAccess(attachmentId).
+         */
         getAttachmentAccessUrl: (attachmentId: string) => Promise<IssueReportAttachmentAccessResponse>;
         /**
          * Soft-delete one owned screenshot attachment.
@@ -761,6 +865,46 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
          * Reply to a resolved or ignored issue report and reopen the linked case.
          */
         reply: (issueReportId: string, payload: ReplyIssueReportRequest) => Promise<IssueReport>;
+        /**
+         * List the chronological, reporter-visible message thread for one owned
+         * issue report. Only active, reporter-visible rows are returned; retracted
+         * or superseded operator messages are excluded and raw audit payloads are
+         * never exposed. `needs_response` badges an open clarification request.
+         */
+        listMessages: (issueReportId: string) => Promise<ListIssueReportMessagesResponse>;
+        /**
+         * Submit a reporter clarification response on one owned issue report. This
+         * does NOT reopen a closed case (use `reply` for that). Idempotent on
+         * `idempotency_key`: same key + same body returns the existing message,
+         * same key + different body returns 409 ISSUE_REPORT_MESSAGE_CONFLICT.
+         */
+        submitMessage: (issueReportId: string, payload: CreateReporterMessageRequest) => Promise<IssueReportMessage>;
+        /**
+         * Triage-operator message commands. These require a secret key context and a
+         * triage role/capability; publishable browser contexts are rejected by the
+         * server. Provide the secret key as the SDK's API key.
+         */
+        triage: {
+            /**
+             * List all projection rows for an app-scoped report (including corrected
+             * rows) for authorized triage operators.
+             */
+            listMessages: (issueReportId: string) => Promise<ListIssueReportMessagesResponse>;
+            /**
+             * Post a clarification_request or final_response reporter-visible message
+             * as a triage operator. Idempotent on `idempotency_key`; a key reused with
+             * a different body returns 409. A final_response can drive a terminal
+             * lifecycle transition via `resolve_case`; the internal resolution_note is
+             * never auto-displayed to reporters.
+             */
+            postMessage: (issueReportId: string, payload: CreateOperatorMessageRequest) => Promise<IssueReportMessage>;
+            /**
+             * Retract an operator-authored message. The body is retained; the row's
+             * state is marked `retracted`. Retracting an already-retracted message is
+             * a safe no-op.
+             */
+            retractMessage: (issueReportId: string, messageId: string, payload?: RetractOperatorMessageRequest) => Promise<IssueReportMessage>;
+        };
     };
     /**
      * Application-scoped short links for browser apps that need stable public URLs.
@@ -770,6 +914,10 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
          * Create a short link owned by the authenticated user.
          */
         create: (payload: CreateAppLinkRequest) => Promise<AppLink>;
+        /**
+         * Update a short link owned by the authenticated user.
+         */
+        update: (username: string, slug: string, payload: UpdateAppLinkRequest) => Promise<AppLink>;
         /**
          * Resolve a public short link for the active application.
          */
@@ -777,6 +925,30 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
             track?: boolean;
         }) => Promise<AppLink>;
     };
+    /**
+     * Marketing events and experiment results.
+     *
+     * Use a publishable key for browser-side event emission. Use a secret key
+     * from a trusted server or agent process when reading experiment results.
+     */
+    marketing: {
+        /**
+         * Emit one anonymous attribution touch or experiment exposure.
+         */
+        emit: (payload: MarketingEventIngestRequest) => Promise<MarketingEventIngestResponse>;
+        /**
+         * Alias for emit(), matching the backend ingest endpoint language.
+         */
+        ingest: (payload: MarketingEventIngestRequest) => Promise<MarketingEventIngestResponse>;
+        /**
+         * Read per-variant experiment results and the conservative stop signal.
+         */
+        getExperimentResults: (experimentId: string) => Promise<MarketingExperimentResultsResponse>;
+        /**
+         * Short alias for getExperimentResults().
+         */
+        getResults: (experimentId: string) => Promise<MarketingExperimentResultsResponse>;
+    };
     private static envVar;
     constructor(config?: SPAPSConfig);
     /** Raw API request helper that returns an ApiResponse-like shape */
@@ -1154,6 +1326,8 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
     recordUsage(payload: UsageControlRecordRequest): Promise<UsageControlRecordResponse>;
     getUsageStatus(query: UsageControlStatusRequest): Promise<UsageControlStatusResponse>;
     listUsageHistory(query?: UsageControlHistoryRequest): Promise<UsageControlHistoryResponse>;
+    emitMarketingEvent(payload: MarketingEventIngestRequest): Promise<MarketingEventIngestResponse>;
+    getMarketingExperimentResults(experimentId: string): Promise<MarketingExperimentResultsResponse>;
     private createSecureMessage;
     private listSecureMessages;
     /**
@@ -1335,4 +1509,4 @@ declare function createServerClient(secretKey: string, options?: Omit<SPAPSConfi
  */
 declare function detectKeyType(key: string): ApiKeyType | null;
 
-export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, type CreateSkillEvalCaseRequest, type CreateSkillEvalGovernanceSnapshotRequest, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type HeaderProvider, type ImportSkillEvalGovernanceOutcomeRequest, type IssueReportAttachmentUploadOptions, type IssueReportListParams, type IssueReportStatusParams, type PermissionCheckResult, PermissionChecker, type RespondToSkillEvalReviewRequest, type RevealSkillEvalEvidenceRequest, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type SPAPSEnvelope, type SkillEvalAccessMode, type SkillEvalActorAccess, type SkillEvalCandidateInput, type SkillEvalCandidateResponse, type SkillEvalCasePolicy, type SkillEvalCaseResponse, type SkillEvalConfidence, type SkillEvalCreateOptions, type SkillEvalDisclosurePolicy, type SkillEvalEligibilitySource, type SkillEvalGovernanceOutcomeResult, type SkillEvalGovernancePurpose, type SkillEvalGovernanceSnapshotResult, type SkillEvalInsight, type SkillEvalInsightsResponse, type SkillEvalModelEffort, type SkillEvalMutationOptions, type SkillEvalPosterResponse, type SkillEvalPosterResponseResult, type SkillEvalRevealField, type SkillEvalRevealResult, type SkillEvalReviewMarkInput, type SkillEvalReviewMarkKind, type SkillEvalReviewResponse, type SkillEvalReviewRoom, type SkillEvalReviewerEligibilityInput, type SkillEvalRewardEvent, type SubmitSkillEvalReviewRequest, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, type X402ExecuteActionOptions, X402PaymentRequiredSDKError, type X402ReceiptListParams, type X402VerifyHandoffOptions, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, isEnvelope, isErrorEnvelope, isSuccessEnvelope, unwrapEnvelope, unwrapNestedData, verifyCryptoWebhookSignature };
