@proveanything/smartlinks 1.15.15 → 1.15.17

package/dist/openapi.yaml

@@ -12183,6 +12183,90 @@ paths:
           application/json:
             schema:
               $ref: "#/components/schemas/ProofClaimRequest"
+  /public/collection/{collectionId}/product/{productId}/proof/{proofId}/grant/redeem:
+    post:
+      tags:
+        - proof
+      summary: Redeem a grant token (anonymous or signed-in).
+      operationId: proof_redeemGrant
+      security: []
+      parameters:
+        - name: collectionId
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: productId
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: proofId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/RedeemGrantResult"
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/RedeemGrantOptions"
+  /public/collection/{collectionId}/product/{productId}/proof/{proofId}/grant/{grantId}:
+    delete:
+      tags:
+        - proof
+      summary: Revoke a grant by id (owner / collection admin only).
+      operationId: proof_revokeGrant
+      security: []
+      parameters:
+        - name: collectionId
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: productId
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: proofId
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: grantId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
   /public/collection/{collectionId}/products/{productId}/createClaim:
     post:
       tags:
@@ -17731,6 +17815,8 @@ components:
           type: string
         admin:
           type: boolean
+        signal:
+          $ref: "#/components/schemas/AbortSignal"
       required:
         - file
     UploadFromUrlOptions:
@@ -17996,6 +18082,39 @@ components:
         - collectionId
         - tokenId
         - file
+    CreateResumableUploadOptions:
+      type: object
+      properties:
+        file:
+          $ref: "#/components/schemas/File"
+        name:
+          type: string
+        metadata:
+          type: object
+          additionalProperties: true
+        appId:
+          type: string
+        admin:
+          type: boolean
+        token:
+          type: string
+      required:
+        - file
+    ResumableStartOptions:
+      type: object
+      properties:
+        signal:
+          $ref: "#/components/schemas/AbortSignal"
+    ResumableUploadHandle:
+      type: object
+      properties:
+        id:
+          type: string
+        size:
+          type: number
+      required:
+        - id
+        - size
     AttestationResponse:
       type: object
       properties:
@@ -24830,6 +24949,80 @@ components:
             $ref: "#/components/schemas/ProofFieldDef"
       required:
         - fields
+    GrantAudience:
+      type: object
+      properties:
+        kind:
+          type: string
+          enum:
+            - public_link
+            - named
+        email:
+          type: string
+        userId:
+          type: string
+      required:
+        - kind
+    ProofGrant:
+      type: object
+      properties:
+        grantId:
+          type: string
+        proofId:
+          type: string
+        productId:
+          type: string
+        scope:
+          type: array
+          items:
+            $ref: "#/components/schemas/GrantScope"
+        audience:
+          $ref: "#/components/schemas/GrantAudience"
+        createdBy:
+          type: string
+        expiresAt:
+          type: string
+        revokedAt:
+          type: string
+        redeemedBy:
+          type: object
+          additionalProperties: true
+        redeemCount:
+          type: number
+        createdAt:
+          type: string
+        updatedAt:
+          type: string
+        token:
+          type: string
+      required:
+        - grantId
+        - proofId
+        - scope
+        - audience
+        - createdBy
+        - redeemCount
+        - createdAt
+        - updatedAt
+    CreateGrantOptions:
+      type: object
+      properties:
+        scope:
+          type: array
+          items:
+            $ref: "#/components/schemas/GrantScope"
+        audience:
+          $ref: "#/components/schemas/GrantAudience"
+        expiresAt:
+          type: object
+          additionalProperties: true
+      required:
+        - scope
+    RedeemGrantOptions:
+      type: object
+      properties:
+        guestName:
+          type: string
     ProofResponse:
       type: object
       additionalProperties: true

