spaps-sdk 1.6.2 → 1.6.4

package/CHANGELOG.md

@@ -8,6 +8,12 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 
 - No changes yet.
 
+## [1.6.3] - 2026-03-29
+
+### Added
+
+- Added canonical issue-reporting client methods for end-user create, list, detail, status, update, and reply flows.
+
 ## [1.6.1] - 2026-02-16
 
 ### Fixed

package/README.md

@@ -1,38 +1,50 @@
 # spaps-sdk
 
-<a href="https://www.npmjs.com/package/spaps-sdk"><img alt="npm" src="https://img.shields.io/npm/v/spaps-sdk.svg"></a>
-<img alt="node" src="https://img.shields.io/badge/node-%3E%3D14-brightgreen">
-<img alt="types" src="https://img.shields.io/badge/types-TypeScript-blue">
+TypeScript SDK for the Sweet Potato Authentication & Payment Service.
 
-> Sweet Potato Authentication & Payment Service SDK
+## TL;DR
 
-Zero-config client for SPAPS authentication, payments, secure messaging, and admin/product workflows.
+**The Problem**: SPAPS consumers need one client that can speak auth, payments, secure messaging, issue reporting, entitlements, and dayrate APIs without rebuilding request plumbing for every app.
 
-## Quick Facts
+**The Solution**: `spaps-sdk` exposes a typed `SPAPSClient` with source-backed namespaces for the major SPAPS surfaces and a small set of permission helpers for app code.
 
-- Package: `spaps-sdk`
-- Latest version: `1.6.1`
-- Runtime: `Node.js >=14.0.0`
-- Default local API URL: `http://localhost:3301`
+### Why Use `spaps-sdk`?
+
+| Feature | What It Does |
+| --- | --- |
+| Zero-config local mode | Point at `localhost` and the SDK automatically treats it as local mode |
+| Typed namespaces | Use `auth`, `payments`, `sessions`, `secureMessages`, `issueReporting`, `email`, `entitlements`, `dayrate`, `cfo`, and `admin` from one client |
+| Browser and server key support | Configure with `publishableKey`, `secretKey`, or the legacy `apiKey` field |
+| Shared contracts | Re-exports many `spaps-types` definitions so apps can stay on one dependency surface |
 
 ## Metadata
 
 - `package_name`: `spaps-sdk`
-- `latest_version`: `1.6.1`
+- `latest_version`: `1.6.3`
 - `minimum_runtime`: `Node.js >=14.0.0`
 - `api_base_url`: `https://api.sweetpotato.dev`
 
 ## Installation
 
+### npm
+
 ```bash
 npm install spaps-sdk
-# or
-yarn add spaps-sdk
-# or
+```
+
+### pnpm
+
+```bash
 pnpm add spaps-sdk
 ```
 
-## Quick Start
+### yarn
+
+```bash
+yarn add spaps-sdk
+```
+
+## Quick Example
 
 ```typescript
 import { SPAPSClient } from 'spaps-sdk';
@@ -50,71 +62,50 @@ if (spaps.isAuthenticated()) {
 }
 ```
 
-## Compatibility
-
-- Node.js (v14+)
-- Modern browsers
-- TypeScript (types bundled)
-- Next.js and React Native
-
-The SDK includes a `cross-fetch` polyfill for Node environments without native fetch.
-
 ## Configuration
 
-`SPAPSClient` reads config from constructor args first, then environment variables.
-
-- `SPAPS_API_URL` or `NEXT_PUBLIC_SPAPS_API_URL` - API base URL
-- `SPAPS_API_KEY` or `NEXT_PUBLIC_SPAPS_API_KEY` - API key
-
-```bash
-# Node
-export SPAPS_API_URL=https://api.sweetpotato.dev
-export SPAPS_API_KEY=spaps_xxx
+Constructor values win over environment variables.
 