+export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, type CreateSkillEvalCaseRequest, type CreateSkillEvalGovernanceSnapshotRequest, type CurrentUserProjectAccessParams, type CurrentUserProjectGrantListParams, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type HeaderProvider, type ImportSkillEvalGovernanceOutcomeRequest, type IssueReportAttachmentUploadOptions, type IssueReportListParams, type IssueReportStatusParams, type MarketingEventIngestRequest, type MarketingEventIngestResponse, type MarketingEventType, type MarketingExperimentDecision, type MarketingExperimentEffectDecision, type MarketingExperimentMinSampleDecision, type MarketingExperimentRecommendation, type MarketingExperimentResultsResponse, type MarketingExperimentSrmDecision, type MarketingExperimentSrmStatus, type MarketingExperimentVariantResult, type PermissionCheckResult, PermissionChecker, type RespondToSkillEvalReviewRequest, type RevealSkillEvalEvidenceRequest, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type SPAPSEnvelope, type SkillEvalAccessMode, type SkillEvalActorAccess, type SkillEvalCandidateInput, type SkillEvalCandidateResponse, type SkillEvalCasePolicy, type SkillEvalCaseResponse, type SkillEvalConfidence, type SkillEvalCreateOptions, type SkillEvalDisclosurePolicy, type SkillEvalEligibilitySource, type SkillEvalGovernanceOutcomeResult, type SkillEvalGovernancePurpose, type SkillEvalGovernanceSnapshotResult, type SkillEvalInsight, type SkillEvalInsightsResponse, type SkillEvalModelEffort, type SkillEvalMutationOptions, type SkillEvalPosterResponse, type SkillEvalPosterResponseResult, type SkillEvalRevealField, type SkillEvalRevealResult, type SkillEvalReviewMarkInput, type SkillEvalReviewMarkKind, type SkillEvalReviewResponse, type SkillEvalReviewRoom, type SkillEvalReviewerEligibilityInput, type SkillEvalRewardEvent, type SubmitSkillEvalReviewRequest, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, type X402ExecuteActionOptions, X402PaymentRequiredSDKError, type X402ReceiptListParams, type X402VerifyHandoffOptions, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, isEnvelope, isErrorEnvelope, isSuccessEnvelope, unwrapEnvelope, unwrapNestedData, verifyCryptoWebhookSignature };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import * as spaps_types from 'spaps-types';
-import { ResourceType, Entitlement, CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, IssueReportScope, IssueReportStatusResult, IssueReportStatus, IssueReportListResult, IssueReport, CreateIssueReportRequest, IssueReportAttachmentOut, ListIssueReportAttachmentsResponse, IssueReportAttachmentAccessResponse, IssueReportingVoiceTokenResult, UpdateIssueReportRequest, ReplyIssueReportRequest, CreateAppLinkRequest, AppLink, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, X402ResourceStatusResponse, X402ActionResponse, X402ReceiptResponse, X402ReceiptListResponse, X402HandoffVerification, DayrateAvailabilityResponse, DayrateBookingRequest, DayrateBookingResponse, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayrateX402BookingRequest, DayrateX402BookingResponse, DayrateCheckoutStatusResponse, UsageControlFeaturesResponse, UsageControlStatusRequest, UsageControlStatusResponse, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, Subscription, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
-export { AdminPermission, AdminRole, AdminUser, ApiResponse, AppLink, AuthResponse, CheckoutSession, CreateAppLinkRequest, CreateCryptoInvoiceRequest, CreateIssueReportRequest, CreatePriceRequest, CreateProductRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, DayrateAvailabilityResponse, DayrateAvailableSlot, DayrateBookingRequest, DayrateBookingResponse, DayrateCheckoutStatus, DayrateCheckoutStatusBooking, DayrateCheckoutStatusResponse, DayrateDayOfWeek, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayratePriceBreakdown, DayrateSlotType, DayrateX402BookingRequest, DayrateX402BookingResponse, Entitlement, IssueReport, IssueReportAttachmentAccessResponse, IssueReportAttachmentOut, IssueReportListResult, IssueReportStatus, IssueReportStatusResult, IssueReportTarget, IssueReportingInputMode, IssueReportingVoiceProvider, IssueReportingVoiceTokenResult, LinkedIssueReportCase, ListIssueReportAttachmentsResponse, Price, Product, ProductSyncResult, ReplyIssueReportRequest, ResourceType, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateIssueReportRequest, UpdateProductRequest, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlDecision, UsageControlDimensions, UsageControlError, UsageControlErrorCode, UsageControlFeaturesResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, UsageControlLedgerEvent, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlRecordStatus, UsageControlStatusRequest, UsageControlStatusResponse, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, X402ActionFreeResponse, X402ActionOutcome, X402ActionPendingResponse, X402ActionReplayedResponse, X402ActionResponse, X402ActionSettledResponse, X402ExecuteActionRequest, X402HandoffAuthorization, X402HandoffVerification, X402HandoffVerifyRequest, X402PaymentAccept, X402PaymentRequirement, X402ProjectionStatus, X402Receipt, X402ReceiptListResponse, X402ReceiptResponse, X402ReceiptStatus, X402Resource, X402ResourceStatus, X402ResourceStatusResponse, atomicToMoneyUnits, createSecureMessageRequestSchema, isX402PaymentRequired, isX402ResourceStatus, moneyUnitsToAtomic, roundHalfToPositiveInfinity, secureMessageMetadataSchema, secureMessageSchema, validatePositiveAmountAtomic } from 'spaps-types';
+import { ResourceType, Entitlement, CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, ListProjectGrantsResponse, ProjectAccessCheckResponse, IssueReportScope, IssueReportStatusResult, IssueReportStatus, IssueReportListResult, IssueReport, CreateIssueReportRequest, IssueReportAttachmentOut, ListIssueReportAttachmentsResponse, IssueReportAttachmentAccessResponse, IssueReportingVoiceTokenResult, UpdateIssueReportRequest, ReplyIssueReportRequest, ListIssueReportMessagesResponse, CreateReporterMessageRequest, IssueReportMessage, CreateOperatorMessageRequest, RetractOperatorMessageRequest, CreateAppLinkRequest, AppLink, UpdateAppLinkRequest, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, X402ResourceStatusResponse, X402ActionResponse, X402ReceiptResponse, X402ReceiptListResponse, X402HandoffVerification, DayrateAvailabilityResponse, DayrateBookingRequest, DayrateBookingResponse, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayrateX402BookingRequest, DayrateX402BookingResponse, DayrateCheckoutStatusResponse, UsageControlFeaturesResponse, UsageControlStatusRequest, UsageControlStatusResponse, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, Subscription, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
