spaps-sdk 1.10.2 → 1.12.0

package/CHANGELOG.md

@@ -8,6 +8,20 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 
 ### Added
 
+- Added browser-safe `entitlements.listCurrentUserProjects()` and `entitlements.checkCurrentUserProjectAccess(...)` helpers for project grant reads.
+
+## [1.11.0] - 2026-06-08
+
+### Added
+
+- Exported the canonical issue-report screenshot attachment constraints: `ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES`, `ISSUE_REPORT_ATTACHMENT_MAX_BYTES`, and `ISSUE_REPORT_ATTACHMENT_MAX_RETAINED`.
+- Added SDK-side preflight validation to `issueReporting.uploadAttachment(file, options)`, rejecting unsupported MIME types and files larger than 10 MiB before opening the multipart request. SPAPS remains the authoritative backend validator.
+- Documented the operator-gated automatic screenshot-capture handoff: React consumers should lazy-load capture through `spaps-issue-reporting-react@0.6.0`, pass captured files to SDK `uploadAttachment`, and keep publishing/deployment approval outside worker nodes. The local proof tarball for this SDK line was `/tmp/spaps-sdk-1.11.0.tgz`; `spaps-sdk@1.11.0` is now published on npm.
+
+## [1.10.2] - 2026-06-04
+
+### Added
+
 - Added `issueReporting.getAttachmentAccess(attachmentId)` as the canonical screenshot access helper while keeping `getAttachmentAccessUrl` as a backward-compatible alias.
 
 ## [1.10.1] - 2026-05-16

package/PERMISSIONS.md

@@ -2,6 +2,27 @@
 
 Client-side permission checking and role management utilities for SPAPS applications.
 
+## Browser-Safe Project Access
+
+The SDK exposes read-only helpers for current-user project access:
+
+```typescript
+await spaps.entitlements.listCurrentUserProjects({
+  entitlementKey: 'pds.project.viewer'
+});
+
+await spaps.entitlements.checkCurrentUserProjectAccess({
+  projectId: 'project_123',
+  entitlementKey: 'pds.project.viewer'
+});
+```
+
+These helpers are safe for publishable-key browser contexts because SPAPS
+validates the JWT subject server-side. The SDK does not expose browser methods
+for account membership invitation, project grant, project revoke, or account
+capability mutation. Keep those operations in a trusted backend using a secret
+key and admin access token.
+
 ## 🚀 Quick Start
 
 ```typescript
@@ -387,4 +408,4 @@ interface PermissionCheckResult {
 4. **Role-based UI**: Show/hide features based on user permissions
 5. **Custom admin management**: Use custom admin lists for multi-tenant apps
 6. **Testing**: Test permission logic with various user states
-7. **Type safety**: Use TypeScript interfaces for better development experience
+7. **Type safety**: Use TypeScript interfaces for better development experience

package/README.md

@@ -88,7 +88,7 @@ Relevant environment variables:
 | `appLinks` | Authenticated create and public resolve helpers for application-scoped short links |
 | `marketing` | Browser-safe attribution/experiment event emission and server-side experiment results |
 | `email` | Template lookup, preview, and send helpers |
-| `entitlements` | User and resource entitlement queries |
+| `entitlements` | User/resource entitlement queries and browser-safe current-user project access reads |
 | `usage` | Secret-key usage authorization and immutable usage recording |
 | `skillEvals` | Paid blind skill-eval cases, review rooms, reviewer marks, insight inboxes, and controlled reveal |
 | `dayrate` | Availability, Stripe booking, x402 booking-hold, and checkout-status helpers |
@@ -97,6 +97,33 @@ Relevant environment variables:
 
 ## Common Patterns
 
+### Browser-Safe Project Access Reads
+
+Use a publishable key and an authenticated user JWT in browser code. These
+helpers only read project access for the current user; membership invitation,
+project grant, project revoke, and account capability mutation remain
+server-only operations.
+
+```ts
+const spaps = new SPAPSClient({
+  apiUrl: "https://api.example.test",
+  publishableKey: "spaps_pub_example",
+});
+
+spaps.setAccessToken(userAccessToken);
+
+const projects = await spaps.entitlements.listCurrentUserProjects({
+  entitlementKey: "pds.project.viewer",
+});
+
+const access = await spaps.entitlements.checkCurrentUserProjectAccess({
+  projectId: "project_123",
+  entitlementKey: "pds.project.viewer",
+});
+
+console.log(projects.count, access.has_access);
+```
+
 ### Typed Secure Messages
 
 ```ts
@@ -127,14 +154,34 @@ console.log(voiceToken.provider, voiceToken.model_id);
 
 ### Issue Reporting Screenshot Attachments
 
-Screenshots are uploaded as private pending hosted assets first. Create, update, or reply calls then send only attachment IDs; do not put raw image bytes, data URLs, or base64 payloads in issue notes or target metadata.
+Use `spaps.issueReporting.uploadAttachment(file)` as the canonical screenshot
+upload path. Consumers should not carry raw `POST /api/v1/issue-reports/attachments`
+adapters when their installed `spaps-sdk` exposes this method.
+
+Screenshots are uploaded as private pending hosted assets first. Create, update,
+or reply calls then send only attachment IDs; do not put raw image bytes, data
+URLs, or base64 payloads in issue notes or target metadata.
 
 ```ts
+import {
+  ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES,
+  ISSUE_REPORT_ATTACHMENT_MAX_BYTES,
+  ISSUE_REPORT_ATTACHMENT_MAX_RETAINED,
+} from "spaps-sdk";
+
 spaps.setAccessToken(accessToken);
 
 const file = new File([pngBytes], "protocol-save-failure.png", {
   type: "image/png",
 });
+
+const supportedType = ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES.some(
+  (mimeType) => mimeType === file.type,
+);
+if (!supportedType || file.size > ISSUE_REPORT_ATTACHMENT_MAX_BYTES) {
+  throw new Error("Screenshot is not a supported SPAPS issue-report attachment");
+}
+
 const attachment = await spaps.issueReporting.uploadAttachment(file);
 
 const issue = await spaps.issueReporting.create({
@@ -151,10 +198,35 @@ const issue = await spaps.issueReporting.create({
 });
 
 const access = await spaps.issueReporting.getAttachmentAccess(attachment.id);
-console.log(issue.id, access.expires_in_seconds);
+console.log(issue.id, access.expires_in_seconds, ISSUE_REPORT_ATTACHMENT_MAX_RETAINED);
 ```
 
