@proveanything/smartlinks 1.15.13 → 1.15.15

package/dist/api/authKit.d.ts

@@ -20,15 +20,28 @@ export declare namespace authKit {
      *   fresh challenge — `login()` just returns `MFA_REQUIRED` again, no special handling.
      */
     function login(clientId: string, email: string, password: string, trustedDeviceToken?: string): Promise<AuthLoginResponse>;
-    /** Register a new user (public). */
+    /**
+     * Register a new user (public).
+     *
+     * Not gated by step-up MFA — a brand-new user has no enrolled factors yet, so there's
+     * nothing to challenge against.
+     */
     function register(clientId: string, data: {
         email: string;
         password: string;
         displayName?: string;
         accountData?: Record<string, any>;
     }): Promise<AuthLoginResponse>;
-    /** Google OAuth login via ID token (public). */
-    function googleLogin(clientId: string, idToken: string): Promise<AuthLoginResponse>;
+    /**
+     * Google OAuth login via ID token (public).
+     *
+     * Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape.
+     *
+     * @param trustedDeviceToken - Optional. Pass a token previously returned by
+     *   {@link mfaChallengeVerify}/{@link mfaRecoveryCode} (with `trustDevice: true`) to skip
+     *   the challenge on this device, same as {@link login}.
+     */
+    function googleLogin(clientId: string, idToken: string, trustedDeviceToken?: string): Promise<AuthLoginResponse>;
     /** Google OAuth login via server-side authorization code (public). */
     function googleCodeLogin(clientId: string, code: string, redirectUri: string): Promise<AuthLoginResponse>;
     /**
@@ -46,6 +59,9 @@ export declare namespace authKit {
      *   then link Apple from settings. **The same 409 can now come back from
      *   {@link googleLogin}** under the shared verified-to-verified linking policy.
      *
+     * Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape. Pass
+     * `opts.trustedDeviceToken` to skip the challenge on a recognized device.
+     *
      * @see AppleLoginOptions
      */
     function appleLogin(clientId: string, identityToken: string, opts?: AppleLoginOptions): Promise<AuthLoginResponse>;
@@ -84,20 +100,46 @@ export declare namespace authKit {
         redirectUrl: string;
         accountData?: Record<string, any>;
     }): Promise<MagicLinkSendResponse>;
-    /** Verify a magic link token and authenticate/create the user (public). */
-    function verifyMagicLink(clientId: string, token: string): Promise<MagicLinkVerifyResponse>;
+    /**
+     * Verify a magic link token and authenticate/create the user (public).
+     *
+     * Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape.
+     *
+     * @param trustedDeviceToken - Optional. See {@link login}.
+     */
+    function verifyMagicLink(clientId: string, token: string, trustedDeviceToken?: string): Promise<MagicLinkVerifyResponse>;
     /** Send phone verification code (public). */
     function sendPhoneCode(clientId: string, phoneNumber: string): Promise<PhoneSendCodeResponse>;
-    /** Verify phone verification code (public). */
-    function verifyPhoneCode(clientId: string, phoneNumber: string, code: string): Promise<PhoneVerifyResponse>;
+    /**
+     * Verify phone verification code (public).
+     *
+     * Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape.
+     *
+     * @param trustedDeviceToken - Optional. See {@link login}.
+     */
+    function verifyPhoneCode(clientId: string, phoneNumber: string, code: string, trustedDeviceToken?: string): Promise<PhoneVerifyResponse>;
     /** Send a WhatsApp verification deep-link (public). */
     function sendWhatsApp(clientId: string, body?: SendWhatsAppRequest): Promise<SendWhatsAppResponse>;
-    /** Manually verify WhatsApp token if inbound webhook path is unavailable (legacy/public fallback). */
+    /**
+     * Manually verify WhatsApp token if inbound webhook path is unavailable (legacy/public fallback).
+     *
+     * Not gated by step-up MFA — this endpoint only confirms the code, it never issues a
+     * session/bearer token, so there is nothing to challenge. {@link exchangeWhatsAppSession}
+     * is the WhatsApp method that's gated.
+     */
     function verifyWhatsApp(clientId: string, token: string, phoneNumber: string): Promise<VerifyWhatsAppResponse>;
     /** Poll WhatsApp verification status for a token (public). */
     function getWhatsAppStatus(clientId: string, token: string): Promise<WhatsAppStatusResponse>;
-    /** Exchange a verified WhatsApp token for an Auth Kit session (public). */
-    function exchangeWhatsAppSession(clientId: string, token: string, sessionKey: string): Promise<ExchangeWhatsAppSessionResponse>;
+    /**
+     * Exchange a verified WhatsApp token for an Auth Kit session (public).
+     *
+     * Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape. This is
+     * the WhatsApp method that needs `trustedDeviceToken`, not {@link verifyWhatsApp} (which
+     * never issues a session).
+     *
+     * @param trustedDeviceToken - Optional. See {@link login}.
+     */
+    function exchangeWhatsAppSession(clientId: string, token: string, sessionKey: string, trustedDeviceToken?: string): Promise<ExchangeWhatsAppSessionResponse>;
     /** Send an SMS click-to-verify link (public). */
     function sendSmsVerify(clientId: string, body: SendSmsVerifyRequest): Promise<SendSmsVerifyResponse>;
     /** Verify an SMS click-to-verify token via API (public). */