+export { AdminPermission, AdminRole, AdminUser, ApiResponse, AppLink, AuthResponse, CheckoutSession, CreateAppLinkRequest, CreateCryptoInvoiceRequest, CreateIssueReportRequest, CreateOperatorMessageRequest, CreatePriceRequest, CreateProductRequest, CreateReporterMessageRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, DayrateAvailabilityResponse, DayrateAvailableSlot, DayrateBookingRequest, DayrateBookingResponse, DayrateCheckoutStatus, DayrateCheckoutStatusBooking, DayrateCheckoutStatusResponse, DayrateDayOfWeek, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayratePriceBreakdown, DayrateSlotType, DayrateX402BookingRequest, DayrateX402BookingResponse, Entitlement, IssueReport, IssueReportAttachmentAccessResponse, IssueReportAttachmentOut, IssueReportListResult, IssueReportMessage, IssueReportStatus, IssueReportStatusResult, IssueReportTarget, IssueReportingInputMode, IssueReportingVoiceProvider, IssueReportingVoiceTokenResult, LinkedIssueReportCase, ListIssueReportAttachmentsResponse, ListIssueReportMessagesResponse, ListProjectGrantsResponse, Price, Product, ProductSyncResult, ProjectAccessCheckResponse, ProjectGrant, ProjectGrantStatus, ReplyIssueReportRequest, ResourceType, RetractOperatorMessageRequest, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateAppLinkRequest, UpdateIssueReportRequest, UpdateProductRequest, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlDecision, UsageControlDimensions, UsageControlError, UsageControlErrorCode, UsageControlFeaturesResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, UsageControlLedgerEvent, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlRecordStatus, UsageControlStatusRequest, UsageControlStatusResponse, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, X402ActionFreeResponse, X402ActionOutcome, X402ActionPendingResponse, X402ActionReplayedResponse, X402ActionResponse, X402ActionSettledResponse, X402ExecuteActionRequest, X402HandoffAuthorization, X402HandoffVerification, X402HandoffVerifyRequest, X402PaymentAccept, X402PaymentRequirement, X402ProjectionStatus, X402Receipt, X402ReceiptListResponse, X402ReceiptResponse, X402ReceiptStatus, X402Resource, X402ResourceStatus, X402ResourceStatusResponse, atomicToMoneyUnits, createSecureMessageRequestSchema, isX402PaymentRequired, isX402ResourceStatus, moneyUnitsToAtomic, roundHalfToPositiveInfinity, secureMessageMetadataSchema, secureMessageSchema, validatePositiveAmountAtomic } from 'spaps-types';
 
 /**
  * Permission checking utilities for SPAPS SDK
@@ -336,6 +336,73 @@ interface EmailTemplatePreview {
     html: string;
     text?: string;
 }
+type MarketingEventType = 'attribution_touch' | 'experiment_exposure';
+type MarketingExperimentRecommendation = 'continue' | 'continue_srm_warning' | 'stop_for_winner';
+type MarketingExperimentSrmStatus = 'pass' | 'warning' | 'not_applicable';
+interface MarketingEventIngestRequest {
+    application_id?: string;
+    anon_id: string;
+    event_type: MarketingEventType;
+    experiment_id?: string | null;
+    variant_id?: string | null;
+    variant?: string | null;
+    metadata?: Record<string, unknown> | null;
+    dedupe_key?: string | null;
+    timestamp?: string | null;
+    observed_at?: string | null;
+}
+interface MarketingEventIngestResponse {
+    id: string;
+    application_id: string;
+    anon_id: string;
+    event_type: MarketingEventType;
+    experiment_id?: string | null;
+    variant?: string | null;
+    dedupe_key: string;
+    ts: string;
+    created_at: string;
+}
+interface MarketingExperimentVariantResult {
+    variant_id: string | null;
+    exposures: number;
+    conversions: number;
+    conversion_rate: number;
+    revenue: Record<string, number>;
+}
+interface MarketingExperimentMinSampleDecision {
+    met: boolean;
+    min_exposures_per_variant: number;
+    min_total_conversions: number;
+    observed_min_exposures: number;
+    observed_total_conversions: number;
+}
+interface MarketingExperimentSrmDecision {
+    status: MarketingExperimentSrmStatus;
+    expected_share?: number | null;
+    max_share_ratio?: number | null;
+    min_share_ratio?: number | null;
+}
+interface MarketingExperimentEffectDecision {
+    leader_variant_id?: string | null;
+    runner_up_variant_id?: string | null;
+    absolute_lift?: number | null;
+    relative_lift?: number | null;
+}
+interface MarketingExperimentDecision {
+    decisive: boolean;
+    recommendation: MarketingExperimentRecommendation;
+    winner_variant_id?: string | null;
+    reason_codes: string[];
+    min_sample: MarketingExperimentMinSampleDecision;
+    srm: MarketingExperimentSrmDecision;
+    effect: MarketingExperimentEffectDecision;
+}
+interface MarketingExperimentResultsResponse {
+    application_id: string;
+    experiment_id: string;
+    variants: MarketingExperimentVariantResult[];
+    decision: MarketingExperimentDecision;
+}
 interface EntitlementListParams {
     /** Filter by entitlement key */
     key?: string;
@@ -350,6 +417,22 @@ interface EntitlementCheckResult {
     /** The matching entitlement, if any */
     entitlement?: Entitlement;
 }
+interface CurrentUserProjectGrantListParams {
+    /** Filter to one project entitlement key, such as "pds.project.viewer" */
+    entitlementKey?: string;
+    /** Maximum number of project grants to return */
+    limit?: number;
+    /** Zero-based item offset */
+    offset?: number;
+    /** Opaque pagination cursor */
+    cursor?: string;
+}
+interface CurrentUserProjectAccessParams {
+    /** Project to check */
+    projectId: string;
+    /** Project entitlement key to check, such as "pds.project.viewer" */
+    entitlementKey: string;
+}
 type SupportedIssueReportScope = Extract<IssueReportScope, 'mine'>;
 interface IssueReportListParams {
     status?: IssueReportStatus;
@@ -631,6 +714,7 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
     private headerProvider?;
     private unwrapApiResponse;
     private skillEvalMutationConfig;
+    private requireCurrentUserIdFromAccessToken;
     private isAxiosResponse;
     private isResponseLikeWithData;
     private isApiResponse;
@@ -708,10 +792,24 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
          * Note: For publishable key contexts, only `resource_type=user` is permitted.