package/dist/types/asset.d.ts

@@ -122,6 +122,8 @@ export interface UploadAssetOptions {
     appId?: string;
     /** Optional: Upload via admin route instead of public */
     admin?: boolean;
+    /** Optional: Abort the in-flight upload (browser fetch/XHR only) */
+    signal?: AbortSignal;
 }
 /**
  * Options for uploading an asset from a URL.
@@ -304,3 +306,57 @@ export interface PublicTokenUploadOptions {
     metadata?: Record<string, any>;
     onProgress?: (percent: number) => void;
 }
+/**
+ * Options for opening a resumable upload. Mirrors {@link UploadAssetOptions}
+ * but the transfer is chunked directly to storage and can be paused/resumed,
+ * including after a page reload or app restart.
+ */
+export interface CreateResumableUploadOptions {
+    file: File;
+    scope: {
+        type: 'collection';
+        collectionId: string;
+    } | {
+        type: 'product';
+        collectionId: string;
+        productId: string;
+    } | {
+        type: 'proof';
+        collectionId: string;
+        productId: string;
+        proofId: string;
+    };
+    name?: string;
+    metadata?: Record<string, any>;
+    appId?: string;
+    /** Upload via admin route (default) or, when set, the public token route. */
+    admin?: boolean;
+    /**
+     * Upload token id (from {@link requestUploadToken}) for public/unauthenticated
+     * uploads. When provided, the public resumable route is used.
+     */
+    token?: string;
+}
+export interface ResumableStartOptions {
+    /** Progress callback (0-100), driven by bytes confirmed by storage. */
+    onProgress?: (percent: number) => void;
+    /** Abort the in-flight transfer. */
+    signal?: AbortSignal;
+}
+/**
+ * A handle to a resumable upload. `id` is durable — persist it (e.g. in
+ * IndexedDB) alongside a reference to the file and pass it to
+ * {@link asset.resumeUpload} after a reload to continue mid-file.
+ */
+export interface ResumableUploadHandle {
+    /** Durable, persistable upload id (survives reload/app restart). */
+    readonly id: string;
+    /** Total bytes of the file being uploaded. */
+    readonly size: number;
+    /** Begin (or continue) uploading, resuming from the storage offset. */
+    start(options?: ResumableStartOptions): Promise<Asset>;
+    /** Pause after the current chunk. */
+    pause(): void;
+    /** Resume a paused transfer. */
+    resume(options?: ResumableStartOptions): Promise<Asset>;
+}

package/dist/types/navigation.d.ts

@@ -37,6 +37,11 @@ export type LinkTarget = {
     kind: 'app';
     /** The target app's `appId`. */
     appId: string;
+    /**
+     * App-specific query params (e.g. `{ proofId, shareToken }` for a share link).
+     * Platform context params are injected automatically.
+     */
+    params?: Record<string, string>;
     target?: LinkOpenTarget;
 } | {
     kind: 'deep';

package/dist/types/proof.d.ts

@@ -65,3 +65,58 @@ export type ProofFieldDef = ScopedFieldDef & {
 export interface ProofFieldsConfig {
     fields: ProofFieldDef[];
 }
+/** What a grant authorises the bearer to do on the proof. */
+export type GrantScope = 'read' | 'comment' | 'admin' | 'verify_owner';
+/** Who may redeem a grant. */
+export interface GrantAudience {
+    kind: 'public_link' | 'named';
+    email?: string;
+    userId?: string;
+}
+/** A share grant issued on a proof. */
+export interface ProofGrant {
+    grantId: string;
+    proofId: string;
+    productId?: string | null;
+    scope: GrantScope[];
+    audience: GrantAudience;
+    createdBy: string;
+    expiresAt?: string | null;
+    revokedAt?: string | null;
+    redeemedBy?: {
+        userId?: string;
+        guestName?: string;
+        redeemedAt: string;
+    };
+    redeemCount: number;
+    createdAt: string;
+    updatedAt: string;
+    /** The opaque bearer token — present ONLY on the `createGrant` response, never on `listGrants`. */
+    token?: string;
+}
+export interface CreateGrantOptions {
+    /** At least one scope is required. */
+    scope: GrantScope[];
+    /** Defaults to `{ kind: 'public_link' }`. */
+    audience?: GrantAudience;
+    /** Optional expiry — a `Date` or ISO string. */
+    expiresAt?: Date | string;
+}
+export interface RedeemGrantOptions {
+    /** Display name to stamp on guest activity when the redeemer is not signed in. */
+    guestName?: string;
+}
+/**
+ * Result of redeeming a grant. For read/comment/admin grants this is the granted
+ * scope; for a `verify_owner` grant it is an ownership assertion (never the account).
+ */
+export type RedeemGrantResult = {
+    scope: GrantScope[];
+    redeemedAt: string;
+} | {
+    proofId: string;
+    assertsOwnership: true;
+    ownerDisplayName?: string;
+    issuedAt?: string;
+    expiresAt?: string;
+};

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 1.15.15  |  Generated: 2026-07-29T17:46:34.198Z
+Version: 1.15.17  |  Generated: 2026-08-18T08:10:50.608Z
 
 This is a concise summary of all available API functions and types.
 
@@ -170,6 +170,12 @@ Replace or augment globally applied custom headers.
 **setBearerToken**(token: string | undefined) → `void`
 Allows setting the bearerToken at runtime (e.g. after login/logout). Clears the HTTP cache whenever the token actually changes so that stale user-scoped responses (e.g. /account/profile) are not served after a login or logout event.
 