-# Next.js
-NEXT_PUBLIC_SPAPS_API_URL=https://api.sweetpotato.dev
-```
+| Option | Purpose |
+| --- | --- |
+| `apiUrl` | Base API URL. Localhost enables local mode automatically. |
+| `publishableKey` | Browser-safe key for client-side usage |
+| `secretKey` | Server-side key for full access |
+| `apiKey` | Deprecated legacy key field |
+| `timeout` | Override request timeout |
 
-Local mode auto-detection:
+Relevant environment variables:
 
-- If `apiUrl` is omitted or points to `localhost`/`127.0.0.1`, local mode is enabled.
-- In local mode, API key is optional.
+- `SPAPS_API_URL`
+- `NEXT_PUBLIC_SPAPS_API_URL`
+- `SPAPS_API_KEY`
+- `NEXT_PUBLIC_SPAPS_API_KEY`
 
-## API Surface
+## Client Surface
 
-- `auth` and top-level auth helpers: password, wallet, magic link, refresh/logout
-- `sessions`: current/list/validate/revoke/touch
-- `payments`: checkout sessions, products/prices, guest checkout, subscriptions, crypto invoices
-- `secureMessages`: create/list secure messages
-- `email`: send/list templates/get template/preview template
-- `entitlements`: list/check/list by resource
-- `admin`: product and price management helpers
-- `dayrate`, `cfo`: specialized domain helpers
+| Namespace | What It Covers |
+| --- | --- |
+| `auth` | Password, wallet, magic-link, refresh, and logout flows |
+| `payments` | Checkout sessions, products, prices, subscriptions, and crypto payment helpers |
+| `sessions` | Current session lookup, validation, revocation, and session lifecycle helpers |
+| `secureMessages` | Create and list secure messages |
+| `issueReporting` | Status, history, create, edit, and reply issue-report flows |
+| `email` | Template lookup, previews, and sends |
+| `entitlements` | User and resource entitlement queries |
+| `dayrate` | Availability and booking helpers |
+| `admin` | Product and pricing admin helpers |
+| `cfo` | CFO-specific endpoints |
 
-## Permission Utilities
+## Common Flows
 
-```typescript
-import { isAdminAccount, canAccessAdmin, getUserRole } from 'spaps-sdk';
-
-const isAdmin = isAdminAccount('buildooor@gmail.com');
-const role = getUserRole('user@example.com');
-const adminCheck = canAccessAdmin({ id: 'u1', email: 'user@example.com' });
-
-if (adminCheck.allowed) {
-  // render admin UI
-}
-```
-
-See [PERMISSIONS.md](./PERMISSIONS.md) for React-oriented examples.
-
-## Secure Messaging
+### Typed Secure Messaging
 
 ```typescript
 type SecureMessageMetadata = { urgency: 'low' | 'high'; tags?: string[] };
 
 const spaps = new SPAPSClient<SecureMessageMetadata>({
   apiUrl: 'https://api.sweetpotato.dev',
-  apiKey: process.env.SPAPS_API_KEY,
+  secretKey: process.env.SPAPS_API_KEY,
 });
 
 await spaps.secureMessages.create({
@@ -125,59 +116,113 @@ await spaps.secureMessages.create({
 });
 ```
 
-## Admin API Methods
+### Shared Issue Reporting
 
 ```typescript
-await spaps.admin.createProduct({
-  name: 'Premium Plan',
-  category: 'subscription',
-  description: 'Advanced features',
-});
+spaps.setAccessToken('jwt-token');
+
+const summary = await spaps.issueReporting.getStatus();
+const history = await spaps.issueReporting.list({ status: 'open' });
+
+if (!summary.has_open && history.total === 0) {
+  await spaps.issueReporting.create({
+    target: {
+      component_key: 'patient_protocol_widget',
+      component_label: 'Patient Protocol Widget',
+      page_url: '/patients/123/protocol',
+      metadata: { section: 'daily log' },
+    },
+    note: 'The save action silently fails after I edit today.',
+    reporter_role_hint: 'practitioner',
+  });
+}
+```
 
-await spaps.admin.updateProduct('prod_123', { name: 'Premium Plan Pro' });
+### Permission Utilities
 
-await spaps.admin.createPrice({
-  product_id: 'prod_123',
-  unit_amount: 2999,
-  currency: 'usd',
-  interval: 'month',
-});
+```typescript
+import { canAccessAdmin, getUserRole, isAdminAccount } from 'spaps-sdk';
+
+const role = getUserRole('user@example.com');
+const adminCheck = canAccessAdmin({ id: 'user_123', email: 'buildooor@gmail.com' });
+const isAdmin = isAdminAccount('buildooor@gmail.com');
+
+console.log(role, adminCheck.allowed, isAdmin);
 ```
 
-## Helper Methods
+### Helper Methods
 
 ```typescript
-spaps.isAuthenticated(); // boolean
-spaps.getAccessToken(); // string | undefined
+const spaps = new SPAPSClient({ apiUrl: 'http://localhost:3301' });
+
+spaps.isLocalMode();
+spaps.isAuthenticated();
+spaps.getAccessToken();
 spaps.setAccessToken('token');
-spaps.isLocalMode(); // boolean
 await spaps.health();
 ```
 