          * Non-user resource types will return a 403 error (enforced server-side).
          *
-         * @param resourceType - The resource type (e.g. "user", "company", "org", "system").
+         * @param resourceType - The resource type (e.g. "user", "company", "org", "system", "project").
          * @param resourceId - Optional specific resource ID.
          */
         listByResource: (resourceType: ResourceType, resourceId?: string) => Promise<Entitlement[]>;
+        /**
+         * List project grants for the authenticated user.
+         *
+         * Browser/publishable-key contexts are safe here because the server requires
+         * the JWT subject to match the path user id.
+         */
+        listCurrentUserProjects: (params?: CurrentUserProjectGrantListParams) => Promise<ListProjectGrantsResponse>;
+        /**
+         * Check whether the authenticated user has one project entitlement.
+         *
+         * The helper does not accept user/email overrides; publishable-key callers
+         * are scoped by the server to the JWT identity.
+         */
+        checkCurrentUserProjectAccess: (params: CurrentUserProjectAccessParams) => Promise<ProjectAccessCheckResponse>;
     };
     /**
      * Issue reporting namespace for authenticated end-user issue flows.
@@ -744,6 +842,12 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
         /**
          * Return a short-lived private attachment access URL.
          */
+        getAttachmentAccess: (attachmentId: string) => Promise<IssueReportAttachmentAccessResponse>;
+        /**
+         * Return a short-lived private attachment access URL.
+         *
+         * @deprecated Use getAttachmentAccess(attachmentId).
+         */
         getAttachmentAccessUrl: (attachmentId: string) => Promise<IssueReportAttachmentAccessResponse>;
         /**
          * Soft-delete one owned screenshot attachment.
@@ -761,6 +865,46 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
          * Reply to a resolved or ignored issue report and reopen the linked case.
          */
         reply: (issueReportId: string, payload: ReplyIssueReportRequest) => Promise<IssueReport>;
+        /**
+         * List the chronological, reporter-visible message thread for one owned
+         * issue report. Only active, reporter-visible rows are returned; retracted
+         * or superseded operator messages are excluded and raw audit payloads are
+         * never exposed. `needs_response` badges an open clarification request.
+         */
+        listMessages: (issueReportId: string) => Promise<ListIssueReportMessagesResponse>;
+        /**
+         * Submit a reporter clarification response on one owned issue report. This
+         * does NOT reopen a closed case (use `reply` for that). Idempotent on
+         * `idempotency_key`: same key + same body returns the existing message,
+         * same key + different body returns 409 ISSUE_REPORT_MESSAGE_CONFLICT.
+         */
+        submitMessage: (issueReportId: string, payload: CreateReporterMessageRequest) => Promise<IssueReportMessage>;
+        /**
+         * Triage-operator message commands. These require a secret key context and a
+         * triage role/capability; publishable browser contexts are rejected by the
+         * server. Provide the secret key as the SDK's API key.
+         */
+        triage: {
+            /**
+             * List all projection rows for an app-scoped report (including corrected
+             * rows) for authorized triage operators.
+             */
+            listMessages: (issueReportId: string) => Promise<ListIssueReportMessagesResponse>;
+            /**
+             * Post a clarification_request or final_response reporter-visible message
+             * as a triage operator. Idempotent on `idempotency_key`; a key reused with
+             * a different body returns 409. A final_response can drive a terminal
+             * lifecycle transition via `resolve_case`; the internal resolution_note is
+             * never auto-displayed to reporters.
+             */
+            postMessage: (issueReportId: string, payload: CreateOperatorMessageRequest) => Promise<IssueReportMessage>;
+            /**
+             * Retract an operator-authored message. The body is retained; the row's
+             * state is marked `retracted`. Retracting an already-retracted message is
+             * a safe no-op.
+             */
+            retractMessage: (issueReportId: string, messageId: string, payload?: RetractOperatorMessageRequest) => Promise<IssueReportMessage>;
+        };
     };
     /**
      * Application-scoped short links for browser apps that need stable public URLs.
@@ -770,6 +914,10 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
          * Create a short link owned by the authenticated user.
          */
         create: (payload: CreateAppLinkRequest) => Promise<AppLink>;
+        /**
+         * Update a short link owned by the authenticated user.
+         */
+        update: (username: string, slug: string, payload: UpdateAppLinkRequest) => Promise<AppLink>;
         /**
          * Resolve a public short link for the active application.
          */
@@ -777,6 +925,30 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
             track?: boolean;
         }) => Promise<AppLink>;
     };
+    /**
+     * Marketing events and experiment results.
+     *
+     * Use a publishable key for browser-side event emission. Use a secret key
+     * from a trusted server or agent process when reading experiment results.
+     */
+    marketing: {
+        /**
+         * Emit one anonymous attribution touch or experiment exposure.
+         */
+        emit: (payload: MarketingEventIngestRequest) => Promise<MarketingEventIngestResponse>;
+        /**
+         * Alias for emit(), matching the backend ingest endpoint language.
+         */
+        ingest: (payload: MarketingEventIngestRequest) => Promise<MarketingEventIngestResponse>;
+        /**
+         * Read per-variant experiment results and the conservative stop signal.
+         */
+        getExperimentResults: (experimentId: string) => Promise<MarketingExperimentResultsResponse>;
+        /**
+         * Short alias for getExperimentResults().
