spaps-sdk 1.11.0 → 1.12.0

package/CHANGELOG.md

@@ -10,6 +10,14 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 
 - Added browser-safe `entitlements.listCurrentUserProjects()` and `entitlements.checkCurrentUserProjectAccess(...)` helpers for project grant reads.
 
+## [1.11.0] - 2026-06-08
+
+### Added
+
+- Exported the canonical issue-report screenshot attachment constraints: `ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES`, `ISSUE_REPORT_ATTACHMENT_MAX_BYTES`, and `ISSUE_REPORT_ATTACHMENT_MAX_RETAINED`.
+- Added SDK-side preflight validation to `issueReporting.uploadAttachment(file, options)`, rejecting unsupported MIME types and files larger than 10 MiB before opening the multipart request. SPAPS remains the authoritative backend validator.
+- Documented the operator-gated automatic screenshot-capture handoff: React consumers should lazy-load capture through `spaps-issue-reporting-react@0.6.0`, pass captured files to SDK `uploadAttachment`, and keep publishing/deployment approval outside worker nodes. The local proof tarball for this SDK line was `/tmp/spaps-sdk-1.11.0.tgz`; `spaps-sdk@1.11.0` is now published on npm.
+
 ## [1.10.2] - 2026-06-04
 
 ### Added

package/README.md

@@ -154,14 +154,34 @@ console.log(voiceToken.provider, voiceToken.model_id);
 
 ### Issue Reporting Screenshot Attachments
 
-Screenshots are uploaded as private pending hosted assets first. Create, update, or reply calls then send only attachment IDs; do not put raw image bytes, data URLs, or base64 payloads in issue notes or target metadata.
+Use `spaps.issueReporting.uploadAttachment(file)` as the canonical screenshot
+upload path. Consumers should not carry raw `POST /api/v1/issue-reports/attachments`
+adapters when their installed `spaps-sdk` exposes this method.
+
+Screenshots are uploaded as private pending hosted assets first. Create, update,
+or reply calls then send only attachment IDs; do not put raw image bytes, data
+URLs, or base64 payloads in issue notes or target metadata.
 
 ```ts
+import {
+  ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES,
+  ISSUE_REPORT_ATTACHMENT_MAX_BYTES,
+  ISSUE_REPORT_ATTACHMENT_MAX_RETAINED,
+} from "spaps-sdk";
+
 spaps.setAccessToken(accessToken);
 
 const file = new File([pngBytes], "protocol-save-failure.png", {
   type: "image/png",
 });
+
+const supportedType = ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES.some(
+  (mimeType) => mimeType === file.type,
+);
+if (!supportedType || file.size > ISSUE_REPORT_ATTACHMENT_MAX_BYTES) {
+  throw new Error("Screenshot is not a supported SPAPS issue-report attachment");
+}
+
 const attachment = await spaps.issueReporting.uploadAttachment(file);
 
 const issue = await spaps.issueReporting.create({
@@ -178,10 +198,35 @@ const issue = await spaps.issueReporting.create({
 });
 
 const access = await spaps.issueReporting.getAttachmentAccess(attachment.id);
-console.log(issue.id, access.expires_in_seconds);
+console.log(issue.id, access.expires_in_seconds, ISSUE_REPORT_ATTACHMENT_MAX_RETAINED);
 ```
 
-SPAPS accepts PNG, JPEG, and WebP screenshots up to 10 MiB each, with at most 5 retained screenshots per report. The hosted object remains private; callers fetch a short-lived access URL after normal issue-reporting authorization succeeds. SPAPS does not redact screenshot contents, so host apps should warn users when a capture may include sensitive data.
+The SDK rejects unsupported screenshot MIME types and files over 10 MiB before
+opening the multipart request. SPAPS still performs authoritative validation,
+stores the hosted object privately, and retains at most 5 screenshots per report
+or reply. Callers fetch a short-lived access URL after normal issue-reporting
+authorization succeeds. SPAPS does not redact screenshot contents, so host apps
+should warn users when a capture may include sensitive data.
+
+Browser capture is intentionally outside this SDK. The shared
+`spaps-issue-reporting-react` automatic DOM capture contract is a React-package
+concern: it should lazy-load `html2canvas` only after the host app opts in with
+the React `screenshotCapture` config, convert the visible same-origin DOM result
+to a PNG, JPEG, or WebP `Blob`/`File`, then pass that file to
+`uploadAttachment`. Apps that do not opt in must not download `html2canvas`.
+If capture or upload fails, submit the issue with metadata and any manual
+attachments instead of blocking issue submission.
+
+Version note: `uploadAttachment` was added in `spaps-sdk@1.10.1`, and
+`getAttachmentAccess` became the canonical access helper in `spaps-sdk@1.10.2`.
+The exported limit constants shown above are part of this source package line;
+wait for the operator-approved npm release before removing local shims from
+consumers pinned to older packages.
+
+No new SDK method or backend screenshot endpoint is part of the automatic
+capture contract unless the existing private attachment upload proves
+insufficient. Worker nodes may validate with local packs or workspace links, but
+publishing `spaps-sdk` or `spaps-issue-reporting-react` remains operator-gated.
 