-SPAPS accepts PNG, JPEG, and WebP screenshots up to 10 MiB each, with at most 5 retained screenshots per report. The hosted object remains private; callers fetch a short-lived access URL after normal issue-reporting authorization succeeds. SPAPS does not redact screenshot contents, so host apps should warn users when a capture may include sensitive data.
+The SDK rejects unsupported screenshot MIME types and files over 10 MiB before
+opening the multipart request. SPAPS still performs authoritative validation,
+stores the hosted object privately, and retains at most 5 screenshots per report
+or reply. Callers fetch a short-lived access URL after normal issue-reporting
+authorization succeeds. SPAPS does not redact screenshot contents, so host apps
+should warn users when a capture may include sensitive data.
+
+Browser capture is intentionally outside this SDK. The shared
+`spaps-issue-reporting-react` automatic DOM capture contract is a React-package
+concern: it should lazy-load `html2canvas` only after the host app opts in with
+the React `screenshotCapture` config, convert the visible same-origin DOM result
+to a PNG, JPEG, or WebP `Blob`/`File`, then pass that file to
+`uploadAttachment`. Apps that do not opt in must not download `html2canvas`.
+If capture or upload fails, submit the issue with metadata and any manual
+attachments instead of blocking issue submission.
+
+Version note: `uploadAttachment` was added in `spaps-sdk@1.10.1`, and
+`getAttachmentAccess` became the canonical access helper in `spaps-sdk@1.10.2`.
+The exported limit constants shown above are part of this source package line;
+wait for the operator-approved npm release before removing local shims from
+consumers pinned to older packages.
+
+No new SDK method or backend screenshot endpoint is part of the automatic
+capture contract unless the existing private attachment upload proves
+insufficient. Worker nodes may validate with local packs or workspace links, but
+publishing `spaps-sdk` or `spaps-issue-reporting-react` remains operator-gated.
 
 ### Application Short Links
 
@@ -484,7 +556,7 @@ npm run test:readme
 ## Metadata
 
 - `package_name`: `spaps-sdk`
-- `latest_version`: `1.10.1`
+- `latest_version`: `1.11.0`
 - `minimum_runtime`: `Node.js >=14.0.0`
 - `api_base_url`: `https://api.sweetpotato.dev`
 

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import * as spaps_types from 'spaps-types';
-import { ResourceType, Entitlement, CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, IssueReportScope, IssueReportStatusResult, IssueReportStatus, IssueReportListResult, IssueReport, CreateIssueReportRequest, IssueReportAttachmentOut, ListIssueReportAttachmentsResponse, IssueReportAttachmentAccessResponse, IssueReportingVoiceTokenResult, UpdateIssueReportRequest, ReplyIssueReportRequest, ListIssueReportMessagesResponse, CreateReporterMessageRequest, IssueReportMessage, CreateOperatorMessageRequest, RetractOperatorMessageRequest, CreateAppLinkRequest, AppLink, UpdateAppLinkRequest, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, X402ResourceStatusResponse, X402ActionResponse, X402ReceiptResponse, X402ReceiptListResponse, X402HandoffVerification, DayrateAvailabilityResponse, DayrateBookingRequest, DayrateBookingResponse, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayrateX402BookingRequest, DayrateX402BookingResponse, DayrateCheckoutStatusResponse, UsageControlFeaturesResponse, UsageControlStatusRequest, UsageControlStatusResponse, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, Subscription, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
-export { AdminPermission, AdminRole, AdminUser, ApiResponse, AppLink, AuthResponse, CheckoutSession, CreateAppLinkRequest, CreateCryptoInvoiceRequest, CreateIssueReportRequest, CreateOperatorMessageRequest, CreatePriceRequest, CreateProductRequest, CreateReporterMessageRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, DayrateAvailabilityResponse, DayrateAvailableSlot, DayrateBookingRequest, DayrateBookingResponse, DayrateCheckoutStatus, DayrateCheckoutStatusBooking, DayrateCheckoutStatusResponse, DayrateDayOfWeek, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayratePriceBreakdown, DayrateSlotType, DayrateX402BookingRequest, DayrateX402BookingResponse, Entitlement, IssueReport, IssueReportAttachmentAccessResponse, IssueReportAttachmentOut, IssueReportListResult, IssueReportMessage, IssueReportStatus, IssueReportStatusResult, IssueReportTarget, IssueReportingInputMode, IssueReportingVoiceProvider, IssueReportingVoiceTokenResult, LinkedIssueReportCase, ListIssueReportAttachmentsResponse, ListIssueReportMessagesResponse, Price, Product, ProductSyncResult, ReplyIssueReportRequest, ResourceType, RetractOperatorMessageRequest, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateAppLinkRequest, UpdateIssueReportRequest, UpdateProductRequest, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlDecision, UsageControlDimensions, UsageControlError, UsageControlErrorCode, UsageControlFeaturesResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, UsageControlLedgerEvent, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlRecordStatus, UsageControlStatusRequest, UsageControlStatusResponse, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, X402ActionFreeResponse, X402ActionOutcome, X402ActionPendingResponse, X402ActionReplayedResponse, X402ActionResponse, X402ActionSettledResponse, X402ExecuteActionRequest, X402HandoffAuthorization, X402HandoffVerification, X402HandoffVerifyRequest, X402PaymentAccept, X402PaymentRequirement, X402ProjectionStatus, X402Receipt, X402ReceiptListResponse, X402ReceiptResponse, X402ReceiptStatus, X402Resource, X402ResourceStatus, X402ResourceStatusResponse, atomicToMoneyUnits, createSecureMessageRequestSchema, isX402PaymentRequired, isX402ResourceStatus, moneyUnitsToAtomic, roundHalfToPositiveInfinity, secureMessageMetadataSchema, secureMessageSchema, validatePositiveAmountAtomic } from 'spaps-types';
+import { ResourceType, Entitlement, CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, ListProjectGrantsResponse, ProjectAccessCheckResponse, IssueReportScope, IssueReportStatusResult, IssueReportStatus, IssueReportListResult, IssueReport, CreateIssueReportRequest, IssueReportAttachmentOut, ListIssueReportAttachmentsResponse, IssueReportAttachmentAccessResponse, IssueReportingVoiceTokenResult, UpdateIssueReportRequest, ReplyIssueReportRequest, ListIssueReportMessagesResponse, CreateReporterMessageRequest, IssueReportMessage, CreateOperatorMessageRequest, RetractOperatorMessageRequest, CreateAppLinkRequest, AppLink, UpdateAppLinkRequest, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, X402ResourceStatusResponse, X402ActionResponse, X402ReceiptResponse, X402ReceiptListResponse, X402HandoffVerification, DayrateAvailabilityResponse, DayrateBookingRequest, DayrateBookingResponse, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayrateX402BookingRequest, DayrateX402BookingResponse, DayrateCheckoutStatusResponse, UsageControlFeaturesResponse, UsageControlStatusRequest, UsageControlStatusResponse, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, Subscription, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
+export { AdminPermission, AdminRole, AdminUser, ApiResponse, AppLink, AuthResponse, CheckoutSession, CreateAppLinkRequest, CreateCryptoInvoiceRequest, CreateIssueReportRequest, CreateOperatorMessageRequest, CreatePriceRequest, CreateProductRequest, CreateReporterMessageRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, DayrateAvailabilityResponse, DayrateAvailableSlot, DayrateBookingRequest, DayrateBookingResponse, DayrateCheckoutStatus, DayrateCheckoutStatusBooking, DayrateCheckoutStatusResponse, DayrateDayOfWeek, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayratePriceBreakdown, DayrateSlotType, DayrateX402BookingRequest, DayrateX402BookingResponse, Entitlement, IssueReport, IssueReportAttachmentAccessResponse, IssueReportAttachmentOut, IssueReportListResult, IssueReportMessage, IssueReportStatus, IssueReportStatusResult, IssueReportTarget, IssueReportingInputMode, IssueReportingVoiceProvider, IssueReportingVoiceTokenResult, LinkedIssueReportCase, ListIssueReportAttachmentsResponse, ListIssueReportMessagesResponse, ListProjectGrantsResponse, Price, Product, ProductSyncResult, ProjectAccessCheckResponse, ProjectGrant, ProjectGrantStatus, ReplyIssueReportRequest, ResourceType, RetractOperatorMessageRequest, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateAppLinkRequest, UpdateIssueReportRequest, UpdateProductRequest, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlDecision, UsageControlDimensions, UsageControlError, UsageControlErrorCode, UsageControlFeaturesResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, UsageControlLedgerEvent, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlRecordStatus, UsageControlStatusRequest, UsageControlStatusResponse, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, X402ActionFreeResponse, X402ActionOutcome, X402ActionPendingResponse, X402ActionReplayedResponse, X402ActionResponse, X402ActionSettledResponse, X402ExecuteActionRequest, X402HandoffAuthorization, X402HandoffVerification, X402HandoffVerifyRequest, X402PaymentAccept, X402PaymentRequirement, X402ProjectionStatus, X402Receipt, X402ReceiptListResponse, X402ReceiptResponse, X402ReceiptStatus, X402Resource, X402ResourceStatus, X402ResourceStatusResponse, atomicToMoneyUnits, createSecureMessageRequestSchema, isX402PaymentRequired, isX402ResourceStatus, moneyUnitsToAtomic, roundHalfToPositiveInfinity, secureMessageMetadataSchema, secureMessageSchema, validatePositiveAmountAtomic } from 'spaps-types';
 