-## Troubleshooting
-
-- `401 Unauthorized`: ensure valid access token and API key for non-local mode.
-- `403 Forbidden`: account lacks admin role for admin endpoints.
-- Local mode confusion: call `spaps.isLocalMode()` and verify `apiUrl`.
-
 ## Development
 
-From repository root:
-
 ```bash
 cd packages/sdk
 npm ci
 npm run build
+npm run typecheck:readme
+npm run test:readme
 npm run test
+```
+
+## Troubleshooting
+
+### `401 Unauthorized`
+
+Check the access token and key configuration for the environment you are targeting.
+
+### Local mode is not activating
+
+Use a localhost URL such as `http://localhost:3301`, or call `spaps.isLocalMode()` to confirm how the SDK resolved the environment.
+
+### Browser app needs limited access
+
+Use `publishableKey` instead of a server-side secret key.
+
+## Limitations
+
+- The SDK wraps the current SPAPS surface; it is not an exhaustive code-generated client for every backend route.
+- Some admin and entitlement flows still depend on upstream permissions and token context.
+- The legacy `apiKey` constructor field still exists for compatibility, but new integrations should prefer the explicit key fields.
+
+## FAQ
+
+### Does this work in browsers?
+
+Yes. The package is designed for both browser and server-side usage.
+
+### Does it include fetch polyfills?
+
+Yes. It loads `cross-fetch/polyfill` when `fetch` is unavailable.
+
+### Can I use it without TypeScript?
+
+Yes. The runtime works in JavaScript projects and ships bundled type declarations for TS users.
+
+### Does it re-export shared types?
+
+Yes. Many `spaps-types` exports are re-exported for convenience.
+
+### How do I validate README-related examples?
+
+Run:
+
+```bash
 npm run typecheck:readme
 npm run test:readme
 ```
 
-## Release
+## About Contributions
 
-- Main publish flow: `.github/workflows/publish.yml` (`publish-sdk` job).
-- Manual publish flow: `.github/workflows/npm-publish-manual.yml`.
-- npm credential source: repository secret `NPM_TOKEN`.
+*About Contributions:* Please don't take this the wrong way, but I do not accept outside contributions for any of my projects. I simply don't have the mental bandwidth to review anything, and it's my name on the thing, so I'm responsible for any problems it causes; thus, the risk-reward is highly asymmetric from my perspective. I'd also have to worry about other "stakeholders," which seems unwise for tools I mostly make for myself for free. Feel free to submit issues, and even PRs if you want to illustrate a proposed fix, but know I won't merge them directly. Instead, I'll have Claude or Codex review submissions via `gh` and independently decide whether and how to address them. Bug reports in particular are welcome. Sorry if this offends, but I want to avoid wasted time and hurt feelings. I understand this isn't in sync with the prevailing open-source ethos that seeks community contributions, but it's the only way I can move at this velocity and keep my sanity.
 
 ## License
 

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import * as spaps_types from 'spaps-types';
-import { ResourceType, Entitlement, CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, DayrateAvailabilityResponse, DayrateBookingRequest, DayrateBookingResponse, DayrateMultiBookingRequest, DayrateMultiBookingResponse, Subscription, UsageBalance, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
-export { AdminPermission, AdminRole, AdminUser, ApiResponse, AuthResponse, CheckoutSession, CreateCryptoInvoiceRequest, CreatePriceRequest, CreateProductRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, DayrateAvailabilityResponse, DayrateAvailableSlot, DayrateBookingRequest, DayrateBookingResponse, DayrateDayOfWeek, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayratePriceBreakdown, DayrateSlotType, Entitlement, Price, Product, ProductSyncResult, ResourceType, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateProductRequest, UsageBalance, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, createSecureMessageRequestSchema, secureMessageMetadataSchema, secureMessageSchema } from 'spaps-types';
+import { ResourceType, Entitlement, CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, IssueReportStatusResult, IssueReportStatus, IssueReportListResult, IssueReport, CreateIssueReportRequest, UpdateIssueReportRequest, ReplyIssueReportRequest, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, DayrateAvailabilityResponse, DayrateBookingRequest, DayrateBookingResponse, DayrateMultiBookingRequest, DayrateMultiBookingResponse, Subscription, UsageBalance, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
+export { AdminPermission, AdminRole, AdminUser, ApiResponse, AuthResponse, CheckoutSession, CreateCryptoInvoiceRequest, CreateIssueReportRequest, CreatePriceRequest, CreateProductRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, DayrateAvailabilityResponse, DayrateAvailableSlot, DayrateBookingRequest, DayrateBookingResponse, DayrateDayOfWeek, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayratePriceBreakdown, DayrateSlotType, Entitlement, IssueReport, IssueReportListResult, IssueReportStatus, IssueReportStatusResult, IssueReportTarget, LinkedIssueReportCase, Price, Product, ProductSyncResult, ReplyIssueReportRequest, ResourceType, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateIssueReportRequest, UpdateProductRequest, UsageBalance, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, createSecureMessageRequestSchema, secureMessageMetadataSchema, secureMessageSchema } from 'spaps-types';
 