 ### Application Short Links
 
@@ -511,7 +556,7 @@ npm run test:readme
 ## Metadata
 
 - `package_name`: `spaps-sdk`
-- `latest_version`: `1.10.2`
+- `latest_version`: `1.11.0`
 - `minimum_runtime`: `Node.js >=14.0.0`
 - `api_base_url`: `https://api.sweetpotato.dev`
 

package/dist/index.d.mts

@@ -444,8 +444,16 @@ interface IssueReportStatusParams {
     scope?: SupportedIssueReportScope;
 }
 interface IssueReportAttachmentUploadOptions {
+    /**
+     * Optional filename to send in the multipart `file` part. File objects keep
+     * their own name when this is omitted.
+     */
     filename?: string;
 }
+declare const ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES: readonly ["image/png", "image/jpeg", "image/webp"];
+type IssueReportAttachmentMimeType = typeof ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES[number];
+declare const ISSUE_REPORT_ATTACHMENT_MAX_BYTES: number;
+declare const ISSUE_REPORT_ATTACHMENT_MAX_RETAINED = 5;
 declare class X402PaymentRequiredSDKError extends Error {
     readonly paymentRequiredHeader: string;
     readonly response: unknown;
@@ -1509,4 +1517,4 @@ declare function createServerClient(secretKey: string, options?: Omit<SPAPSConfi
  */
 declare function detectKeyType(key: string): ApiKeyType | null;
 
-export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, type CreateSkillEvalCaseRequest, type CreateSkillEvalGovernanceSnapshotRequest, type CurrentUserProjectAccessParams, type CurrentUserProjectGrantListParams, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type HeaderProvider, type ImportSkillEvalGovernanceOutcomeRequest, type IssueReportAttachmentUploadOptions, type IssueReportListParams, type IssueReportStatusParams, type MarketingEventIngestRequest, type MarketingEventIngestResponse, type MarketingEventType, type MarketingExperimentDecision, type MarketingExperimentEffectDecision, type MarketingExperimentMinSampleDecision, type MarketingExperimentRecommendation, type MarketingExperimentResultsResponse, type MarketingExperimentSrmDecision, type MarketingExperimentSrmStatus, type MarketingExperimentVariantResult, type PermissionCheckResult, PermissionChecker, type RespondToSkillEvalReviewRequest, type RevealSkillEvalEvidenceRequest, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type SPAPSEnvelope, type SkillEvalAccessMode, type SkillEvalActorAccess, type SkillEvalCandidateInput, type SkillEvalCandidateResponse, type SkillEvalCasePolicy, type SkillEvalCaseResponse, type SkillEvalConfidence, type SkillEvalCreateOptions, type SkillEvalDisclosurePolicy, type SkillEvalEligibilitySource, type SkillEvalGovernanceOutcomeResult, type SkillEvalGovernancePurpose, type SkillEvalGovernanceSnapshotResult, type SkillEvalInsight, type SkillEvalInsightsResponse, type SkillEvalModelEffort, type SkillEvalMutationOptions, type SkillEvalPosterResponse, type SkillEvalPosterResponseResult, type SkillEvalRevealField, type SkillEvalRevealResult, type