 /**
  * Permission checking utilities for SPAPS SDK
@@ -417,6 +417,22 @@ interface EntitlementCheckResult {
     /** The matching entitlement, if any */
     entitlement?: Entitlement;
 }
+interface CurrentUserProjectGrantListParams {
+    /** Filter to one project entitlement key, such as "pds.project.viewer" */
+    entitlementKey?: string;
+    /** Maximum number of project grants to return */
+    limit?: number;
+    /** Zero-based item offset */
+    offset?: number;
+    /** Opaque pagination cursor */
+    cursor?: string;
+}
+interface CurrentUserProjectAccessParams {
+    /** Project to check */
+    projectId: string;
+    /** Project entitlement key to check, such as "pds.project.viewer" */
+    entitlementKey: string;
+}
 type SupportedIssueReportScope = Extract<IssueReportScope, 'mine'>;
 interface IssueReportListParams {
     status?: IssueReportStatus;
@@ -428,8 +444,16 @@ interface IssueReportStatusParams {
     scope?: SupportedIssueReportScope;
 }
 interface IssueReportAttachmentUploadOptions {
+    /**
+     * Optional filename to send in the multipart `file` part. File objects keep
+     * their own name when this is omitted.
+     */
     filename?: string;
 }
+declare const ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES: readonly ["image/png", "image/jpeg", "image/webp"];
+type IssueReportAttachmentMimeType = typeof ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES[number];
+declare const ISSUE_REPORT_ATTACHMENT_MAX_BYTES: number;
+declare const ISSUE_REPORT_ATTACHMENT_MAX_RETAINED = 5;
 declare class X402PaymentRequiredSDKError extends Error {
     readonly paymentRequiredHeader: string;
     readonly response: unknown;
@@ -698,6 +722,7 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
     private headerProvider?;
     private unwrapApiResponse;
     private skillEvalMutationConfig;
+    private requireCurrentUserIdFromAccessToken;
     private isAxiosResponse;
     private isResponseLikeWithData;
     private isApiResponse;
@@ -779,6 +804,20 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
          * @param resourceId - Optional specific resource ID.
          */
         listByResource: (resourceType: ResourceType, resourceId?: string) => Promise<Entitlement[]>;
+        /**
+         * List project grants for the authenticated user.
+         *
+         * Browser/publishable-key contexts are safe here because the server requires
+         * the JWT subject to match the path user id.
+         */
+        listCurrentUserProjects: (params?: CurrentUserProjectGrantListParams) => Promise<ListProjectGrantsResponse>;
+        /**
+         * Check whether the authenticated user has one project entitlement.
+         *
+         * The helper does not accept user/email overrides; publishable-key callers
+         * are scoped by the server to the JWT identity.
+         */
+        checkCurrentUserProjectAccess: (params: CurrentUserProjectAccessParams) => Promise<ProjectAccessCheckResponse>;
     };
     /**
      * Issue reporting namespace for authenticated end-user issue flows.
@@ -1478,4 +1517,4 @@ declare function createServerClient(secretKey: string, options?: Omit<SPAPSConfi
  */
 declare function detectKeyType(key: string): ApiKeyType | null;
 