+         */
+        getResults: (experimentId: string) => Promise<MarketingExperimentResultsResponse>;
+    };
     private static envVar;
     constructor(config?: SPAPSConfig);
     /** Raw API request helper that returns an ApiResponse-like shape */
@@ -1154,6 +1326,8 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
     recordUsage(payload: UsageControlRecordRequest): Promise<UsageControlRecordResponse>;
     getUsageStatus(query: UsageControlStatusRequest): Promise<UsageControlStatusResponse>;
     listUsageHistory(query?: UsageControlHistoryRequest): Promise<UsageControlHistoryResponse>;
+    emitMarketingEvent(payload: MarketingEventIngestRequest): Promise<MarketingEventIngestResponse>;
+    getMarketingExperimentResults(experimentId: string): Promise<MarketingExperimentResultsResponse>;
     private createSecureMessage;
     private listSecureMessages;
     /**
@@ -1335,4 +1509,4 @@ declare function createServerClient(secretKey: string, options?: Omit<SPAPSConfi
  */
 declare function detectKeyType(key: string): ApiKeyType | null;
 
-export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, type CreateSkillEvalCaseRequest, type CreateSkillEvalGovernanceSnapshotRequest, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type HeaderProvider, type ImportSkillEvalGovernanceOutcomeRequest, type IssueReportAttachmentUploadOptions, type IssueReportListParams, type IssueReportStatusParams, type PermissionCheckResult, PermissionChecker, type RespondToSkillEvalReviewRequest, type RevealSkillEvalEvidenceRequest, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type SPAPSEnvelope, type SkillEvalAccessMode, type SkillEvalActorAccess, type SkillEvalCandidateInput, type SkillEvalCandidateResponse, type SkillEvalCasePolicy, type SkillEvalCaseResponse, type SkillEvalConfidence, type SkillEvalCreateOptions, type SkillEvalDisclosurePolicy, type SkillEvalEligibilitySource, type SkillEvalGovernanceOutcomeResult, type SkillEvalGovernancePurpose, type SkillEvalGovernanceSnapshotResult, type SkillEvalInsight, type SkillEvalInsightsResponse, type SkillEvalModelEffort, type SkillEvalMutationOptions, type SkillEvalPosterResponse, type SkillEvalPosterResponseResult, type SkillEvalRevealField, type SkillEvalRevealResult, type SkillEvalReviewMarkInput, type SkillEvalReviewMarkKind, type SkillEvalReviewResponse, type SkillEvalReviewRoom, type SkillEvalReviewerEligibilityInput, type SkillEvalRewardEvent, type SubmitSkillEvalReviewRequest, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, type X402ExecuteActionOptions, X402PaymentRequiredSDKError, type X402ReceiptListParams, type X402VerifyHandoffOptions, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, isEnvelope, isErrorEnvelope, isSuccessEnvelope, unwrapEnvelope, unwrapNestedData, verifyCryptoWebhookSignature };
+export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, type CreateSkillEvalCaseRequest, type CreateSkillEvalGovernanceSnapshotRequest, type CurrentUserProjectAccessParams, type CurrentUserProjectGrantListParams, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type HeaderProvider, type ImportSkillEvalGovernanceOutcomeRequest, type IssueReportAttachmentUploadOptions, type IssueReportListParams, type IssueReportStatusParams, type MarketingEventIngestRequest, type MarketingEventIngestResponse, type MarketingEventType, type MarketingExperimentDecision, type MarketingExperimentEffectDecision, type MarketingExperimentMinSampleDecision, type MarketingExperimentRecommendation, type MarketingExperimentResultsResponse, type MarketingExperimentSrmDecision, type MarketingExperimentSrmStatus, type MarketingExperimentVariantResult, type PermissionCheckResult, PermissionChecker, type RespondToSkillEvalReviewRequest, type RevealSkillEvalEvidenceRequest, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type SPAPSEnvelope, type SkillEvalAccessMode, type SkillEvalActorAccess, type SkillEvalCandidateInput, type SkillEvalCandidateResponse, type SkillEvalCasePolicy, type SkillEvalCaseResponse, type SkillEvalConfidence, type SkillEvalCreateOptions, type SkillEvalDisclosurePolicy, type SkillEvalEligibilitySource, type SkillEvalGovernanceOutcomeResult, type SkillEvalGovernancePurpose, type SkillEvalGovernanceSnapshotResult, type SkillEvalInsight, type SkillEvalInsightsResponse, type SkillEvalModelEffort, type SkillEvalMutationOptions, type SkillEvalPosterResponse, type SkillEvalPosterResponseResult, type SkillEvalRevealField, type SkillEvalRevealResult, type SkillEvalReviewMarkInput, type SkillEvalReviewMarkKind, type SkillEvalReviewResponse, type SkillEvalReviewRoom, type SkillEvalReviewerEligibilityInput, type SkillEvalRewardEvent, type SubmitSkillEvalReviewRequest, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, type X402ExecuteActionOptions, X402PaymentRequiredSDKError, type X402ReceiptListParams, type X402VerifyHandoffOptions, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, isEnvelope, isErrorEnvelope, isSuccessEnvelope, unwrapEnvelope, unwrapNestedData, verifyCryptoWebhookSignature };

package/dist/index.js

@@ -563,6 +563,17 @@ var SPAPSClient = class _SPAPSClient {
     }
     return { headers: { "If-Match": String(ifMatch) } };
   }
+  requireCurrentUserIdFromAccessToken() {
+    if (!this.accessToken) {
+      throw new Error("Authentication required. Please authenticate first.");
+    }
+    const payload = TokenManager.decodePayload(this.accessToken);
+    const userId = payload?.user_id ?? payload?.sub;
+    if (typeof userId !== "string" || userId.length === 0) {
+      throw new Error("Current user id not found in access token.");
+    }
+    return userId;
+  }
   isAxiosResponse(value) {
     if (!value || typeof value !== "object") {
       return false;
@@ -672,7 +683,7 @@ var SPAPSClient = class _SPAPSClient {
      * @param userId - Optional user ID override (secret key contexts only).
      */
     check: async (key, userId) => {
-      const q = new URLSearchParams({ key });
+      const q = new URLSearchParams({ entitlement_key: key });
       if (userId) q.append("user_id", userId);
       const res = await this.client.get(
         `/api/entitlements/check?${q.toString()}`,
@@ -686,7 +697,7 @@ var SPAPSClient = class _SPAPSClient {
      * Note: For publishable key contexts, only `resource_type=user` is permitted.
      * Non-user resource types will return a 403 error (enforced server-side).
      *
-     * @param resourceType - The resource type (e.g. "user", "company", "org", "system").
+     * @param resourceType - The resource type (e.g. "user", "company", "org", "system", "project").
      * @param resourceId - Optional specific resource ID.
      */
     listByResource: async (resourceType, resourceId) => {
@@ -701,6 +712,46 @@ var SPAPSClient = class _SPAPSClient {
         return payload.entitlements;
       }
       return payload;
+    },
+    /**
+     * List project grants for the authenticated user.
+     *
+     * Browser/publishable-key contexts are safe here because the server requires
+     * the JWT subject to match the path user id.