package/dist/api/authKit.js

@@ -35,14 +35,27 @@ export var authKit;
         return res;
     }
     authKit.login = login;
-    /** Register a new user (public). */
+    /**
+     * Register a new user (public).
+     *
+     * Not gated by step-up MFA — a brand-new user has no enrolled factors yet, so there's
+     * nothing to challenge against.
+     */
     async function register(clientId, data) {
         return post(`/authkit/${encodeURIComponent(clientId)}/auth/register`, data);
     }
     authKit.register = register;
-    /** Google OAuth login via ID token (public). */
-    async function googleLogin(clientId, idToken) {
-        const res = await post(`/authkit/${encodeURIComponent(clientId)}/auth/google`, { idToken });
+    /**
+     * Google OAuth login via ID token (public).
+     *
+     * Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape.
+     *
+     * @param trustedDeviceToken - Optional. Pass a token previously returned by
+     *   {@link mfaChallengeVerify}/{@link mfaRecoveryCode} (with `trustDevice: true`) to skip
+     *   the challenge on this device, same as {@link login}.
+     */
+    async function googleLogin(clientId, idToken, trustedDeviceToken) {
+        const res = await post(`/authkit/${encodeURIComponent(clientId)}/auth/google`, { idToken, trustedDeviceToken });
         if (res.token) {
             setBearerToken(res.token);
             invalidateCache();
@@ -75,6 +88,9 @@ export var authKit;
      *   then link Apple from settings. **The same 409 can now come back from
      *   {@link googleLogin}** under the shared verified-to-verified linking policy.
      *
+     * Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape. Pass
+     * `opts.trustedDeviceToken` to skip the challenge on a recognized device.
+     *
      * @see AppleLoginOptions
      */
     async function appleLogin(clientId, identityToken, opts) {
@@ -138,9 +154,15 @@ export var authKit;
         return post(`/authkit/${encodeURIComponent(clientId)}/auth/magic-link/send`, data);
     }
     authKit.sendMagicLink = sendMagicLink;
-    /** Verify a magic link token and authenticate/create the user (public). */
-    async function verifyMagicLink(clientId, token) {
-        const res = await post(`/authkit/${encodeURIComponent(clientId)}/auth/magic-link/verify`, { token });
+    /**
+     * Verify a magic link token and authenticate/create the user (public).
+     *
+     * Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape.
+     *
+     * @param trustedDeviceToken - Optional. See {@link login}.
+     */
+    async function verifyMagicLink(clientId, token, trustedDeviceToken) {
+        const res = await post(`/authkit/${encodeURIComponent(clientId)}/auth/magic-link/verify`, { token, trustedDeviceToken });
         if (res.token) {
             setBearerToken(res.token);
             invalidateCache();
@@ -153,9 +175,15 @@ export var authKit;
         return post(`/authkit/${encodeURIComponent(clientId)}/auth/phone/send-code`, { phoneNumber });
     }
     authKit.sendPhoneCode = sendPhoneCode;
-    /** Verify phone verification code (public). */
-    async function verifyPhoneCode(clientId, phoneNumber, code) {
-        const res = await post(`/authkit/${encodeURIComponent(clientId)}/auth/phone/verify`, { phoneNumber, code });
+    /**
+     * Verify phone verification code (public).
+     *
+     * Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape.
+     *
+     * @param trustedDeviceToken - Optional. See {@link login}.
+     */
+    async function verifyPhoneCode(clientId, phoneNumber, code, trustedDeviceToken) {
+        const res = await post(`/authkit/${encodeURIComponent(clientId)}/auth/phone/verify`, { phoneNumber, code, trustedDeviceToken });
         setBearerToken(res.token);
         invalidateCache();
         return res;
@@ -166,7 +194,13 @@ export var authKit;
         return post(`/authkit/${encodeURIComponent(clientId)}/auth/whatsapp/send`, body);
     }
     authKit.sendWhatsApp = sendWhatsApp;
-    /** Manually verify WhatsApp token if inbound webhook path is unavailable (legacy/public fallback). */
+    /**
+     * Manually verify WhatsApp token if inbound webhook path is unavailable (legacy/public fallback).
+     *
+     * Not gated by step-up MFA — this endpoint only confirms the code, it never issues a
+     * session/bearer token, so there is nothing to challenge. {@link exchangeWhatsAppSession}
+     * is the WhatsApp method that's gated.
+     */
     async function verifyWhatsApp(clientId, token, phoneNumber) {
         return post(`/authkit/${encodeURIComponent(clientId)}/auth/whatsapp/verify`, { token, phoneNumber });
     }
@@ -177,9 +211,17 @@ export var authKit;
         return request(`/authkit/${encodeURIComponent(clientId)}/auth/whatsapp/status?token=${encodedToken}`);
     }
     authKit.getWhatsAppStatus = getWhatsAppStatus;
-    /** Exchange a verified WhatsApp token for an Auth Kit session (public). */
-    async function exchangeWhatsAppSession(clientId, token, sessionKey) {
-        const res = await post(`/authkit/${encodeURIComponent(clientId)}/auth/whatsapp/exchange-session`, { token, sessionKey });
+    /**
+     * Exchange a verified WhatsApp token for an Auth Kit session (public).
+     *
+     * Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape. This is
+     * the WhatsApp method that needs `trustedDeviceToken`, not {@link verifyWhatsApp} (which
+     * never issues a session).
+     *
+     * @param trustedDeviceToken - Optional. See {@link login}.
+     */
+    async function exchangeWhatsAppSession(clientId, token, sessionKey, trustedDeviceToken) {
+        const res = await post(`/authkit/${encodeURIComponent(clientId)}/auth/whatsapp/exchange-session`, { token, sessionKey, trustedDeviceToken });
         setBearerToken(res.token);
         invalidateCache();
         return res;

package/dist/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 1.15.13  |  Generated: 2026-07-27T08:21:16.504Z
+Version: 1.15.15  |  Generated: 2026-07-29T17:46:34.198Z
 
 This is a concise summary of all available API functions and types.
 
@@ -170,6 +170,9 @@ Replace or augment globally applied custom headers.
 **setBearerToken**(token: string | undefined) → `void`
 Allows setting the bearerToken at runtime (e.g. after login/logout). Clears the HTTP cache whenever the token actually changes so that stale user-scoped responses (e.g. /account/profile) are not served after a login or logout event.
 
+**getBearerToken**() → `string | undefined`
+Returns the bearer token currently held by the SDK, or `undefined` if none is set. In proxy mode, credentials are held by the parent frame, not the local SDK, so this returns `undefined` even when the caller is authenticated.
+
 **getBaseURL**() → `string | null`
 Get the currently configured API base URL. Returns null if initializeApi() has not been called yet.
 