-export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, type CreateSkillEvalCaseRequest, type CreateSkillEvalGovernanceSnapshotRequest, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type HeaderProvider, type ImportSkillEvalGovernanceOutcomeRequest, type IssueReportAttachmentUploadOptions, type IssueReportListParams, type IssueReportStatusParams, type MarketingEventIngestRequest, type MarketingEventIngestResponse, type MarketingEventType, type MarketingExperimentDecision, type MarketingExperimentEffectDecision, type MarketingExperimentMinSampleDecision, type MarketingExperimentRecommendation, type MarketingExperimentResultsResponse, type MarketingExperimentSrmDecision, type MarketingExperimentSrmStatus, type MarketingExperimentVariantResult, type PermissionCheckResult, PermissionChecker, type RespondToSkillEvalReviewRequest, type RevealSkillEvalEvidenceRequest, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type SPAPSEnvelope, type SkillEvalAccessMode, type SkillEvalActorAccess, type SkillEvalCandidateInput, type SkillEvalCandidateResponse, type SkillEvalCasePolicy, type SkillEvalCaseResponse, type SkillEvalConfidence, type SkillEvalCreateOptions, type SkillEvalDisclosurePolicy, type SkillEvalEligibilitySource, type SkillEvalGovernanceOutcomeResult, type SkillEvalGovernancePurpose, type SkillEvalGovernanceSnapshotResult, type SkillEvalInsight, type SkillEvalInsightsResponse, type SkillEvalModelEffort, type SkillEvalMutationOptions, type SkillEvalPosterResponse, type SkillEvalPosterResponseResult, type SkillEvalRevealField, type SkillEvalRevealResult, type SkillEvalReviewMarkInput, type SkillEvalReviewMarkKind, type SkillEvalReviewResponse, type SkillEvalReviewRoom, type SkillEvalReviewerEligibilityInput, type SkillEvalRewardEvent, type SubmitSkillEvalReviewRequest, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, type X402ExecuteActionOptions, X402PaymentRequiredSDKError, type X402ReceiptListParams, type X402VerifyHandoffOptions, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, isEnvelope, isErrorEnvelope, isSuccessEnvelope, unwrapEnvelope, unwrapNestedData, verifyCryptoWebhookSignature };
+export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, type CreateSkillEvalCaseRequest, type CreateSkillEvalGovernanceSnapshotRequest, type CurrentUserProjectAccessParams, type CurrentUserProjectGrantListParams, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type HeaderProvider, ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES, ISSUE_REPORT_ATTACHMENT_MAX_BYTES, ISSUE_REPORT_ATTACHMENT_MAX_RETAINED, type ImportSkillEvalGovernanceOutcomeRequest, type IssueReportAttachmentMimeType, type IssueReportAttachmentUploadOptions, type IssueReportListParams, type IssueReportStatusParams, type MarketingEventIngestRequest, type MarketingEventIngestResponse, type MarketingEventType, type MarketingExperimentDecision, type MarketingExperimentEffectDecision, type MarketingExperimentMinSampleDecision, type MarketingExperimentRecommendation, type MarketingExperimentResultsResponse, type MarketingExperimentSrmDecision, type MarketingExperimentSrmStatus, type MarketingExperimentVariantResult, type PermissionCheckResult, PermissionChecker, type RespondToSkillEvalReviewRequest, type RevealSkillEvalEvidenceRequest, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type SPAPSEnvelope, type SkillEvalAccessMode, type SkillEvalActorAccess, type SkillEvalCandidateInput, type SkillEvalCandidateResponse, type SkillEvalCasePolicy, type SkillEvalCaseResponse, type SkillEvalConfidence, type SkillEvalCreateOptions, type SkillEvalDisclosurePolicy, type SkillEvalEligibilitySource, type SkillEvalGovernanceOutcomeResult, type SkillEvalGovernancePurpose, type SkillEvalGovernanceSnapshotResult, type SkillEvalInsight, type SkillEvalInsightsResponse, type SkillEvalModelEffort, type SkillEvalMutationOptions, type SkillEvalPosterResponse, type SkillEvalPosterResponseResult, type SkillEvalRevealField, type SkillEvalRevealResult, type SkillEvalReviewMarkInput, type SkillEvalReviewMarkKind, type SkillEvalReviewResponse, type SkillEvalReviewRoom, type SkillEvalReviewerEligibilityInput, type SkillEvalRewardEvent, type SubmitSkillEvalReviewRequest, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, type X402ExecuteActionOptions, X402PaymentRequiredSDKError, type X402ReceiptListParams, type X402VerifyHandoffOptions, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, isEnvelope, isErrorEnvelope, isSuccessEnvelope, unwrapEnvelope, unwrapNestedData, verifyCryptoWebhookSignature };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import * as spaps_types from 'spaps-types';
-import { ResourceType, Entitlement, CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, IssueReportScope, IssueReportStatusResult, IssueReportStatus, IssueReportListResult, IssueReport, CreateIssueReportRequest, IssueReportAttachmentOut, ListIssueReportAttachmentsResponse, IssueReportAttachmentAccessResponse, IssueReportingVoiceTokenResult, UpdateIssueReportRequest, ReplyIssueReportRequest, ListIssueReportMessagesResponse, CreateReporterMessageRequest, IssueReportMessage, CreateOperatorMessageRequest, RetractOperatorMessageRequest, CreateAppLinkRequest, AppLink, UpdateAppLinkRequest, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, X402ResourceStatusResponse, X402ActionResponse, X402ReceiptResponse, X402ReceiptListResponse, X402HandoffVerification, DayrateAvailabilityResponse, DayrateBookingRequest, DayrateBookingResponse, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayrateX402BookingRequest, DayrateX402BookingResponse, DayrateCheckoutStatusResponse, UsageControlFeaturesResponse, UsageControlStatusRequest, UsageControlStatusResponse, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, Subscription, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
-export { AdminPermission, AdminRole, AdminUser, ApiResponse, AppLink, AuthResponse, CheckoutSession, CreateAppLinkRequest, CreateCryptoInvoiceRequest, CreateIssueReportRequest, CreateOperatorMessageRequest, CreatePriceRequest, CreateProductRequest, CreateReporterMessageRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, DayrateAvailabilityResponse, DayrateAvailableSlot, DayrateBookingRequest, DayrateBookingResponse, DayrateCheckoutStatus, DayrateCheckoutStatusBooking, DayrateCheckoutStatusResponse, DayrateDayOfWeek, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayratePriceBreakdown, DayrateSlotType, DayrateX402BookingRequest, DayrateX402BookingResponse, Entitlement, IssueReport, IssueReportAttachmentAccessResponse, IssueReportAttachmentOut, IssueReportListResult, IssueReportMessage, IssueReportStatus, IssueReportStatusResult, IssueReportTarget, IssueReportingInputMode, IssueReportingVoiceProvider, IssueReportingVoiceTokenResult, LinkedIssueReportCase, ListIssueReportAttachmentsResponse, ListIssueReportMessagesResponse, Price, Product, ProductSyncResult, ReplyIssueReportRequest, ResourceType, RetractOperatorMessageRequest, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateAppLinkRequest, UpdateIssueReportRequest, UpdateProductRequest, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlDecision, UsageControlDimensions, UsageControlError, UsageControlErrorCode, UsageControlFeaturesResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, UsageControlLedgerEvent, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlRecordStatus, UsageControlStatusRequest, UsageControlStatusResponse, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, X402ActionFreeResponse, X402ActionOutcome, X402ActionPendingResponse, X402ActionReplayedResponse, X402ActionResponse, X402ActionSettledResponse, X402ExecuteActionRequest, X402HandoffAuthorization, X402HandoffVerification, X402HandoffVerifyRequest, X402PaymentAccept, X402PaymentRequirement, X402ProjectionStatus, X402Receipt, X402ReceiptListResponse, X402ReceiptResponse, X402ReceiptStatus, X402Resource, X402ResourceStatus, X402ResourceStatusResponse, atomicToMoneyUnits, createSecureMessageRequestSchema, isX402PaymentRequired, isX402ResourceStatus, moneyUnitsToAtomic, roundHalfToPositiveInfinity, secureMessageMetadataSchema, secureMessageSchema, validatePositiveAmountAtomic } from 'spaps-types';
+import { ResourceType, Entitlement, CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, ListProjectGrantsResponse, ProjectAccessCheckResponse, IssueReportScope, IssueReportStatusResult, IssueReportStatus, IssueReportListResult, IssueReport, CreateIssueReportRequest, IssueReportAttachmentOut, ListIssueReportAttachmentsResponse, IssueReportAttachmentAccessResponse, IssueReportingVoiceTokenResult, UpdateIssueReportRequest, ReplyIssueReportRequest, ListIssueReportMessagesResponse, CreateReporterMessageRequest, IssueReportMessage, CreateOperatorMessageRequest, RetractOperatorMessageRequest, CreateAppLinkRequest, AppLink, UpdateAppLinkRequest, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, X402ResourceStatusResponse, X402ActionResponse, X402ReceiptResponse, X402ReceiptListResponse, X402HandoffVerification, DayrateAvailabilityResponse, DayrateBookingRequest, DayrateBookingResponse, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayrateX402BookingRequest, DayrateX402BookingResponse, DayrateCheckoutStatusResponse, UsageControlFeaturesResponse, UsageControlStatusRequest, UsageControlStatusResponse, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, Subscription, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
+export { AdminPermission, AdminRole, AdminUser, ApiResponse, AppLink, AuthResponse, CheckoutSession, CreateAppLinkRequest, CreateCryptoInvoiceRequest, CreateIssueReportRequest, CreateOperatorMessageRequest, CreatePriceRequest, CreateProductRequest, CreateReporterMessageRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, DayrateAvailabilityResponse, DayrateAvailableSlot, DayrateBookingRequest, DayrateBookingResponse, DayrateCheckoutStatus, DayrateCheckoutStatusBooking, DayrateCheckoutStatusResponse, DayrateDayOfWeek, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayratePriceBreakdown, DayrateSlotType, DayrateX402BookingRequest, DayrateX402BookingResponse, Entitlement, IssueReport, IssueReportAttachmentAccessResponse, IssueReportAttachmentOut, IssueReportListResult, IssueReportMessage, IssueReportStatus, IssueReportStatusResult, IssueReportTarget, IssueReportingInputMode, IssueReportingVoiceProvider, IssueReportingVoiceTokenResult, LinkedIssueReportCase, ListIssueReportAttachmentsResponse, ListIssueReportMessagesResponse, ListProjectGrantsResponse, Price, Product, ProductSyncResult, ProjectAccessCheckResponse, ProjectGrant, ProjectGrantStatus, ReplyIssueReportRequest, ResourceType, RetractOperatorMessageRequest, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateAppLinkRequest, UpdateIssueReportRequest, UpdateProductRequest, UsageControlAuthorizeRequest, UsageControlAuthorizeResponse, UsageControlDecision, UsageControlDimensions, UsageControlError, UsageControlErrorCode, UsageControlFeaturesResponse, UsageControlHistoryRequest, UsageControlHistoryResponse, UsageControlLedgerEvent, UsageControlRecordRequest, UsageControlRecordResponse, UsageControlRecordStatus, UsageControlStatusRequest, UsageControlStatusResponse, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, X402ActionFreeResponse, X402ActionOutcome, X402ActionPendingResponse, X402ActionReplayedResponse, X402ActionResponse, X402ActionSettledResponse, X402ExecuteActionRequest, X402HandoffAuthorization, X402HandoffVerification, X402HandoffVerifyRequest, X402PaymentAccept, X402PaymentRequirement, X402ProjectionStatus, X402Receipt, X402ReceiptListResponse, X402ReceiptResponse, X402ReceiptStatus, X402Resource, X402ResourceStatus, X402ResourceStatusResponse, atomicToMoneyUnits, createSecureMessageRequestSchema, isX402PaymentRequired, isX402ResourceStatus, moneyUnitsToAtomic, roundHalfToPositiveInfinity, secureMessageMetadataSchema, secureMessageSchema, validatePositiveAmountAtomic } from 'spaps-types';
 