SkillEvalReviewMarkInput, type SkillEvalReviewMarkKind, type SkillEvalReviewResponse, type SkillEvalReviewRoom, type SkillEvalReviewerEligibilityInput, type SkillEvalRewardEvent, type SubmitSkillEvalReviewRequest, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, type X402ExecuteActionOptions, X402PaymentRequiredSDKError, type X402ReceiptListParams, type X402VerifyHandoffOptions, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, isEnvelope, isErrorEnvelope, isSuccessEnvelope, unwrapEnvelope, unwrapNestedData, verifyCryptoWebhookSignature };
+export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, type CreateSkillEvalCaseRequest, type CreateSkillEvalGovernanceSnapshotRequest, type CurrentUserProjectAccessParams, type CurrentUserProjectGrantListParams, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type HeaderProvider, ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES, ISSUE_REPORT_ATTACHMENT_MAX_BYTES, ISSUE_REPORT_ATTACHMENT_MAX_RETAINED, type ImportSkillEvalGovernanceOutcomeRequest, type IssueReportAttachmentMimeType, type IssueReportAttachmentUploadOptions, type IssueReportListParams, type IssueReportStatusParams, type MarketingEventIngestRequest, type MarketingEventIngestResponse, type MarketingEventType, type MarketingExperimentDecision, type MarketingExperimentEffectDecision, type MarketingExperimentMinSampleDecision, type MarketingExperimentRecommendation, type MarketingExperimentResultsResponse, type MarketingExperimentSrmDecision, type MarketingExperimentSrmStatus, type MarketingExperimentVariantResult, type PermissionCheckResult, PermissionChecker, type RespondToSkillEvalReviewRequest, type RevealSkillEvalEvidenceRequest, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type SPAPSEnvelope, type SkillEvalAccessMode, type SkillEvalActorAccess, type SkillEvalCandidateInput, type SkillEvalCandidateResponse, type SkillEvalCasePolicy, type SkillEvalCaseResponse, type SkillEvalConfidence, type SkillEvalCreateOptions, type SkillEvalDisclosurePolicy, type SkillEvalEligibilitySource, type SkillEvalGovernanceOutcomeResult, type SkillEvalGovernancePurpose, type SkillEvalGovernanceSnapshotResult, type SkillEvalInsight, type SkillEvalInsightsResponse, type SkillEvalModelEffort, type SkillEvalMutationOptions, type SkillEvalPosterResponse, type SkillEvalPosterResponseResult, type SkillEvalRevealField, type SkillEvalRevealResult, type SkillEvalReviewMarkInput, type SkillEvalReviewMarkKind, type SkillEvalReviewResponse, type SkillEvalReviewRoom, type SkillEvalReviewerEligibilityInput, type SkillEvalRewardEvent, type SubmitSkillEvalReviewRequest, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, type X402ExecuteActionOptions, X402PaymentRequiredSDKError, type X402ReceiptListParams, type X402VerifyHandoffOptions, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, isEnvelope, isErrorEnvelope, isSuccessEnvelope, unwrapEnvelope, unwrapNestedData, verifyCryptoWebhookSignature };