+     */
+    listCurrentUserProjects: async (params) => {
+      const userId = this.requireCurrentUserIdFromAccessToken();
+      const q = new URLSearchParams();
+      if (params?.entitlementKey) q.append("entitlement_key", params.entitlementKey);
+      if (params?.limit !== void 0) q.append("limit", String(params.limit));
+      if (params?.offset !== void 0) q.append("offset", String(params.offset));
+      if (params?.cursor) q.append("cursor", params.cursor);
+      const qs = q.toString();
+      const res = await this.client.get(
+        `/api/project-grants/user/${encodeURIComponent(userId)}/projects${qs ? `?${qs}` : ""}`,
+        { headers: { Authorization: `Bearer ${this.accessToken}` } }
+      );
+      return this.unwrapApiResponse(res, "Failed to list current user project grants");
+    },
+    /**
+     * Check whether the authenticated user has one project entitlement.
+     *
+     * The helper does not accept user/email overrides; publishable-key callers
+     * are scoped by the server to the JWT identity.
+     */
+    checkCurrentUserProjectAccess: async (params) => {
+      if (!this.accessToken) {
+        throw new Error("Authentication required. Please authenticate first.");
+      }
+      const q = new URLSearchParams({
+        project_id: params.projectId,
+        entitlement_key: params.entitlementKey
+      });
+      const res = await this.client.get(
+        `/api/project-grants/check?${q.toString()}`,
+        { headers: { Authorization: `Bearer ${this.accessToken}` } }
+      );
+      return this.unwrapApiResponse(res, "Failed to check current user project access");
     }
   };
   /**
@@ -793,7 +844,7 @@ var SPAPSClient = class _SPAPSClient {
     /**
      * Return a short-lived private attachment access URL.
      */
-    getAttachmentAccessUrl: async (attachmentId) => {
+    getAttachmentAccess: async (attachmentId) => {
       const res = await this.client.get(
         `/api/v1/issue-reports/attachments/${encodeURIComponent(attachmentId)}/access`,
         this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
@@ -803,6 +854,14 @@ var SPAPSClient = class _SPAPSClient {
         "Failed to get issue report attachment access URL"
       );
     },
+    /**
+     * Return a short-lived private attachment access URL.
+     *
+     * @deprecated Use getAttachmentAccess(attachmentId).
+     */
+    getAttachmentAccessUrl: async (attachmentId) => {
+      return this.issueReporting.getAttachmentAccess(attachmentId);
+    },
     /**
      * Soft-delete one owned screenshot attachment.
      */
@@ -844,6 +903,82 @@ var SPAPSClient = class _SPAPSClient {
         this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
       );
       return this.unwrapApiResponse(res, "Failed to reply to issue report");
+    },
+    /**
+     * List the chronological, reporter-visible message thread for one owned
+     * issue report. Only active, reporter-visible rows are returned; retracted
+     * or superseded operator messages are excluded and raw audit payloads are
+     * never exposed. `needs_response` badges an open clarification request.
+     */
+    listMessages: async (issueReportId) => {
+      const res = await this.client.get(
+        `/api/v1/issue-reports/${issueReportId}/messages`,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to list issue report messages");
+    },
+    /**
+     * Submit a reporter clarification response on one owned issue report. This
+     * does NOT reopen a closed case (use `reply` for that). Idempotent on
+     * `idempotency_key`: same key + same body returns the existing message,
+     * same key + different body returns 409 ISSUE_REPORT_MESSAGE_CONFLICT.
+     */
+    submitMessage: async (issueReportId, payload) => {
+      const res = await this.client.post(
+        `/api/v1/issue-reports/${issueReportId}/messages`,
+        payload,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to submit issue report message");
+    },
+    /**
+     * Triage-operator message commands. These require a secret key context and a
+     * triage role/capability; publishable browser contexts are rejected by the
+     * server. Provide the secret key as the SDK's API key.
+     */
+    triage: {
+      /**
+       * List all projection rows for an app-scoped report (including corrected
+       * rows) for authorized triage operators.
+       */
+      listMessages: async (issueReportId) => {
+        const res = await this.client.get(
+          `/api/v1/issue-reports/triage/${issueReportId}/messages`,
+          this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+        );
+        return this.unwrapApiResponse(
+          res,
+          "Failed to list triage issue report messages"
+        );
+      },
+      /**
+       * Post a clarification_request or final_response reporter-visible message
+       * as a triage operator. Idempotent on `idempotency_key`; a key reused with
+       * a different body returns 409. A final_response can drive a terminal
+       * lifecycle transition via `resolve_case`; the internal resolution_note is
+       * never auto-displayed to reporters.
+       */
+      postMessage: async (issueReportId, payload) => {
+        const res = await this.client.post(
+          `/api/v1/issue-reports/triage/${issueReportId}/messages`,
+          payload,
+          this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+        );
+        return this.unwrapApiResponse(res, "Failed to post triage issue report message");
+      },
+      /**
+       * Retract an operator-authored message. The body is retained; the row's
+       * state is marked `retracted`. Retracting an already-retracted message is
+       * a safe no-op.
+       */
+      retractMessage: async (issueReportId, messageId, payload = {}) => {
+        const res = await this.client.post(
+          `/api/v1/issue-reports/triage/${issueReportId}/messages/${messageId}/retract`,
+          payload,
+          this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+        );
+        return this.unwrapApiResponse(res, "Failed to retract triage issue report message");
+      }
     }
   };
   /**
@@ -861,6 +996,17 @@ var SPAPSClient = class _SPAPSClient {
       );
       return this.unwrapApiResponse(res, "Failed to create app link");
     },
+    /**
+     * Update a short link owned by the authenticated user.
+     */
+    update: async (username, slug, payload) => {
+      const res = await this.client.patch(
+        `/api/v1/app-links/${encodeURIComponent(username)}/${encodeURIComponent(slug)}`,
+        payload,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to update app link");
+    },
     /**
      * Resolve a public short link for the active application.
      */
@@ -875,6 +1021,58 @@ var SPAPSClient = class _SPAPSClient {
       return this.unwrapApiResponse(res, "Failed to get app link");
     }
   };
+  /**
+   * Marketing events and experiment results.
+   *
+   * Use a publishable key for browser-side event emission. Use a secret key
+   * from a trusted server or agent process when reading experiment results.
+   */
+  marketing = {
+    /**
+     * Emit one anonymous attribution touch or experiment exposure.