 /**
  * Permission checking utilities for SPAPS SDK
@@ -417,6 +417,22 @@ interface EntitlementCheckResult {
     /** The matching entitlement, if any */
     entitlement?: Entitlement;
 }
+interface CurrentUserProjectGrantListParams {
+    /** Filter to one project entitlement key, such as "pds.project.viewer" */
+    entitlementKey?: string;
+    /** Maximum number of project grants to return */
+    limit?: number;
+    /** Zero-based item offset */
+    offset?: number;
+    /** Opaque pagination cursor */
+    cursor?: string;
+}
+interface CurrentUserProjectAccessParams {
+    /** Project to check */
+    projectId: string;
+    /** Project entitlement key to check, such as "pds.project.viewer" */
+    entitlementKey: string;
+}
 type SupportedIssueReportScope = Extract<IssueReportScope, 'mine'>;
 interface IssueReportListParams {
     status?: IssueReportStatus;
@@ -428,8 +444,16 @@ interface IssueReportStatusParams {
     scope?: SupportedIssueReportScope;
 }
 interface IssueReportAttachmentUploadOptions {
+    /**
+     * Optional filename to send in the multipart `file` part. File objects keep
+     * their own name when this is omitted.
+     */
     filename?: string;
 }
+declare const ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES: readonly ["image/png", "image/jpeg", "image/webp"];
+type IssueReportAttachmentMimeType = typeof ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES[number];
+declare const ISSUE_REPORT_ATTACHMENT_MAX_BYTES: number;
+declare const ISSUE_REPORT_ATTACHMENT_MAX_RETAINED = 5;
 declare class X402PaymentRequiredSDKError extends Error {
     readonly paymentRequiredHeader: string;
     readonly response: unknown;
@@ -698,6 +722,7 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
     private headerProvider?;
     private unwrapApiResponse;
     private skillEvalMutationConfig;
+    private requireCurrentUserIdFromAccessToken;
     private isAxiosResponse;
     private isResponseLikeWithData;
     private isApiResponse;
@@ -779,6 +804,20 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
          * @param resourceId - Optional specific resource ID.
          */
         listByResource: (resourceType: ResourceType, resourceId?: string) => Promise<Entitlement[]>;
+        /**
+         * List project grants for the authenticated user.
+         *
+         * Browser/publishable-key contexts are safe here because the server requires
+         * the JWT subject to match the path user id.
+         */
+        listCurrentUserProjects: (params?: CurrentUserProjectGrantListParams) => Promise<ListProjectGrantsResponse>;
+        /**
+         * Check whether the authenticated user has one project entitlement.
+         *
+         * The helper does not accept user/email overrides; publishable-key callers
+         * are scoped by the server to the JWT identity.
+         */
+        checkCurrentUserProjectAccess: (params: CurrentUserProjectAccessParams) => Promise<ProjectAccessCheckResponse>;
     };
     /**
      * Issue reporting namespace for authenticated end-user issue flows.
@@ -1478,4 +1517,4 @@ declare function createServerClient(secretKey: string, options?: Omit<SPAPSConfi
  */
 declare function detectKeyType(key: string): ApiKeyType | null;
 