package/dist/index.d.ts

@@ -444,8 +444,16 @@ interface IssueReportStatusParams {
     scope?: SupportedIssueReportScope;
 }
 interface IssueReportAttachmentUploadOptions {
+    /**
+     * Optional filename to send in the multipart `file` part. File objects keep
+     * their own name when this is omitted.
+     */
     filename?: string;
 }
+declare const ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES: readonly ["image/png", "image/jpeg", "image/webp"];
+type IssueReportAttachmentMimeType = typeof ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES[number];
+declare const ISSUE_REPORT_ATTACHMENT_MAX_BYTES: number;
+declare const ISSUE_REPORT_ATTACHMENT_MAX_RETAINED = 5;
 declare class X402PaymentRequiredSDKError extends Error {
     readonly paymentRequiredHeader: string;
     readonly response: unknown;
@@ -1509,4 +1517,4 @@ declare function createServerClient(secretKey: string, options?: Omit<SPAPSConfi
  */
 declare function detectKeyType(key: string): ApiKeyType | null;
 
-export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, type CreateSkillEvalCaseRequest, type CreateSkillEvalGovernanceSnapshotRequest, type CurrentUserProjectAccessParams, type CurrentUserProjectGrantListParams, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type HeaderProvider, type ImportSkillEvalGovernanceOutcomeRequest, type IssueReportAttachmentUploadOptions, type IssueReportListParams, type IssueReportStatusParams, type MarketingEventIngestRequest, type MarketingEventIngestResponse, type MarketingEventType, type MarketingExperimentDecision, type MarketingExperimentEffectDecision, type MarketingExperimentMinSampleDecision, type MarketingExperimentRecommendation, type MarketingExperimentResultsResponse, type MarketingExperimentSrmDecision, type MarketingExperimentSrmStatus, type MarketingExperimentVariantResult, type PermissionCheckResult, PermissionChecker, type RespondToSkillEvalReviewRequest, type RevealSkillEvalEvidenceRequest, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type SPAPSEnvelope, type SkillEvalAccessMode, type SkillEvalActorAccess, type SkillEvalCandidateInput, type SkillEvalCandidateResponse, type SkillEvalCasePolicy, type SkillEvalCaseResponse, type SkillEvalConfidence, type SkillEvalCreateOptions, type SkillEvalDisclosurePolicy, type SkillEvalEligibilitySource, type SkillEvalGovernanceOutcomeResult, type SkillEvalGovernancePurpose, type SkillEvalGovernanceSnapshotResult, type SkillEvalInsight, type SkillEvalInsightsResponse, type SkillEvalModelEffort, type SkillEvalMutationOptions, type SkillEvalPosterResponse, type SkillEvalPosterResponseResult, type SkillEvalRevealField, type SkillEvalRevealResult, type SkillEvalReviewMarkInput, type SkillEvalReviewMarkKind, type SkillEvalReviewResponse, type SkillEvalReviewRoom, type SkillEvalReviewerEligibilityInput, type SkillEvalRewardEvent, type SubmitSkillEvalReviewRequest, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, type X402ExecuteActionOptions, X402PaymentRequiredSDKError, type X402ReceiptListParams, type X402VerifyHandoffOptions, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, isEnvelope, isErrorEnvelope, isSuccessEnvelope, unwrapEnvelope, unwrapNestedData, verifyCryptoWebhookSignature };
+export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, type CreateSkillEvalCaseRequest, type CreateSkillEvalGovernanceSnapshotRequest, type CurrentUserProjectAccessParams, type CurrentUserProjectGrantListParams, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type HeaderProvider, ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES, ISSUE_REPORT_ATTACHMENT_MAX_BYTES, ISSUE_REPORT_ATTACHMENT_MAX_RETAINED, type ImportSkillEvalGovernanceOutcomeRequest, type IssueReportAttachmentMimeType, type IssueReportAttachmentUploadOptions, type IssueReportListParams, type IssueReportStatusParams, type MarketingEventIngestRequest, type MarketingEventIngestResponse, type MarketingEventType, type MarketingExperimentDecision, type MarketingExperimentEffectDecision, type MarketingExperimentMinSampleDecision, type MarketingExperimentRecommendation, type MarketingExperimentResultsResponse, type MarketingExperimentSrmDecision, type MarketingExperimentSrmStatus, type MarketingExperimentVariantResult, type PermissionCheckResult, PermissionChecker, type RespondToSkillEvalReviewRequest, type RevealSkillEvalEvidenceRequest, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type SPAPSEnvelope, type SkillEvalAccessMode, type SkillEvalActorAccess, type SkillEvalCandidateInput, type SkillEvalCandidateResponse, type SkillEvalCasePolicy, type SkillEvalCaseResponse, type SkillEvalConfidence, type SkillEvalCreateOptions, type SkillEvalDisclosurePolicy, type SkillEvalEligibilitySource, type SkillEvalGovernanceOutcomeResult, type SkillEvalGovernancePurpose, type SkillEvalGovernanceSnapshotResult, type SkillEvalInsight, type SkillEvalInsightsResponse, type SkillEvalModelEffort, type SkillEvalMutationOptions, type SkillEvalPosterResponse, type SkillEvalPosterResponseResult, type SkillEvalRevealField, type SkillEvalRevealResult, type SkillEvalReviewMarkInput, type SkillEvalReviewMarkKind, type SkillEvalReviewResponse, type SkillEvalReviewRoom, type SkillEvalReviewerEligibilityInput, type SkillEvalRewardEvent, type SubmitSkillEvalReviewRequest, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, type X402ExecuteActionOptions, X402PaymentRequiredSDKError, type X402ReceiptListParams, type X402VerifyHandoffOptions, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, isEnvelope, isErrorEnvelope, isSuccessEnvelope, unwrapEnvelope, unwrapNestedData, verifyCryptoWebhookSignature };