+     */
+    emit: async (payload) => {
+      if (payload.event_type === "experiment_exposure") {
+        if (!payload.experiment_id?.trim()) {
+          throw new Error("experiment_id is required for experiment_exposure events");
+        }
+        const variant = payload.variant_id ?? payload.variant;
+        if (!variant?.trim()) {
+          throw new Error("variant_id or variant is required for experiment_exposure events");
+        }
+      }
+      const res = await this.client.post("/api/marketing-events/ingest", payload);
+      return this.unwrapApiResponse(
+        res,
+        "Failed to emit marketing event"
+      );
+    },
+    /**
+     * Alias for emit(), matching the backend ingest endpoint language.
+     */
+    ingest: async (payload) => {
+      return this.marketing.emit(payload);
+    },
+    /**
+     * Read per-variant experiment results and the conservative stop signal.
+     */
+    getExperimentResults: async (experimentId) => {
+      const encodedExperimentId = encodeURIComponent(experimentId);
+      const res = await this.client.get(
+        `/api/marketing/experiments/${encodedExperimentId}/results`
+      );
+      return this.unwrapApiResponse(
+        res,
+        "Failed to get marketing experiment results"
+      );
+    },
+    /**
+     * Short alias for getExperimentResults().
+     */
+    getResults: async (experimentId) => {
+      return this.marketing.getExperimentResults(experimentId);
+    }
+  };
   static envVar(name) {
     if (typeof process !== "undefined" && process.env) {
       return process.env[name];
@@ -1763,6 +1961,12 @@ var SPAPSClient = class _SPAPSClient {
   async listUsageHistory(query = {}) {
     return this.usage.listHistory(query);
   }
+  async emitMarketingEvent(payload) {
+    return this.marketing.emit(payload);
+  }
+  async getMarketingExperimentResults(experimentId) {
+    return this.marketing.getExperimentResults(experimentId);
+  }
   // Secure Messaging Methods
   async createSecureMessage(payload) {
     const response = await this.client.post("/api/secure-messages", payload);

package/dist/index.mjs

@@ -528,6 +528,17 @@ var SPAPSClient = class _SPAPSClient {
     }
     return { headers: { "If-Match": String(ifMatch) } };
   }
+  requireCurrentUserIdFromAccessToken() {
+    if (!this.accessToken) {
+      throw new Error("Authentication required. Please authenticate first.");
+    }
+    const payload = TokenManager.decodePayload(this.accessToken);
+    const userId = payload?.user_id ?? payload?.sub;
+    if (typeof userId !== "string" || userId.length === 0) {
+      throw new Error("Current user id not found in access token.");
+    }
+    return userId;
+  }
   isAxiosResponse(value) {
     if (!value || typeof value !== "object") {
       return false;
@@ -637,7 +648,7 @@ var SPAPSClient = class _SPAPSClient {
      * @param userId - Optional user ID override (secret key contexts only).
      */
     check: async (key, userId) => {
-      const q = new URLSearchParams({ key });
+      const q = new URLSearchParams({ entitlement_key: key });
       if (userId) q.append("user_id", userId);
       const res = await this.client.get(
         `/api/entitlements/check?${q.toString()}`,
@@ -651,7 +662,7 @@ var SPAPSClient = class _SPAPSClient {
      * Note: For publishable key contexts, only `resource_type=user` is permitted.
      * Non-user resource types will return a 403 error (enforced server-side).
      *
-     * @param resourceType - The resource type (e.g. "user", "company", "org", "system").
+     * @param resourceType - The resource type (e.g. "user", "company", "org", "system", "project").
      * @param resourceId - Optional specific resource ID.
      */
     listByResource: async (resourceType, resourceId) => {
@@ -666,6 +677,46 @@ var SPAPSClient = class _SPAPSClient {
         return payload.entitlements;
       }
       return payload;
+    },
+    /**
+     * List project grants for the authenticated user.
+     *
+     * Browser/publishable-key contexts are safe here because the server requires
+     * the JWT subject to match the path user id.
+     */
+    listCurrentUserProjects: async (params) => {
+      const userId = this.requireCurrentUserIdFromAccessToken();
+      const q = new URLSearchParams();
+      if (params?.entitlementKey) q.append("entitlement_key", params.entitlementKey);
+      if (params?.limit !== void 0) q.append("limit", String(params.limit));
+      if (params?.offset !== void 0) q.append("offset", String(params.offset));
+      if (params?.cursor) q.append("cursor", params.cursor);
+      const qs = q.toString();
+      const res = await this.client.get(
+        `/api/project-grants/user/${encodeURIComponent(userId)}/projects${qs ? `?${qs}` : ""}`,
+        { headers: { Authorization: `Bearer ${this.accessToken}` } }
+      );
+      return this.unwrapApiResponse(res, "Failed to list current user project grants");
+    },
+    /**
+     * Check whether the authenticated user has one project entitlement.
+     *
+     * The helper does not accept user/email overrides; publishable-key callers
+     * are scoped by the server to the JWT identity.
+     */
+    checkCurrentUserProjectAccess: async (params) => {
+      if (!this.accessToken) {
+        throw new Error("Authentication required. Please authenticate first.");
+      }
+      const q = new URLSearchParams({
+        project_id: params.projectId,
+        entitlement_key: params.entitlementKey
+      });
+      const res = await this.client.get(
+        `/api/project-grants/check?${q.toString()}`,
+        { headers: { Authorization: `Bearer ${this.accessToken}` } }
+      );
+      return this.unwrapApiResponse(res, "Failed to check current user project access");
     }
   };
   /**
@@ -758,7 +809,7 @@ var SPAPSClient = class _SPAPSClient {
     /**
      * Return a short-lived private attachment access URL.
      */
-    getAttachmentAccessUrl: async (attachmentId) => {
+    getAttachmentAccess: async (attachmentId) => {
       const res = await this.client.get(
         `/api/v1/issue-reports/attachments/${encodeURIComponent(attachmentId)}/access`,
         this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
@@ -768,6 +819,14 @@ var SPAPSClient = class _SPAPSClient {
         "Failed to get issue report attachment access URL"
       );
     },
+    /**
+     * Return a short-lived private attachment access URL.
+     *
+     * @deprecated Use getAttachmentAccess(attachmentId).
+     */
+    getAttachmentAccessUrl: async (attachmentId) => {
+      return this.issueReporting.getAttachmentAccess(attachmentId);
+    },
     /**
      * Soft-delete one owned screenshot attachment.