@@ -3104,6 +3107,10 @@ interface AppleLoginOptions {
   * these again, and never inside the token. Forwarded so the server can persist the
   * display name on first account creation. Treated as untrusted (never used for identity).
   userInfo?: { email?: string; name?: string }
+  * A previously-issued trusted-device token (from a prior MFA `challenge/verify`
+  * or `challenge/recovery-code` response). If still valid, the server skips any
+  * step-up challenge for this login. See `SDK_AUTHKIT_MFA_UPDATE.md` §3.
+  trustedDeviceToken?: string
 }
 ```
 
@@ -3778,6 +3785,21 @@ interface Collection {
   portalUrl?: string // URL for the collection's portal (if applicable)
   allowAutoGenerateClaims?: boolean
   defaultAuthKitId: string // default auth kit for this collection, used for auth
+  admin?: {
+  * Redirect behavior for plain collection-level scans (a short link with
+  * no product/serial code in the path, e.g. `https://.../c/shortId`).
+  * Unset means such links always go to the normal collection page.
+  redirect?: CollectionRedirectConfig
+  }
+}
+```
+
+**CollectionRedirectConfig** (interface)
+```typescript
+interface CollectionRedirectConfig {
+  mode: 'fixed' | 'dynamic' | 'deep'
+  url?: string
+  template?: string
 }
 ```
 
@@ -8620,16 +8642,16 @@ Gets current account information for the logged in user. Returns user, owner, ac
 Login with email + password (public). When the client's MFA policy requires a step-up, the server returns **403 `MFA_REQUIRED`** instead of a session — `login()` throws a `SmartlinksApiError` with `err.errorResponse?.errorCode === 'MFA_REQUIRED'` and the challenge details in `err.details` (see {@link MfaRequiredDetails}). Route the caller to {@link mfaChallengeSend} on that error; this method's return type is unchanged. returned one (via {@link mfaChallengeVerify}/{@link mfaRecoveryCode} with `trustDevice: true`), pass it here to skip the challenge entirely as long as it's still valid. If it's revoked/expired, the server silently falls back to requiring a fresh challenge — `login()` just returns `MFA_REQUIRED` again, no special handling.
 
 **register**(clientId: string, data: { email: string; password: string; displayName?: string; accountData?: Record<string, any> }) → `Promise<AuthLoginResponse>`
-Register a new user (public).
+Register a new user (public). Not gated by step-up MFA — a brand-new user has no enrolled factors yet, so there's nothing to challenge against.
 
-**googleLogin**(clientId: string, idToken: string) → `Promise<AuthLoginResponse>`
-Google OAuth login via ID token (public).
+**googleLogin**(clientId: string, idToken: string, trustedDeviceToken?: string) → `Promise<AuthLoginResponse>`
+Google OAuth login via ID token (public). Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape. {@link mfaChallengeVerify}/{@link mfaRecoveryCode} (with `trustDevice: true`) to skip the challenge on this device, same as {@link login}.
 
 **googleCodeLogin**(clientId: string, code: string, redirectUri: string) → `Promise<AuthLoginResponse>`
 Google OAuth login via server-side authorization code (public).
 
 **appleLogin**(clientId: string, identityToken: string, opts?: AppleLoginOptions) → `Promise<AuthLoginResponse>`
-Sign in with Apple via an Apple identity token (public). Mirrors {@link googleLogin}. On success the returned bearer token is stored automatically and the cache is invalidated. Notable error codes (thrown as `SmartlinksApiError`, read via `err.errorCode`): - `MISSING_APPLE_TOKEN` (400), `APPLE_AUTH_NOT_CONFIGURED` (400), `INVALID_APPLE_TOKEN` (401), `APPLE_AUTH_FAILED` (500) - `ACCOUNT_EXISTS_UNVERIFIED` (409) — an unverified account already owns this email; the server refuses to silently link. `err.details.requiresEmailVerification` is `true`. Recoverable: the user should sign in with their password (or reset it), then link Apple from settings. **The same 409 can now come back from {@link googleLogin}** under the shared verified-to-verified linking policy.
+Sign in with Apple via an Apple identity token (public). Mirrors {@link googleLogin}. On success the returned bearer token is stored automatically and the cache is invalidated. Notable error codes (thrown as `SmartlinksApiError`, read via `err.errorCode`): - `MISSING_APPLE_TOKEN` (400), `APPLE_AUTH_NOT_CONFIGURED` (400), `INVALID_APPLE_TOKEN` (401), `APPLE_AUTH_FAILED` (500) - `ACCOUNT_EXISTS_UNVERIFIED` (409) — an unverified account already owns this email; the server refuses to silently link. `err.details.requiresEmailVerification` is `true`. Recoverable: the user should sign in with their password (or reset it), then link Apple from settings. **The same 409 can now come back from {@link googleLogin}** under the shared verified-to-verified linking policy. Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape. Pass `opts.trustedDeviceToken` to skip the challenge on a recognized device.
 
 **refreshToken**(clientId: string, refreshToken: string) → `Promise<RefreshResponse>`
 Exchange a refresh token for a fresh access token (public — the refresh token IS the credential). **Native sessions only**; refresh tokens are issued only when the host opted in via `initializeApi({ platform: 'native' })`. On success the new access token is stored automatically (`setBearerToken`). The returned `refreshToken` is **rotated** — the caller must persist it and discard the old one before refreshing again. ⚠️ **Single-use, no retry, serialize calls.** This method issues exactly one request and never retries: replaying a consumed refresh token triggers `REFRESH_TOKEN_REUSE_DETECTED` (the whole session family is revoked). The caller is responsible for ensuring only one refresh is in flight at a time (e.g. across tabs or resume events). Errors (thrown as `SmartlinksApiError`, read via `err.errorCode`): `MISSING_REFRESH_TOKEN` (400), `INVALID_REFRESH_TOKEN` (401), `REFRESH_TOKEN_REUSE_DETECTED` (401) — the last two mean a hard logout.
@@ -8640,26 +8662,26 @@ Revoke a refresh token's entire family server-side (that device's whole rotation
 **sendMagicLink**(clientId: string, data: { email: string; redirectUrl: string; accountData?: Record<string, any> }) → `Promise<MagicLinkSendResponse>`
 Send a magic link email to the user (public).
 
-**verifyMagicLink**(clientId: string, token: string) → `Promise<MagicLinkVerifyResponse>`
-Verify a magic link token and authenticate/create the user (public).
+**verifyMagicLink**(clientId: string, token: string, trustedDeviceToken?: string) → `Promise<MagicLinkVerifyResponse>`
+Verify a magic link token and authenticate/create the user (public). Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape.
 
 **sendPhoneCode**(clientId: string, phoneNumber: string) → `Promise<PhoneSendCodeResponse>`
 Send phone verification code (public).
 