 /**
  * Permission checking utilities for SPAPS SDK
@@ -344,6 +344,11 @@ interface EntitlementCheckResult {
     /** The matching entitlement, if any */
     entitlement?: Entitlement;
 }
+interface IssueReportListParams {
+    status?: IssueReportStatus;
+    limit?: number;
+    offset?: number;
+}
 
 declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Record<string, any>> {
     private client;
@@ -429,6 +434,35 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
          */
         listByResource: (resourceType: ResourceType, resourceId?: string) => Promise<Entitlement[]>;
     };
+    /**
+     * Issue reporting namespace for authenticated end-user issue flows.
+     */
+    issueReporting: {
+        /**
+         * Return canonical issue-report summary for the shared floating entrypoint.
+         */
+        getStatus: () => Promise<IssueReportStatusResult>;
+        /**
+         * List the caller's issue reports inside the active application scope.
+         */
+        list: (params?: IssueReportListParams) => Promise<IssueReportListResult>;
+        /**
+         * Hydrate one canonical issue report by ID.
+         */
+        get: (issueReportId: string) => Promise<IssueReport>;
+        /**
+         * Create a new canonical issue report.
+         */
+        create: (payload: CreateIssueReportRequest) => Promise<IssueReport>;
+        /**
+         * Update the note for an unresolved issue report.
+         */
+        update: (issueReportId: string, payload: UpdateIssueReportRequest) => Promise<IssueReport>;
+        /**
+         * Reply to a resolved or ignored issue report and reopen the linked case.
+         */
+        reply: (issueReportId: string, payload: ReplyIssueReportRequest) => Promise<IssueReport>;
+    };
     constructor(config?: SPAPSConfig);
     /** Raw API request helper that returns an ApiResponse-like shape */
     request<T = any>(method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH', url: string, data?: any, requiresAuth?: boolean): Promise<{
@@ -895,4 +929,4 @@ declare function createServerClient(secretKey: string, options?: Omit<SPAPSConfi
  */
 declare function detectKeyType(key: string): ApiKeyType | null;
 
-export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type PermissionCheckResult, PermissionChecker, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, verifyCryptoWebhookSignature };
+export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type IssueReportListParams, type PermissionCheckResult, PermissionChecker, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, verifyCryptoWebhookSignature };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import * as spaps_types from 'spaps-types';
-import { ResourceType, Entitlement, CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, DayrateAvailabilityResponse, DayrateBookingRequest, DayrateBookingResponse, DayrateMultiBookingRequest, DayrateMultiBookingResponse, Subscription, UsageBalance, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
-export { AdminPermission, AdminRole, AdminUser, ApiResponse, AuthResponse, CheckoutSession, CreateCryptoInvoiceRequest, CreatePriceRequest, CreateProductRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, DayrateAvailabilityResponse, DayrateAvailableSlot, DayrateBookingRequest, DayrateBookingResponse, DayrateDayOfWeek, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayratePriceBreakdown, DayrateSlotType, Entitlement, Price, Product, ProductSyncResult, ResourceType, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateProductRequest, UsageBalance, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, createSecureMessageRequestSchema, secureMessageMetadataSchema, secureMessageSchema } from 'spaps-types';
+import { ResourceType, Entitlement, CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, IssueReportStatusResult, IssueReportStatus, IssueReportListResult, IssueReport, CreateIssueReportRequest, UpdateIssueReportRequest, ReplyIssueReportRequest, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, DayrateAvailabilityResponse, DayrateBookingRequest, DayrateBookingResponse, DayrateMultiBookingRequest, DayrateMultiBookingResponse, Subscription, UsageBalance, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
+export { AdminPermission, AdminRole, AdminUser, ApiResponse, AuthResponse, CheckoutSession, CreateCryptoInvoiceRequest, CreateIssueReportRequest, CreatePriceRequest, CreateProductRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, DayrateAvailabilityResponse, DayrateAvailableSlot, DayrateBookingRequest, DayrateBookingResponse, DayrateDayOfWeek, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayratePriceBreakdown, DayrateSlotType, Entitlement, IssueReport, IssueReportListResult, IssueReportStatus, IssueReportStatusResult, IssueReportTarget, LinkedIssueReportCase, Price, Product, ProductSyncResult, ReplyIssueReportRequest, ResourceType, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateIssueReportRequest, UpdateProductRequest, UsageBalance, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, createSecureMessageRequestSchema, secureMessageMetadataSchema, secureMessageSchema } from 'spaps-types';
 