-export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, type CreateSkillEvalCaseRequest, type CreateSkillEvalGovernanceSnapshotRequest, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type HeaderProvider, type ImportSkillEvalGovernanceOutcomeRequest, type IssueReportAttachmentUploadOptions, type IssueReportListParams, type IssueReportStatusParams, type MarketingEventIngestRequest, type MarketingEventIngestResponse, type MarketingEventType, type MarketingExperimentDecision, type MarketingExperimentEffectDecision, type MarketingExperimentMinSampleDecision, type MarketingExperimentRecommendation, type MarketingExperimentResultsResponse, type MarketingExperimentSrmDecision, type MarketingExperimentSrmStatus, type MarketingExperimentVariantResult, type PermissionCheckResult, PermissionChecker, type RespondToSkillEvalReviewRequest, type RevealSkillEvalEvidenceRequest, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type SPAPSEnvelope, type SkillEvalAccessMode, type SkillEvalActorAccess, type SkillEvalCandidateInput, type SkillEvalCandidateResponse, type SkillEvalCasePolicy, type SkillEvalCaseResponse, type SkillEvalConfidence, type SkillEvalCreateOptions, type SkillEvalDisclosurePolicy, type SkillEvalEligibilitySource, type SkillEvalGovernanceOutcomeResult, type SkillEvalGovernancePurpose, type SkillEvalGovernanceSnapshotResult, type SkillEvalInsight, type SkillEvalInsightsResponse, type SkillEvalModelEffort, type SkillEvalMutationOptions, type SkillEvalPosterResponse, type SkillEvalPosterResponseResult, type SkillEvalRevealField, type SkillEvalRevealResult, type SkillEvalReviewMarkInput, type SkillEvalReviewMarkKind, type SkillEvalReviewResponse, type SkillEvalReviewRoom, type SkillEvalReviewerEligibilityInput, type SkillEvalRewardEvent, type SubmitSkillEvalReviewRequest, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, type X402ExecuteActionOptions, X402PaymentRequiredSDKError, type X402ReceiptListParams, type X402VerifyHandoffOptions, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, isEnvelope, isErrorEnvelope, isSuccessEnvelope, unwrapEnvelope, unwrapNestedData, verifyCryptoWebhookSignature };
+export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, type CreateSkillEvalCaseRequest, type CreateSkillEvalGovernanceSnapshotRequest, type CurrentUserProjectAccessParams, type CurrentUserProjectGrantListParams, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type HeaderProvider, ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES, ISSUE_REPORT_ATTACHMENT_MAX_BYTES, ISSUE_REPORT_ATTACHMENT_MAX_RETAINED, type ImportSkillEvalGovernanceOutcomeRequest, type IssueReportAttachmentMimeType, type IssueReportAttachmentUploadOptions, type IssueReportListParams, type IssueReportStatusParams, type MarketingEventIngestRequest, type MarketingEventIngestResponse, type MarketingEventType, type MarketingExperimentDecision, type MarketingExperimentEffectDecision, type MarketingExperimentMinSampleDecision, type MarketingExperimentRecommendation, type MarketingExperimentResultsResponse, type MarketingExperimentSrmDecision, type MarketingExperimentSrmStatus, type MarketingExperimentVariantResult, type PermissionCheckResult, PermissionChecker, type RespondToSkillEvalReviewRequest, type RevealSkillEvalEvidenceRequest, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type SPAPSEnvelope, type SkillEvalAccessMode, type SkillEvalActorAccess, type SkillEvalCandidateInput, type SkillEvalCandidateResponse, type SkillEvalCasePolicy, type SkillEvalCaseResponse, type SkillEvalConfidence, type SkillEvalCreateOptions, type SkillEvalDisclosurePolicy, type SkillEvalEligibilitySource, type SkillEvalGovernanceOutcomeResult, type SkillEvalGovernancePurpose, type SkillEvalGovernanceSnapshotResult, type SkillEvalInsight, type SkillEvalInsightsResponse, type SkillEvalModelEffort, type SkillEvalMutationOptions, type SkillEvalPosterResponse, type SkillEvalPosterResponseResult, type SkillEvalRevealField, type SkillEvalRevealResult, type SkillEvalReviewMarkInput, type SkillEvalReviewMarkKind, type SkillEvalReviewResponse, type SkillEvalReviewRoom, type SkillEvalReviewerEligibilityInput, type SkillEvalRewardEvent, type SubmitSkillEvalReviewRequest, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, type X402ExecuteActionOptions, X402PaymentRequiredSDKError, type X402ReceiptListParams, type X402VerifyHandoffOptions, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, isEnvelope, isErrorEnvelope, isSuccessEnvelope, unwrapEnvelope, unwrapNestedData, verifyCryptoWebhookSignature };