-**verifyPhoneCode**(clientId: string, phoneNumber: string, code: string) → `Promise<PhoneVerifyResponse>`
-Verify phone verification code (public).
+**verifyPhoneCode**(clientId: string, phoneNumber: string, code: string, trustedDeviceToken?: string) → `Promise<PhoneVerifyResponse>`
+Verify phone verification code (public). Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape.
 
 **sendWhatsApp**(clientId: string, body: SendWhatsAppRequest = {}) → `Promise<SendWhatsAppResponse>`
 Send a WhatsApp verification deep-link (public).
 
 **verifyWhatsApp**(clientId: string, token: string, phoneNumber: string) → `Promise<VerifyWhatsAppResponse>`
-Manually verify WhatsApp token if inbound webhook path is unavailable (legacy/public fallback).
+Manually verify WhatsApp token if inbound webhook path is unavailable (legacy/public fallback). Not gated by step-up MFA — this endpoint only confirms the code, it never issues a session/bearer token, so there is nothing to challenge. {@link exchangeWhatsAppSession} is the WhatsApp method that's gated.
 
 **getWhatsAppStatus**(clientId: string, token: string) → `Promise<WhatsAppStatusResponse>`
 Poll WhatsApp verification status for a token (public).
 
-**exchangeWhatsAppSession**(clientId: string, token: string, sessionKey: string) → `Promise<ExchangeWhatsAppSessionResponse>`
-Exchange a verified WhatsApp token for an Auth Kit session (public).
+**exchangeWhatsAppSession**(clientId: string, token: string, sessionKey: string, trustedDeviceToken?: string) → `Promise<ExchangeWhatsAppSessionResponse>`
+Exchange a verified WhatsApp token for an Auth Kit session (public). Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape. This is the WhatsApp method that needs `trustedDeviceToken`, not {@link verifyWhatsApp} (which never issues a session).
 
 **sendSmsVerify**(clientId: string, body: SendSmsVerifyRequest) → `Promise<SendSmsVerifyResponse>`
 Send an SMS click-to-verify link (public).

package/dist/docs/auth-kit.md

@@ -226,6 +226,7 @@ const session = await authKit.appleLogin(clientId, appleIdentityToken, {
   // All optional:
   nonce,                                  // raw nonce, if you used nonce binding
   userInfo: { name, email },              // first authorization callback ONLY — Apple never resends it
+  trustedDeviceToken,                     // skip an MFA step-up challenge on a recognized device — see "Step-up MFA" below
 });
 // session.isNewUser and session.expiresAt (ms epoch) are populated by this endpoint.
 ```
@@ -307,16 +308,32 @@ clearPersistedTokens();
 ## Step-up MFA (Phase 1)
 
 Backend-only for now — **no admin-console UI and no challenge UI ship with this pass.**
-Factors: **email OTP, SMS OTP, recovery codes**. WhatsApp OTP, TOTP, and passkeys are
-deferred to a later phase; don't build against them yet.
+Factors: **email OTP, SMS OTP, recovery codes**. WhatsApp OTP, TOTP, and passkeys as
+*factors* are deferred to a later phase; don't build against them yet.
 
-The step-up gate is wired into **`login()` only** — `register`, `verifyPhoneCode`, and
-`verifyMagicLink` never return `MFA_REQUIRED`, regardless of client config.
+The step-up gate applies to **every login method that issues a session**:
 
-### Handling `MFA_REQUIRED` from `login()`
-
-`login()`'s return type is unchanged. When the client's MFA policy requires a step-up,
-the server returns 403 instead of a session, and `login()` throws:
+| Method | Gated? |
+|---|---|
+| `login()` | ✅ |
+| `googleLogin()` | ✅ |
+| `appleLogin()` | ✅ — pass `opts.trustedDeviceToken` |
+| `verifyPhoneCode()` | ✅ |
+| `verifyMagicLink()` | ✅ |
+| `exchangeWhatsAppSession()` | ✅ — **this is the WhatsApp method that needs a trusted-device token, not `verifyWhatsApp()`** |
+| `verifyWhatsApp()` | ❌ — only confirms the code, never issues a session, so there's nothing to gate |
+| `register()` | ❌ — a brand-new user has no enrolled factors to challenge against |
+| `googleCodeLogin()` | ❌ — no `/auth/google-code` route exists server-side |
+
+All six gated methods accept an optional `trustedDeviceToken` param (the last positional
+argument, or `opts.trustedDeviceToken` for `appleLogin()`) — same purpose everywhere: skip
+the challenge on a device the user already verified.
+
+### Handling `MFA_REQUIRED`
+
+Every gated method's return type is unchanged. When the client's MFA policy requires a
+step-up, the server returns 403 instead of a session, and the method throws — identically
+for all six:
 
 ```ts
 import { authKit, SmartlinksApiError } from '@proveanything/smartlinks';
@@ -362,10 +379,15 @@ above — same secure storage, same persist-before-next-call discipline:
 // 1) Persist trustedDeviceToken from a successful challenge (trustDevice: true)
 persistTrustedDeviceToken(session.trustedDeviceToken, session.trustedDeviceExpiresAt);
 
-// 2) Send it on every subsequent login() — if still valid, the challenge is skipped entirely
+// 2) Send it on every subsequent call to ANY of the six gated methods — if still valid,
+//    the challenge is skipped entirely. It isn't tied to which method the user challenged
+//    through, so "remember this device" works no matter which login method they pick next.
 const session = await authKit.login(clientId, email, password, storedTrustedDeviceToken);
+const session = await authKit.googleLogin(clientId, idToken, storedTrustedDeviceToken);
+const session = await authKit.exchangeWhatsAppSession(clientId, waToken, sessionKey, storedTrustedDeviceToken);
+// ...and so on for appleLogin (via opts), verifyPhoneCode, verifyMagicLink.
 // If it's revoked/expired, the server silently falls back to requiring a fresh challenge —
-// login() just throws MFA_REQUIRED again, no special-case handling needed.
+// the method just throws MFA_REQUIRED again, no special-case handling needed.
 