 /**
  * Permission checking utilities for SPAPS SDK
@@ -344,6 +344,11 @@ interface EntitlementCheckResult {
     /** The matching entitlement, if any */
     entitlement?: Entitlement;
 }
+interface IssueReportListParams {
+    status?: IssueReportStatus;
+    limit?: number;
+    offset?: number;
+}
 
 declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Record<string, any>> {
     private client;
@@ -429,6 +434,35 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
          */
         listByResource: (resourceType: ResourceType, resourceId?: string) => Promise<Entitlement[]>;
     };
+    /**
+     * Issue reporting namespace for authenticated end-user issue flows.
+     */
+    issueReporting: {
+        /**
+         * Return canonical issue-report summary for the shared floating entrypoint.
+         */
+        getStatus: () => Promise<IssueReportStatusResult>;
+        /**
+         * List the caller's issue reports inside the active application scope.
+         */
+        list: (params?: IssueReportListParams) => Promise<IssueReportListResult>;
+        /**
+         * Hydrate one canonical issue report by ID.
+         */
+        get: (issueReportId: string) => Promise<IssueReport>;
+        /**
+         * Create a new canonical issue report.
+         */
+        create: (payload: CreateIssueReportRequest) => Promise<IssueReport>;
+        /**
+         * Update the note for an unresolved issue report.
+         */
+        update: (issueReportId: string, payload: UpdateIssueReportRequest) => Promise<IssueReport>;
+        /**
+         * Reply to a resolved or ignored issue report and reopen the linked case.
+         */
+        reply: (issueReportId: string, payload: ReplyIssueReportRequest) => Promise<IssueReport>;
+    };
     constructor(config?: SPAPSConfig);
     /** Raw API request helper that returns an ApiResponse-like shape */
     request<T = any>(method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH', url: string, data?: any, requiresAuth?: boolean): Promise<{
@@ -895,4 +929,4 @@ declare function createServerClient(secretKey: string, options?: Omit<SPAPSConfi
  */
 declare function detectKeyType(key: string): ApiKeyType | null;
 
-export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type PermissionCheckResult, PermissionChecker, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, verifyCryptoWebhookSignature };
+export { type AdminConfig, type ApiKeyType, type CheckoutLineItem, type CheckoutLineItemPriceData, type CreateCheckoutSessionPayload, DEFAULT_ADMIN_ACCOUNTS, type EmailSendOptions, type EmailSendResult, type EmailTemplate, type EmailTemplatePreview, type EntitlementCheckResult, type EntitlementListParams, type FeatureContext, type FeatureDefinition, FeatureEvaluator, type IssueReportListParams, type PermissionCheckResult, PermissionChecker, RoleHierarchy, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, type TemplateVariable, TokenManager, WalletUtils, WebSocketAuthHelper, type WebSocketAuthHelperConfig, canAccessAdmin, createBrowserClient, createPermissionChecker, createServerClient, SPAPSClient as default, defaultPermissionChecker, detectKeyType, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, verifyCryptoWebhookSignature };