      */
@@ -809,6 +868,82 @@ var SPAPSClient = class _SPAPSClient {
         this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
       );
       return this.unwrapApiResponse(res, "Failed to reply to issue report");
+    },
+    /**
+     * List the chronological, reporter-visible message thread for one owned
+     * issue report. Only active, reporter-visible rows are returned; retracted
+     * or superseded operator messages are excluded and raw audit payloads are
+     * never exposed. `needs_response` badges an open clarification request.
+     */
+    listMessages: async (issueReportId) => {
+      const res = await this.client.get(
+        `/api/v1/issue-reports/${issueReportId}/messages`,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to list issue report messages");
+    },
+    /**
+     * Submit a reporter clarification response on one owned issue report. This
+     * does NOT reopen a closed case (use `reply` for that). Idempotent on
+     * `idempotency_key`: same key + same body returns the existing message,
+     * same key + different body returns 409 ISSUE_REPORT_MESSAGE_CONFLICT.
+     */
+    submitMessage: async (issueReportId, payload) => {
+      const res = await this.client.post(
+        `/api/v1/issue-reports/${issueReportId}/messages`,
+        payload,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to submit issue report message");
+    },
+    /**
+     * Triage-operator message commands. These require a secret key context and a
+     * triage role/capability; publishable browser contexts are rejected by the
+     * server. Provide the secret key as the SDK's API key.
+     */
+    triage: {
+      /**
+       * List all projection rows for an app-scoped report (including corrected
+       * rows) for authorized triage operators.
+       */
+      listMessages: async (issueReportId) => {
+        const res = await this.client.get(
+          `/api/v1/issue-reports/triage/${issueReportId}/messages`,
+          this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+        );
+        return this.unwrapApiResponse(
+          res,
+          "Failed to list triage issue report messages"
+        );
+      },
+      /**
+       * Post a clarification_request or final_response reporter-visible message
+       * as a triage operator. Idempotent on `idempotency_key`; a key reused with
+       * a different body returns 409. A final_response can drive a terminal
+       * lifecycle transition via `resolve_case`; the internal resolution_note is
+       * never auto-displayed to reporters.
+       */
+      postMessage: async (issueReportId, payload) => {
+        const res = await this.client.post(
+          `/api/v1/issue-reports/triage/${issueReportId}/messages`,
+          payload,
+          this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+        );
+        return this.unwrapApiResponse(res, "Failed to post triage issue report message");
+      },
+      /**
+       * Retract an operator-authored message. The body is retained; the row's
+       * state is marked `retracted`. Retracting an already-retracted message is
+       * a safe no-op.
+       */
+      retractMessage: async (issueReportId, messageId, payload = {}) => {
+        const res = await this.client.post(
+          `/api/v1/issue-reports/triage/${issueReportId}/messages/${messageId}/retract`,
+          payload,
+          this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+        );
+        return this.unwrapApiResponse(res, "Failed to retract triage issue report message");
+      }
     }
   };
   /**
@@ -826,6 +961,17 @@ var SPAPSClient = class _SPAPSClient {
       );
       return this.unwrapApiResponse(res, "Failed to create app link");
     },
+    /**
+     * Update a short link owned by the authenticated user.
+     */
+    update: async (username, slug, payload) => {
+      const res = await this.client.patch(
+        `/api/v1/app-links/${encodeURIComponent(username)}/${encodeURIComponent(slug)}`,
+        payload,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to update app link");
+    },
     /**
      * Resolve a public short link for the active application.
      */
@@ -840,6 +986,58 @@ var SPAPSClient = class _SPAPSClient {
       return this.unwrapApiResponse(res, "Failed to get app link");
     }
   };
+  /**
+   * Marketing events and experiment results.
+   *
+   * Use a publishable key for browser-side event emission. Use a secret key
+   * from a trusted server or agent process when reading experiment results.
+   */
+  marketing = {
+    /**
+     * Emit one anonymous attribution touch or experiment exposure.
+     */
+    emit: async (payload) => {
+      if (payload.event_type === "experiment_exposure") {
+        if (!payload.experiment_id?.trim()) {
+          throw new Error("experiment_id is required for experiment_exposure events");
+        }
+        const variant = payload.variant_id ?? payload.variant;
+        if (!variant?.trim()) {
+          throw new Error("variant_id or variant is required for experiment_exposure events");
+        }
+      }
+      const res = await this.client.post("/api/marketing-events/ingest", payload);
+      return this.unwrapApiResponse(
+        res,
+        "Failed to emit marketing event"
+      );
+    },
+    /**
+     * Alias for emit(), matching the backend ingest endpoint language.
+     */
+    ingest: async (payload) => {
+      return this.marketing.emit(payload);
+    },
+    /**
+     * Read per-variant experiment results and the conservative stop signal.
+     */
+    getExperimentResults: async (experimentId) => {
+      const encodedExperimentId = encodeURIComponent(experimentId);
+      const res = await this.client.get(
+        `/api/marketing/experiments/${encodedExperimentId}/results`
+      );
+      return this.unwrapApiResponse(
+        res,
+        "Failed to get marketing experiment results"
+      );
+    },
+    /**
+     * Short alias for getExperimentResults().
+     */
+    getResults: async (experimentId) => {
+      return this.marketing.getExperimentResults(experimentId);
+    }
+  };
   static envVar(name) {
     if (typeof process !== "undefined" && process.env) {
       return process.env[name];
@@ -1728,6 +1926,12 @@ var SPAPSClient = class _SPAPSClient {
   async listUsageHistory(query = {}) {
     return this.usage.listHistory(query);
   }
+  async emitMarketingEvent(payload) {
+    return this.marketing.emit(payload);
+  }
+  async getMarketingExperimentResults(experimentId) {
+    return this.marketing.getExperimentResults(experimentId);
+  }
   // Secure Messaging Methods
   async createSecureMessage(payload) {
     const response = await this.client.post("/api/secure-messages", payload);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spaps-sdk",
-  "version": "1.10.1",
+  "version": "1.11.0",
   "description": "Sweet Potato Authentication & Payment Service SDK - Zero-config client with built-in permission checking, role-based access control, and dayrate scheduling",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -51,7 +51,7 @@
   "dependencies": {
     "axios": "^1.15.1",
     "cross-fetch": "^4.0.0",
-    "spaps-types": "^1.4.0"
+    "spaps-types": "^1.4.2"
   },
   "devDependencies": {
     "@types/node": "^20.10.0",