 // 3) Let users audit/revoke devices from a Settings screen
 const { devices } = await authKit.listTrustedDevices(clientId);
@@ -404,7 +426,7 @@ await authKit.removeMfaFactor(clientId, 'sms', password);
 
 | `errorCode` | HTTP | Meaning / client action |
 |---|---|---|
-| `MFA_REQUIRED` | 403 | From `login()` only — see above |
+| `MFA_REQUIRED` | 403 | From any of the six gated login methods — see above |
 | `INVALID_MFA_CODE` | 401 | Wrong code — let the user retry (attempts are capped) |
 | `MFA_TOO_MANY_ATTEMPTS` | 429 | 5 wrong attempts — the challenge is burned; restart from `login()` |
 | `MFA_FACTOR_NOT_ENROLLED` | 400 | Requested factor isn't enrolled — programming error if the UI only offers `availableFactors` |

package/dist/http.d.ts

@@ -49,6 +49,12 @@ export declare function setExtraHeaders(headers: Record<string, string>): void;
  * login or logout event.
  */
 export declare function setBearerToken(token: string | undefined): void;
+/**
+ * Returns the bearer token currently held by the SDK, or `undefined` if none is set.
+ * In proxy mode, credentials are held by the parent frame, not the local SDK,
+ * so this returns `undefined` even when the caller is authenticated.
+ */
+export declare function getBearerToken(): string | undefined;
 /**
  * Get the currently configured API base URL.
  * Returns null if initializeApi() has not been called yet.

package/dist/http.js

@@ -466,6 +466,14 @@ export function setBearerToken(token) {
     if (cachePersistence !== 'none')
         idbClear().catch(() => { });
 }
+/**
+ * Returns the bearer token currently held by the SDK, or `undefined` if none is set.
+ * In proxy mode, credentials are held by the parent frame, not the local SDK,
+ * so this returns `undefined` even when the caller is authenticated.
+ */
+export function getBearerToken() {
+    return bearerToken;
+}
 /**
  * Get the currently configured API base URL.
  * Returns null if initializeApi() has not been called yet.

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { initializeApi, isInitialized, hasAuthCredentials, configureSdkCache, invalidateCache, request, post, put, patch, del, sendCustomProxyMessage, getApiHeaders, isProxyEnabled, setBearerToken } from "./http";
+export { initializeApi, isInitialized, hasAuthCredentials, configureSdkCache, invalidateCache, request, post, put, patch, del, sendCustomProxyMessage, getApiHeaders, isProxyEnabled, setBearerToken, getBearerToken } from "./http";
 export * from "./api";
 export * from "./types";
 export { iframe } from "./iframe";

package/dist/index.js

@@ -1,6 +1,6 @@
 // src/index.ts
 // Top-level entrypoint of the npm package. Re-export initializeApi + all namespaces.
-export { initializeApi, isInitialized, hasAuthCredentials, configureSdkCache, invalidateCache, request, post, put, patch, del, sendCustomProxyMessage, getApiHeaders, isProxyEnabled, setBearerToken } from "./http";
+export { initializeApi, isInitialized, hasAuthCredentials, configureSdkCache, invalidateCache, request, post, put, patch, del, sendCustomProxyMessage, getApiHeaders, isProxyEnabled, setBearerToken, getBearerToken } from "./http";
 export * from "./api";
 export * from "./types";
 // Iframe namespace

package/dist/openapi.yaml

@@ -8291,7 +8291,7 @@ paths:
     post:
       tags:
         - authKit
-      summary: Sign in with Apple via an Apple identity token (public).
+      summary: authKit.appleLogin
       operationId: authKit_appleLogin
       security: []
       parameters:
@@ -18709,6 +18709,8 @@ components:
         userInfo:
           type: object
           additionalProperties: true
+        trustedDeviceToken:
+          type: string
     MfaRequiredDetails:
       type: object
       properties:
@@ -19723,6 +19725,11 @@ components:
           type: boolean
         defaultAuthKitId:
           type: string
+        admin:
+          type: object
+          additionalProperties: true
+        redirect:
+          $ref: "#/components/schemas/CollectionRedirectConfig"
       required:
         - id
         - title
@@ -19737,6 +19744,21 @@ components:
         - roles
         - shortId
         - defaultAuthKitId
+    CollectionRedirectConfig:
+      type: object
+      properties:
+        mode:
+          type: string
+          enum:
+            - fixed
+            - dynamic
+            - deep
+        url:
+          type: string
+        template:
+          type: string
+      required:
+        - mode
     HubAvailabilityResponse:
       type: object
       properties:

package/dist/types/authKit.d.ts

@@ -112,6 +112,12 @@ export interface AppleLoginOptions {
         email?: string;
         name?: string;
     };
+    /**
+     * A previously-issued trusted-device token (from a prior MFA `challenge/verify`
+     * or `challenge/recovery-code` response). If still valid, the server skips any
+     * step-up challenge for this login. See `SDK_AUTHKIT_MFA_UPDATE.md` §3.
+     */
+    trustedDeviceToken?: string;
 }
 /**
  * Server-defined error codes returned by AuthKit federated-login endpoints
@@ -121,10 +127,10 @@ export interface AppleLoginOptions {
  */
 export type AuthKitErrorCode = 'MISSING_APPLE_TOKEN' | 'APPLE_AUTH_NOT_CONFIGURED' | 'INVALID_APPLE_TOKEN' | 'ACCOUNT_EXISTS_UNVERIFIED' | 'APPLE_AUTH_FAILED';
 /**
- * Details carried on the `MFA_REQUIRED` error thrown by {@link authKit.login} when the
- * client's MFA policy requires a step-up. Surfaced as `err.details` (or
- * `err.errorResponse.details`) on the `SmartlinksApiError` — `login()` never resolves in
- * this case, it throws a 403 instead.
+ * Details carried on the `MFA_REQUIRED` error thrown by any session-issuing login method
+ * (see the gate list above) when the client's MFA policy requires a step-up. Surfaced as
+ * `err.details` (or `err.errorResponse.details`) on the `SmartlinksApiError` — the login
+ * method never resolves in this case, it throws a 403 instead.
  */
 export interface MfaRequiredDetails {
     /** Short-lived (10 min) and single-use. Pass it to every challenge/finalize call below. */
@@ -156,7 +162,10 @@ export interface MfaFinalizeResponse extends AuthLoginResponse {
     /**
      * Present only when the challenge was completed with `trustDevice: true`. Persist it
      * alongside the refresh token (same secure storage) and send it as `trustedDeviceToken`
-     * on future {@link authKit.login} calls to skip the challenge on this device.
+     * on future calls to any gated login method ({@link authKit.login},
+     * {@link authKit.googleLogin}, {@link authKit.appleLogin}, {@link authKit.verifyPhoneCode},
+     * {@link authKit.verifyMagicLink}, {@link authKit.exchangeWhatsAppSession}) to skip the
+     * challenge on this device — it isn't tied to which method the user challenged through.
      */
     trustedDeviceToken?: string;
     trustedDeviceExpiresAt?: string;
@@ -199,7 +208,7 @@ export interface TrustedDevice {
  * Server-defined error codes for the step-up MFA flow, surfaced via
  * `SmartlinksApiError.errorCode`.
  *
- * - `MFA_REQUIRED` (403) — from {@link authKit.login} only; see {@link MfaRequiredDetails}.
+ * - `MFA_REQUIRED` (403) — from any session-issuing login method; see {@link MfaRequiredDetails}.
  * - `INVALID_MFA_CODE` (401) — wrong code; let the user retry (attempts are capped, see next).
  * - `MFA_TOO_MANY_ATTEMPTS` (429) — 5 wrong attempts; the challenge is burned, restart from `login()`.
  * - `MFA_FACTOR_NOT_ENROLLED` (400) — requested factor isn't enrolled (or disabled for the