package/dist/index.js

@@ -196,6 +196,9 @@ var index_exports = {};
 __export(index_exports, {
   DEFAULT_ADMIN_ACCOUNTS: () => DEFAULT_ADMIN_ACCOUNTS,
   FeatureEvaluator: () => FeatureEvaluator,
+  ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES: () => ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES,
+  ISSUE_REPORT_ATTACHMENT_MAX_BYTES: () => ISSUE_REPORT_ATTACHMENT_MAX_BYTES,
+  ISSUE_REPORT_ATTACHMENT_MAX_RETAINED: () => ISSUE_REPORT_ATTACHMENT_MAX_RETAINED,
   PermissionChecker: () => PermissionChecker,
   RoleHierarchy: () => RoleHierarchy,
   SPAPS: () => SPAPSClient,
@@ -523,6 +526,27 @@ function appendSupportedIssueReportScope(q, scope) {
   }
   q.append("scope", scope);
 }
+var ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES = [
+  "image/png",
+  "image/jpeg",
+  "image/webp"
+];
+var ISSUE_REPORT_ATTACHMENT_MAX_BYTES = 10 * 1024 * 1024;
+var ISSUE_REPORT_ATTACHMENT_MAX_RETAINED = 5;
+var ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPE_SET = new Set(
+  ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES
+);
+function assertSupportedIssueReportAttachment(file) {
+  const mimeType = (file.type || "").trim().toLowerCase();
+  if (!ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPE_SET.has(mimeType)) {
+    throw new Error(
+      "SPAPS issue report attachments must be PNG, JPEG, or WebP screenshots"
+    );
+  }
+  if (file.size > ISSUE_REPORT_ATTACHMENT_MAX_BYTES) {
+    throw new Error("SPAPS issue report attachments must be 10 MiB or smaller");
+  }
+}
 var X402PaymentRequiredSDKError = class extends Error {
   paymentRequiredHeader;
   response;
@@ -563,6 +587,17 @@ var SPAPSClient = class _SPAPSClient {
     }
     return { headers: { "If-Match": String(ifMatch) } };
   }
+  requireCurrentUserIdFromAccessToken() {
+    if (!this.accessToken) {
+      throw new Error("Authentication required. Please authenticate first.");
+    }
+    const payload = TokenManager.decodePayload(this.accessToken);
+    const userId = payload?.user_id ?? payload?.sub;
+    if (typeof userId !== "string" || userId.length === 0) {
+      throw new Error("Current user id not found in access token.");
+    }
+    return userId;
+  }
   isAxiosResponse(value) {
     if (!value || typeof value !== "object") {
       return false;
@@ -701,6 +736,46 @@ var SPAPSClient = class _SPAPSClient {
         return payload.entitlements;
       }
       return payload;
+    },
+    /**
+     * List project grants for the authenticated user.
+     *
+     * Browser/publishable-key contexts are safe here because the server requires
+     * the JWT subject to match the path user id.
+     */
+    listCurrentUserProjects: async (params) => {
+      const userId = this.requireCurrentUserIdFromAccessToken();
+      const q = new URLSearchParams();
+      if (params?.entitlementKey) q.append("entitlement_key", params.entitlementKey);
+      if (params?.limit !== void 0) q.append("limit", String(params.limit));
+      if (params?.offset !== void 0) q.append("offset", String(params.offset));
+      if (params?.cursor) q.append("cursor", params.cursor);
+      const qs = q.toString();
+      const res = await this.client.get(
+        `/api/project-grants/user/${encodeURIComponent(userId)}/projects${qs ? `?${qs}` : ""}`,
+        { headers: { Authorization: `Bearer ${this.accessToken}` } }
+      );
+      return this.unwrapApiResponse(res, "Failed to list current user project grants");
+    },
+    /**
+     * Check whether the authenticated user has one project entitlement.
+     *
+     * The helper does not accept user/email overrides; publishable-key callers
+     * are scoped by the server to the JWT identity.
+     */
+    checkCurrentUserProjectAccess: async (params) => {
+      if (!this.accessToken) {
+        throw new Error("Authentication required. Please authenticate first.");
+      }
+      const q = new URLSearchParams({
+        project_id: params.projectId,
+        entitlement_key: params.entitlementKey
+      });
+      const res = await this.client.get(
+        `/api/project-grants/check?${q.toString()}`,
+        { headers: { Authorization: `Bearer ${this.accessToken}` } }
+      );
+      return this.unwrapApiResponse(res, "Failed to check current user project access");
     }
   };
   /**
@@ -764,6 +839,7 @@ var SPAPSClient = class _SPAPSClient {
       if (typeof FormData === "undefined") {
         throw new Error("FormData is required to upload issue report attachments");
       }
+      assertSupportedIssueReportAttachment(file);
       const formData = new FormData();
       const fileWithOptionalName = file;
       const inferredFilename = typeof fileWithOptionalName.name === "string" ? fileWithOptionalName.name : void 0;
@@ -2370,6 +2446,9 @@ function detectKeyType(key) {
 0 && (module.exports = {
   DEFAULT_ADMIN_ACCOUNTS,
   FeatureEvaluator,
+  ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES,
+  ISSUE_REPORT_ATTACHMENT_MAX_BYTES,
+  ISSUE_REPORT_ATTACHMENT_MAX_RETAINED,
   PermissionChecker,
   RoleHierarchy,
   SPAPS,