package/dist/index.js

@@ -196,6 +196,9 @@ var index_exports = {};
 __export(index_exports, {
   DEFAULT_ADMIN_ACCOUNTS: () => DEFAULT_ADMIN_ACCOUNTS,
   FeatureEvaluator: () => FeatureEvaluator,
+  ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES: () => ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES,
+  ISSUE_REPORT_ATTACHMENT_MAX_BYTES: () => ISSUE_REPORT_ATTACHMENT_MAX_BYTES,
+  ISSUE_REPORT_ATTACHMENT_MAX_RETAINED: () => ISSUE_REPORT_ATTACHMENT_MAX_RETAINED,
   PermissionChecker: () => PermissionChecker,
   RoleHierarchy: () => RoleHierarchy,
   SPAPS: () => SPAPSClient,
@@ -523,6 +526,27 @@ function appendSupportedIssueReportScope(q, scope) {
   }
   q.append("scope", scope);
 }
+var ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES = [
+  "image/png",
+  "image/jpeg",
+  "image/webp"
+];
+var ISSUE_REPORT_ATTACHMENT_MAX_BYTES = 10 * 1024 * 1024;
+var ISSUE_REPORT_ATTACHMENT_MAX_RETAINED = 5;
+var ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPE_SET = new Set(
+  ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES
+);
+function assertSupportedIssueReportAttachment(file) {
+  const mimeType = (file.type || "").trim().toLowerCase();
+  if (!ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPE_SET.has(mimeType)) {
+    throw new Error(
+      "SPAPS issue report attachments must be PNG, JPEG, or WebP screenshots"
+    );
+  }
+  if (file.size > ISSUE_REPORT_ATTACHMENT_MAX_BYTES) {
+    throw new Error("SPAPS issue report attachments must be 10 MiB or smaller");
+  }
+}
 var X402PaymentRequiredSDKError = class extends Error {
   paymentRequiredHeader;
   response;
@@ -815,6 +839,7 @@ var SPAPSClient = class _SPAPSClient {
       if (typeof FormData === "undefined") {
         throw new Error("FormData is required to upload issue report attachments");
       }
+      assertSupportedIssueReportAttachment(file);
       const formData = new FormData();
       const fileWithOptionalName = file;
       const inferredFilename = typeof fileWithOptionalName.name === "string" ? fileWithOptionalName.name : void 0;
@@ -2421,6 +2446,9 @@ function detectKeyType(key) {
 0 && (module.exports = {
   DEFAULT_ADMIN_ACCOUNTS,
   FeatureEvaluator,
+  ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES,
+  ISSUE_REPORT_ATTACHMENT_MAX_BYTES,
+  ISSUE_REPORT_ATTACHMENT_MAX_RETAINED,
   PermissionChecker,
   RoleHierarchy,
   SPAPS,

package/dist/index.mjs

@@ -488,6 +488,27 @@ function appendSupportedIssueReportScope(q, scope) {
   }
   q.append("scope", scope);
 }
+var ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES = [
+  "image/png",
+  "image/jpeg",
+  "image/webp"
+];
+var ISSUE_REPORT_ATTACHMENT_MAX_BYTES = 10 * 1024 * 1024;
+var ISSUE_REPORT_ATTACHMENT_MAX_RETAINED = 5;
+var ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPE_SET = new Set(
+  ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES
+);
+function assertSupportedIssueReportAttachment(file) {
+  const mimeType = (file.type || "").trim().toLowerCase();
+  if (!ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPE_SET.has(mimeType)) {
+    throw new Error(
+      "SPAPS issue report attachments must be PNG, JPEG, or WebP screenshots"
+    );
+  }
+  if (file.size > ISSUE_REPORT_ATTACHMENT_MAX_BYTES) {
+    throw new Error("SPAPS issue report attachments must be 10 MiB or smaller");
+  }
+}
 var X402PaymentRequiredSDKError = class extends Error {
   paymentRequiredHeader;
   response;
@@ -780,6 +801,7 @@ var SPAPSClient = class _SPAPSClient {
       if (typeof FormData === "undefined") {
         throw new Error("FormData is required to upload issue report attachments");
       }
+      assertSupportedIssueReportAttachment(file);
       const formData = new FormData();
       const fileWithOptionalName = file;
       const inferredFilename = typeof fileWithOptionalName.name === "string" ? fileWithOptionalName.name : void 0;
@@ -2385,6 +2407,9 @@ function detectKeyType(key) {
 export {
   DEFAULT_ADMIN_ACCOUNTS,
   FeatureEvaluator,
+  ISSUE_REPORT_ATTACHMENT_ALLOWED_MIME_TYPES,
+  ISSUE_REPORT_ATTACHMENT_MAX_BYTES,
+  ISSUE_REPORT_ATTACHMENT_MAX_RETAINED,
   PermissionChecker,
   RoleHierarchy,
   SPAPSClient as SPAPS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spaps-sdk",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "description": "Sweet Potato Authentication & Payment Service SDK - Zero-config client with built-in permission checking, role-based access control, and dayrate scheduling",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -51,7 +51,7 @@
   "dependencies": {
     "axios": "^1.15.1",
     "cross-fetch": "^4.0.0",
-    "spaps-types": "^1.4.2"
+    "spaps-types": "^1.5.0"
   },
   "devDependencies": {
     "@types/node": "^20.10.0",