package/dist/types/collection.d.ts

@@ -58,6 +58,29 @@ export interface Collection {
     /** Allow users to claim products without providing a proof ID (auto-generates serial on-demand) */
     allowAutoGenerateClaims?: boolean;
     defaultAuthKitId: string;
+    /** Admin-configured collection behavior not exposed on public reads */
+    admin?: {
+        /**
+         * Redirect behavior for plain collection-level scans (a short link with
+         * no product/serial code in the path, e.g. `https://.../c/shortId`).
+         * Unset means such links always go to the normal collection page.
+         */
+        redirect?: CollectionRedirectConfig;
+    };
+}
+/**
+ * Redirect rule for plain collection-level scans.
+ * - `fixed` / `dynamic` - redirect the entire collection to one URL/template,
+ *   defined right here via `url`/`template`.
+ * - `deep` - defer to the collection's product-level, facet-rule, and
+ *   collection-wide redirect config (checked in that order) instead.
+ */
+export interface CollectionRedirectConfig {
+    mode: 'fixed' | 'dynamic' | 'deep';
+    /** Required when mode === 'fixed' */
+    url?: string;
+    /** Mustache template, required when mode === 'dynamic' */
+    template?: string;
 }
 export type CollectionResponse = Collection;
 export type CollectionCreateRequest = Omit<Collection, 'id' | 'shortId'>;

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 1.15.13  |  Generated: 2026-07-27T08:21:16.504Z
+Version: 1.15.15  |  Generated: 2026-07-29T17:46:34.198Z
 
 This is a concise summary of all available API functions and types.
 
@@ -170,6 +170,9 @@ Replace or augment globally applied custom headers.
 **setBearerToken**(token: string | undefined) → `void`
 Allows setting the bearerToken at runtime (e.g. after login/logout). Clears the HTTP cache whenever the token actually changes so that stale user-scoped responses (e.g. /account/profile) are not served after a login or logout event.
 
+**getBearerToken**() → `string | undefined`
+Returns the bearer token currently held by the SDK, or `undefined` if none is set. In proxy mode, credentials are held by the parent frame, not the local SDK, so this returns `undefined` even when the caller is authenticated.
+
 **getBaseURL**() → `string | null`
 Get the currently configured API base URL. Returns null if initializeApi() has not been called yet.
 
@@ -3104,6 +3107,10 @@ interface AppleLoginOptions {
   * these again, and never inside the token. Forwarded so the server can persist the
   * display name on first account creation. Treated as untrusted (never used for identity).
   userInfo?: { email?: string; name?: string }
+  * A previously-issued trusted-device token (from a prior MFA `challenge/verify`
+  * or `challenge/recovery-code` response). If still valid, the server skips any
+  * step-up challenge for this login. See `SDK_AUTHKIT_MFA_UPDATE.md` §3.
+  trustedDeviceToken?: string
 }
 ```
 
@@ -3778,6 +3785,21 @@ interface Collection {
   portalUrl?: string // URL for the collection's portal (if applicable)
   allowAutoGenerateClaims?: boolean
   defaultAuthKitId: string // default auth kit for this collection, used for auth
+  admin?: {
+  * Redirect behavior for plain collection-level scans (a short link with
+  * no product/serial code in the path, e.g. `https://.../c/shortId`).
+  * Unset means such links always go to the normal collection page.
+  redirect?: CollectionRedirectConfig
+  }
+}
+```
+
+**CollectionRedirectConfig** (interface)
+```typescript
+interface CollectionRedirectConfig {
+  mode: 'fixed' | 'dynamic' | 'deep'
+  url?: string
+  template?: string
 }
 ```
 
@@ -8620,16 +8642,16 @@ Gets current account information for the logged in user. Returns user, owner, ac
 Login with email + password (public). When the client's MFA policy requires a step-up, the server returns **403 `MFA_REQUIRED`** instead of a session — `login()` throws a `SmartlinksApiError` with `err.errorResponse?.errorCode === 'MFA_REQUIRED'` and the challenge details in `err.details` (see {@link MfaRequiredDetails}). Route the caller to {@link mfaChallengeSend} on that error; this method's return type is unchanged. returned one (via {@link mfaChallengeVerify}/{@link mfaRecoveryCode} with `trustDevice: true`), pass it here to skip the challenge entirely as long as it's still valid. If it's revoked/expired, the server silently falls back to requiring a fresh challenge — `login()` just returns `MFA_REQUIRED` again, no special handling.
 
 **register**(clientId: string, data: { email: string; password: string; displayName?: string; accountData?: Record<string, any> }) → `Promise<AuthLoginResponse>`
-Register a new user (public).
+Register a new user (public). Not gated by step-up MFA — a brand-new user has no enrolled factors yet, so there's nothing to challenge against.
 