package/dist/index.js

@@ -630,6 +630,79 @@ var SPAPSClient = class {
       return payload;
     }
   };
+  /**
+   * Issue reporting namespace for authenticated end-user issue flows.
+   */
+  issueReporting = {
+    /**
+     * Return canonical issue-report summary for the shared floating entrypoint.
+     */
+    getStatus: async () => {
+      const res = await this.client.get(
+        "/api/v1/issue-reports/status",
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to get issue report status");
+    },
+    /**
+     * List the caller's issue reports inside the active application scope.
+     */
+    list: async (params) => {
+      const q = new URLSearchParams();
+      if (params?.status) q.append("status", params.status);
+      if (params?.limit !== void 0) q.append("limit", String(params.limit));
+      if (params?.offset !== void 0) q.append("offset", String(params.offset));
+      const qs = q.toString();
+      const res = await this.client.get(
+        `/api/v1/issue-reports${qs ? `?${qs}` : ""}`,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to list issue reports");
+    },
+    /**
+     * Hydrate one canonical issue report by ID.
+     */
+    get: async (issueReportId) => {
+      const res = await this.client.get(
+        `/api/v1/issue-reports/${issueReportId}`,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to get issue report");
+    },
+    /**
+     * Create a new canonical issue report.
+     */
+    create: async (payload) => {
+      const res = await this.client.post(
+        "/api/v1/issue-reports",
+        payload,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to create issue report");
+    },
+    /**
+     * Update the note for an unresolved issue report.
+     */
+    update: async (issueReportId, payload) => {
+      const res = await this.client.patch(
+        `/api/v1/issue-reports/${issueReportId}`,
+        payload,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to update issue report");
+    },
+    /**
+     * Reply to a resolved or ignored issue report and reopen the linked case.
+     */
+    reply: async (issueReportId, payload) => {
+      const res = await this.client.post(
+        `/api/v1/issue-reports/${issueReportId}/replies`,
+        payload,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to reply to issue report");
+    }
+  };
   constructor(config = {}) {
     const apiUrl = config.apiUrl || process.env.SPAPS_API_URL || process.env.NEXT_PUBLIC_SPAPS_API_URL;
     const isBrowser = typeof window !== "undefined";

package/dist/index.mjs

@@ -600,6 +600,79 @@ var SPAPSClient = class {
       return payload;
     }
   };
+  /**
+   * Issue reporting namespace for authenticated end-user issue flows.
+   */
+  issueReporting = {
+    /**
+     * Return canonical issue-report summary for the shared floating entrypoint.
+     */
+    getStatus: async () => {
+      const res = await this.client.get(
+        "/api/v1/issue-reports/status",
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to get issue report status");
+    },
+    /**
+     * List the caller's issue reports inside the active application scope.
+     */
+    list: async (params) => {
+      const q = new URLSearchParams();
+      if (params?.status) q.append("status", params.status);
+      if (params?.limit !== void 0) q.append("limit", String(params.limit));
+      if (params?.offset !== void 0) q.append("offset", String(params.offset));
+      const qs = q.toString();
+      const res = await this.client.get(
+        `/api/v1/issue-reports${qs ? `?${qs}` : ""}`,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to list issue reports");
+    },
+    /**
+     * Hydrate one canonical issue report by ID.
+     */
+    get: async (issueReportId) => {
+      const res = await this.client.get(
+        `/api/v1/issue-reports/${issueReportId}`,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to get issue report");
+    },
+    /**
+     * Create a new canonical issue report.
+     */
+    create: async (payload) => {
+      const res = await this.client.post(
+        "/api/v1/issue-reports",
+        payload,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to create issue report");
+    },
+    /**
+     * Update the note for an unresolved issue report.
+     */
+    update: async (issueReportId, payload) => {
+      const res = await this.client.patch(
+        `/api/v1/issue-reports/${issueReportId}`,
+        payload,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to update issue report");
+    },
+    /**
+     * Reply to a resolved or ignored issue report and reopen the linked case.
+     */
+    reply: async (issueReportId, payload) => {
+      const res = await this.client.post(
+        `/api/v1/issue-reports/${issueReportId}/replies`,
+        payload,
+        this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0
+      );
+      return this.unwrapApiResponse(res, "Failed to reply to issue report");
+    }
+  };
   constructor(config = {}) {
     const apiUrl = config.apiUrl || process.env.SPAPS_API_URL || process.env.NEXT_PUBLIC_SPAPS_API_URL;
     const isBrowser = typeof window !== "undefined";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spaps-sdk",
-  "version": "1.6.2",
+  "version": "1.6.4",
   "description": "Sweet Potato Authentication & Payment Service SDK - Zero-config client with built-in permission checking, role-based access control, and dayrate scheduling",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -50,7 +50,7 @@
   "dependencies": {
     "axios": "^1.6.0",
     "cross-fetch": "^4.0.0",
-    "spaps-types": "^1.1.0"
+    "spaps-types": "^1.1.1"
   },
   "devDependencies": {
     "@types/node": "^20.10.0",