package/dist/index.mjs

@@ -488,6 +488,27 @@ function appendSupportedIssueReportScope(q, scope) {
   }
   q.append("scope", scope);
 }
+var ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES = [
+  "image/png",
+  "image/jpeg",
+  "image/webp"
+];
+var ISSUE_REPORT_ATTACHMENT_MAX_BYTES = 10 * 1024 * 1024;
+var ISSUE_REPORT_ATTACHMENT_MAX_RETAINED = 5;
+var ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPE_SET = new Set(
+  ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES
+);
+function assertSupportedIssueReportAttachment(file) {
+  const mimeType = (file.type || "").trim().toLowerCase();
+  if (!ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPE_SET.has(mimeType)) {
+    throw new Error(
+      "SPAPS issue report attachments must be PNG, JPEG, or WebP screenshots"
+    );
+  }
+  if (file.size > ISSUE_REPORT_ATTACHMENT_MAX_BYTES) {
+    throw new Error("SPAPS issue report attachments must be 10 MiB or smaller");
+  }
+}
 var X402PaymentRequiredSDKError = class extends Error {
   paymentRequiredHeader;
   response;
@@ -528,6 +549,17 @@ var SPAPSClient = class _SPAPSClient {
     }
     return { headers: { "If-Match": String(ifMatch) } };
   }
+  requireCurrentUserIdFromAccessToken() {
+    if (!this.accessToken) {
+      throw new Error("Authentication required. Please authenticate first.");
+    }
+    const payload = TokenManager.decodePayload(this.accessToken);
+    const userId = payload?.user_id ?? payload?.sub;
+    if (typeof userId !== "string" || userId.length === 0) {
+      throw new Error("Current user id not found in access token.");
+    }
+    return userId;
+  }
   isAxiosResponse(value) {
     if (!value || typeof value !== "object") {
       return false;
@@ -666,6 +698,46 @@ var SPAPSClient = class _SPAPSClient {
         return payload.entitlements;
       }
       return payload;
+    },
+    /**
+     * List project grants for the authenticated user.
+     *
+     * Browser/publishable-key contexts are safe here because the server requires
+     * the JWT subject to match the path user id.
+     */
+    listCurrentUserProjects: async (params) => {
+      const userId = this.requireCurrentUserIdFromAccessToken();
+      const q = new URLSearchParams();
+      if (params?.entitlementKey) q.append("entitlement_key", params.entitlementKey);
+      if (params?.limit !== void 0) q.append("limit", String(params.limit));
+      if (params?.offset !== void 0) q.append("offset", String(params.offset));
+      if (params?.cursor) q.append("cursor", params.cursor);
+      const qs = q.toString();
+      const res = await this.client.get(
+        `/api/project-grants/user/${encodeURIComponent(userId)}/projects${qs ? `?${qs}` : ""}`,
+        { headers: { Authorization: `Bearer ${this.accessToken}` } }
+      );
+      return this.unwrapApiResponse(res, "Failed to list current user project grants");
+    },
+    /**
+     * Check whether the authenticated user has one project entitlement.
+     *
+     * The helper does not accept user/email overrides; publishable-key callers
+     * are scoped by the server to the JWT identity.
+     */
+    checkCurrentUserProjectAccess: async (params) => {
+      if (!this.accessToken) {
+        throw new Error("Authentication required. Please authenticate first.");
+      }
+      const q = new URLSearchParams({
+        project_id: params.projectId,
+        entitlement_key: params.entitlementKey
+      });
+      const res = await this.client.get(
+        `/api/project-grants/check?${q.toString()}`,
+        { headers: { Authorization: `Bearer ${this.accessToken}` } }
+      );
+      return this.unwrapApiResponse(res, "Failed to check current user project access");
     }
   };
   /**
@@ -729,6 +801,7 @@ var SPAPSClient = class _SPAPSClient {
       if (typeof FormData === "undefined") {
         throw new Error("FormData is required to upload issue report attachments");
       }
+      assertSupportedIssueReportAttachment(file);
       const formData = new FormData();
       const fileWithOptionalName = file;
       const inferredFilename = typeof fileWithOptionalName.name === "string" ? fileWithOptionalName.name : void 0;
@@ -2334,6 +2407,9 @@ function detectKeyType(key) {
 export {
   DEFAULT_ADMIN_ACCOUNTS,
   FeatureEvaluator,
+  ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES,
+  ISSUE_REPORT_ATTACHMENT_MAX_BYTES,
+  ISSUE_REPORT_ATTACHMENT_MAX_RETAINED,
   PermissionChecker,
   RoleHierarchy,
   SPAPSClient as SPAPS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spaps-sdk",
-  "version": "1.10.2",
+  "version": "1.12.0",
   "description": "Sweet Potato Authentication & Payment Service SDK - Zero-config client with built-in permission checking, role-based access control, and dayrate scheduling",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -51,7 +51,7 @@
   "dependencies": {
     "axios": "^1.15.1",
     "cross-fetch": "^4.0.0",
-    "spaps-types": "^1.4.2"
+    "spaps-types": "^1.5.0"
   },
   "devDependencies": {
     "@types/node": "^20.10.0",
@@ -81,4 +81,4 @@
   "engines": {
     "node": ">=14.0.0"
   }
-}
+}