-**googleLogin**(clientId: string, idToken: string) → `Promise<AuthLoginResponse>`
-Google OAuth login via ID token (public).
+**googleLogin**(clientId: string, idToken: string, trustedDeviceToken?: string) → `Promise<AuthLoginResponse>`
+Google OAuth login via ID token (public). Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape. {@link mfaChallengeVerify}/{@link mfaRecoveryCode} (with `trustDevice: true`) to skip the challenge on this device, same as {@link login}.
 
 **googleCodeLogin**(clientId: string, code: string, redirectUri: string) → `Promise<AuthLoginResponse>`
 Google OAuth login via server-side authorization code (public).
 
 **appleLogin**(clientId: string, identityToken: string, opts?: AppleLoginOptions) → `Promise<AuthLoginResponse>`
-Sign in with Apple via an Apple identity token (public). Mirrors {@link googleLogin}. On success the returned bearer token is stored automatically and the cache is invalidated. Notable error codes (thrown as `SmartlinksApiError`, read via `err.errorCode`): - `MISSING_APPLE_TOKEN` (400), `APPLE_AUTH_NOT_CONFIGURED` (400), `INVALID_APPLE_TOKEN` (401), `APPLE_AUTH_FAILED` (500) - `ACCOUNT_EXISTS_UNVERIFIED` (409) — an unverified account already owns this email; the server refuses to silently link. `err.details.requiresEmailVerification` is `true`. Recoverable: the user should sign in with their password (or reset it), then link Apple from settings. **The same 409 can now come back from {@link googleLogin}** under the shared verified-to-verified linking policy.
+Sign in with Apple via an Apple identity token (public). Mirrors {@link googleLogin}. On success the returned bearer token is stored automatically and the cache is invalidated. Notable error codes (thrown as `SmartlinksApiError`, read via `err.errorCode`): - `MISSING_APPLE_TOKEN` (400), `APPLE_AUTH_NOT_CONFIGURED` (400), `INVALID_APPLE_TOKEN` (401), `APPLE_AUTH_FAILED` (500) - `ACCOUNT_EXISTS_UNVERIFIED` (409) — an unverified account already owns this email; the server refuses to silently link. `err.details.requiresEmailVerification` is `true`. Recoverable: the user should sign in with their password (or reset it), then link Apple from settings. **The same 409 can now come back from {@link googleLogin}** under the shared verified-to-verified linking policy. Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape. Pass `opts.trustedDeviceToken` to skip the challenge on a recognized device.
 
 **refreshToken**(clientId: string, refreshToken: string) → `Promise<RefreshResponse>`
 Exchange a refresh token for a fresh access token (public — the refresh token IS the credential). **Native sessions only**; refresh tokens are issued only when the host opted in via `initializeApi({ platform: 'native' })`. On success the new access token is stored automatically (`setBearerToken`). The returned `refreshToken` is **rotated** — the caller must persist it and discard the old one before refreshing again. ⚠️ **Single-use, no retry, serialize calls.** This method issues exactly one request and never retries: replaying a consumed refresh token triggers `REFRESH_TOKEN_REUSE_DETECTED` (the whole session family is revoked). The caller is responsible for ensuring only one refresh is in flight at a time (e.g. across tabs or resume events). Errors (thrown as `SmartlinksApiError`, read via `err.errorCode`): `MISSING_REFRESH_TOKEN` (400), `INVALID_REFRESH_TOKEN` (401), `REFRESH_TOKEN_REUSE_DETECTED` (401) — the last two mean a hard logout.
@@ -8640,26 +8662,26 @@ Revoke a refresh token's entire family server-side (that device's whole rotation
 **sendMagicLink**(clientId: string, data: { email: string; redirectUrl: string; accountData?: Record<string, any> }) → `Promise<MagicLinkSendResponse>`
 Send a magic link email to the user (public).
 
-**verifyMagicLink**(clientId: string, token: string) → `Promise<MagicLinkVerifyResponse>`
-Verify a magic link token and authenticate/create the user (public).
+**verifyMagicLink**(clientId: string, token: string, trustedDeviceToken?: string) → `Promise<MagicLinkVerifyResponse>`
+Verify a magic link token and authenticate/create the user (public). Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape.
 
 **sendPhoneCode**(clientId: string, phoneNumber: string) → `Promise<PhoneSendCodeResponse>`
 Send phone verification code (public).
 
-**verifyPhoneCode**(clientId: string, phoneNumber: string, code: string) → `Promise<PhoneVerifyResponse>`
-Verify phone verification code (public).
+**verifyPhoneCode**(clientId: string, phoneNumber: string, code: string, trustedDeviceToken?: string) → `Promise<PhoneVerifyResponse>`
+Verify phone verification code (public). Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape.
 
 **sendWhatsApp**(clientId: string, body: SendWhatsAppRequest = {}) → `Promise<SendWhatsAppResponse>`
 Send a WhatsApp verification deep-link (public).
 
 **verifyWhatsApp**(clientId: string, token: string, phoneNumber: string) → `Promise<VerifyWhatsAppResponse>`
-Manually verify WhatsApp token if inbound webhook path is unavailable (legacy/public fallback).
+Manually verify WhatsApp token if inbound webhook path is unavailable (legacy/public fallback). Not gated by step-up MFA — this endpoint only confirms the code, it never issues a session/bearer token, so there is nothing to challenge. {@link exchangeWhatsAppSession} is the WhatsApp method that's gated.
 
 **getWhatsAppStatus**(clientId: string, token: string) → `Promise<WhatsAppStatusResponse>`
 Poll WhatsApp verification status for a token (public).
 
-**exchangeWhatsAppSession**(clientId: string, token: string, sessionKey: string) → `Promise<ExchangeWhatsAppSessionResponse>`
-Exchange a verified WhatsApp token for an Auth Kit session (public).
+**exchangeWhatsAppSession**(clientId: string, token: string, sessionKey: string, trustedDeviceToken?: string) → `Promise<ExchangeWhatsAppSessionResponse>`
+Exchange a verified WhatsApp token for an Auth Kit session (public). Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape. This is the WhatsApp method that needs `trustedDeviceToken`, not {@link verifyWhatsApp} (which never issues a session).
 
 **sendSmsVerify**(clientId: string, body: SendSmsVerifyRequest) → `Promise<SendSmsVerifyResponse>`
 Send an SMS click-to-verify link (public).

package/docs/auth-kit.md

@@ -226,6 +226,7 @@ const session = await authKit.appleLogin(clientId, appleIdentityToken, {
   // All optional:
   nonce,                                  // raw nonce, if you used nonce binding
   userInfo: { name, email },              // first authorization callback ONLY — Apple never resends it
+  trustedDeviceToken,                     // skip an MFA step-up challenge on a recognized device — see "Step-up MFA" below
 });
 // session.isNewUser and session.expiresAt (ms epoch) are populated by this endpoint.
 ```
@@ -307,16 +308,32 @@ clearPersistedTokens();
 ## Step-up MFA (Phase 1)
 
 Backend-only for now — **no admin-console UI and no challenge UI ship with this pass.**
-Factors: **email OTP, SMS OTP, recovery codes**. WhatsApp OTP, TOTP, and passkeys are
-deferred to a later phase; don't build against them yet.
+Factors: **email OTP, SMS OTP, recovery codes**. WhatsApp OTP, TOTP, and passkeys as
+*factors* are deferred to a later phase; don't build against them yet.
 
-The step-up gate is wired into **`login()` only** — `register`, `verifyPhoneCode`, and
-`verifyMagicLink` never return `MFA_REQUIRED`, regardless of client config.
+The step-up gate applies to **every login method that issues a session**:
 
-### Handling `MFA_REQUIRED` from `login()`
-
-`login()`'s return type is unchanged. When the client's MFA policy requires a step-up,
-the server returns 403 instead of a session, and `login()` throws:
+| Method | Gated? |
+|---|---|
+| `login()` | ✅ |
+| `googleLogin()` | ✅ |
+| `appleLogin()` | ✅ — pass `opts.trustedDeviceToken` |
+| `verifyPhoneCode()` | ✅ |
+| `verifyMagicLink()` | ✅ |
+| `exchangeWhatsAppSession()` | ✅ — **this is the WhatsApp method that needs a trusted-device token, not `verifyWhatsApp()`** |
+| `verifyWhatsApp()` | ❌ — only confirms the code, never issues a session, so there's nothing to gate |
+| `register()` | ❌ — a brand-new user has no enrolled factors to challenge against |
+| `googleCodeLogin()` | ❌ — no `/auth/google-code` route exists server-side |
+
+All six gated methods accept an optional `trustedDeviceToken` param (the last positional
+argument, or `opts.trustedDeviceToken` for `appleLogin()`) — same purpose everywhere: skip
+the challenge on a device the user already verified.
+
+### Handling `MFA_REQUIRED`
+
+Every gated method's return type is unchanged. When the client's MFA policy requires a
+step-up, the server returns 403 instead of a session, and the method throws — identically
+for all six:
 
 ```ts
 import { authKit, SmartlinksApiError } from '@proveanything/smartlinks';
@@ -362,10 +379,15 @@ above — same secure storage, same persist-before-next-call discipline:
 // 1) Persist trustedDeviceToken from a successful challenge (trustDevice: true)
 persistTrustedDeviceToken(session.trustedDeviceToken, session.trustedDeviceExpiresAt);
 
-// 2) Send it on every subsequent login() — if still valid, the challenge is skipped entirely
+// 2) Send it on every subsequent call to ANY of the six gated methods — if still valid,
+//    the challenge is skipped entirely. It isn't tied to which method the user challenged
+//    through, so "remember this device" works no matter which login method they pick next.
 const session = await authKit.login(clientId, email, password, storedTrustedDeviceToken);
+const session = await authKit.googleLogin(clientId, idToken, storedTrustedDeviceToken);
+const session = await authKit.exchangeWhatsAppSession(clientId, waToken, sessionKey, storedTrustedDeviceToken);
+// ...and so on for appleLogin (via opts), verifyPhoneCode, verifyMagicLink.
 // If it's revoked/expired, the server silently falls back to requiring a fresh challenge —
-// login() just throws MFA_REQUIRED again, no special-case handling needed.
+// the method just throws MFA_REQUIRED again, no special-case handling needed.
 
 // 3) Let users audit/revoke devices from a Settings screen
 const { devices } = await authKit.listTrustedDevices(clientId);
@@ -404,7 +426,7 @@ await authKit.removeMfaFactor(clientId, 'sms', password);
 
 | `errorCode` | HTTP | Meaning / client action |
 |---|---|---|
-| `MFA_REQUIRED` | 403 | From `login()` only — see above |
+| `MFA_REQUIRED` | 403 | From any of the six gated login methods — see above |
 | `INVALID_MFA_CODE` | 401 | Wrong code — let the user retry (attempts are capped) |
 | `MFA_TOO_MANY_ATTEMPTS` | 429 | 5 wrong attempts — the challenge is burned; restart from `login()` |
 | `MFA_FACTOR_NOT_ENROLLED` | 400 | Requested factor isn't enrolled — programming error if the UI only offers `availableFactors` |

package/openapi.yaml

@@ -8291,7 +8291,7 @@ paths:
     post:
       tags:
         - authKit
-      summary: Sign in with Apple via an Apple identity token (public).
+      summary: authKit.appleLogin
       operationId: authKit_appleLogin
       security: []
       parameters:
@@ -18709,6 +18709,8 @@ components:
         userInfo:
           type: object
           additionalProperties: true
+        trustedDeviceToken:
+          type: string
     MfaRequiredDetails:
       type: object
       properties:
@@ -19723,6 +19725,11 @@ components:
           type: boolean
         defaultAuthKitId:
           type: string
+        admin:
+          type: object
+          additionalProperties: true
+        redirect:
+          $ref: "#/components/schemas/CollectionRedirectConfig"
       required:
         - id
         - title
@@ -19737,6 +19744,21 @@ components:
         - roles
         - shortId
         - defaultAuthKitId
+    CollectionRedirectConfig:
+      type: object
+      properties:
+        mode:
+          type: string
+          enum:
+            - fixed
+            - dynamic
+            - deep
+        url:
+          type: string
+        template:
+          type: string
+      required:
+        - mode
     HubAvailabilityResponse:
       type: object
       properties:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proveanything/smartlinks",
-  "version": "1.15.13",
+  "version": "1.15.15",
   "description": "Official JavaScript/TypeScript SDK for the Smartlinks API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",