+**setGrantToken**(token: string | undefined) → `void`
+Set (or clear) the per-proof share-grant token. When set, it is attached as the `X-Grant-Token` header on every request, so a recipient who has opened a shared link can read/comment on the granted proof's data. Pass `undefined` to clear it. The server re-checks the grant against the database on every request, so calling `revokeGrant` invalidates an in-flight token immediately. Clears the GET cache on change so grant-tier responses are not served after the token changes. ```ts // On opening ?proofId=…&shareToken=abc setGrantToken(shareToken) const { attestations } = await proof.get(...)  // now sees owner-tier memories ```
+
+**getGrantToken**() → `string | undefined`
+Returns the currently-set share-grant token, or `undefined`.
+
 **getBearerToken**() → `string | undefined`
 Returns the bearer token currently held by the SDK, or `undefined` if none is set. In proxy mode, credentials are held by the parent frame, not the local SDK, so this returns `undefined` even when the caller is authenticated.
 
@@ -2459,6 +2465,7 @@ interface UploadAssetOptions {
   onProgress?: (percent: number) => void
   appId?: string
   admin?: boolean
+  signal?: AbortSignal
 }
 ```
 
@@ -2639,6 +2646,43 @@ interface PublicTokenUploadOptions {
 }
 ```
 
+**CreateResumableUploadOptions** (interface)
+```typescript
+interface CreateResumableUploadOptions {
+  file: File
+  scope:
+  | { type: 'collection'; collectionId: string }
+  | { type: 'product'; collectionId: string; productId: string }
+  | { type: 'proof'; collectionId: string; productId: string; proofId: string }
+  name?: string
+  metadata?: Record<string, any>
+  appId?: string
+  admin?: boolean
+  * Upload token id (from {@link requestUploadToken}) for public/unauthenticated
+  * uploads. When provided, the public resumable route is used.
+  token?: string
+}
+```
+
+**ResumableStartOptions** (interface)
+```typescript
+interface ResumableStartOptions {
+  onProgress?: (percent: number) => void
+  signal?: AbortSignal
+}
+```
+
+**ResumableUploadHandle** (interface)
+```typescript
+interface ResumableUploadHandle {
+  readonly id: string
+  readonly size: number
+  start(options?: ResumableStartOptions): Promise<Asset>
+  pause(): void
+  resume(options?: ResumableStartOptions): Promise<Asset>
+}
+```
+
 **AssetResponse** = `Asset`
 
 ### attestation
@@ -7249,6 +7293,50 @@ interface ProofFieldsConfig {
 }
 ```
 
+**GrantAudience** (interface)
+```typescript
+interface GrantAudience {
+  kind: 'public_link' | 'named'
+  email?: string
+  userId?: string
+}
+```
+
+**ProofGrant** (interface)
+```typescript
+interface ProofGrant {
+  grantId: string
+  proofId: string
+  productId?: string | null
+  scope: GrantScope[]
+  audience: GrantAudience
+  createdBy: string
+  expiresAt?: string | null
+  revokedAt?: string | null
+  redeemedBy?: { userId?: string; guestName?: string; redeemedAt: string }
+  redeemCount: number
+  createdAt: string
+  updatedAt: string
+  token?: string
+}
+```
+
+**CreateGrantOptions** (interface)
+```typescript
+interface CreateGrantOptions {
+  scope: GrantScope[]
+  audience?: GrantAudience
+  expiresAt?: Date | string
+}
+```
+
+**RedeemGrantOptions** (interface)
+```typescript
+interface RedeemGrantOptions {
+  guestName?: string
+}
+```
+
 **ProofResponse** = `Proof`
 
 **ProofUpdateRequest** = `Partial<ProofCreateRequest>`
@@ -7259,6 +7347,10 @@ interface ProofFieldsConfig {
 
 **ProofFieldDef** = `ScopedFieldDef & { scope?: ProofFieldScope }`
 
+**GrantScope** = `'read' | 'comment' | 'admin' | 'verify_owner'`
+
+**RedeemGrantResult** = ``
+
 ### qr
 
 **QrShortCodeLookupResponse** (interface)
@@ -8479,6 +8571,12 @@ Request a single-use upload token for a public (unauthenticated) upload. The tok
 **publicUploadWithToken**(options: PublicTokenUploadOptions) → `Promise<Asset>`
 Upload a file using a single-use upload token (no admin auth required). Assets are created with `status: 'pending_review'` when the token policy has `reviewRequired: true`.
 
+**createResumableUpload**(options: CreateResumableUploadOptions) → `Promise<ResumableUploadHandle>`
+Open a resumable upload for a large file (e.g. video). The bytes are chunked directly to storage and can be paused/resumed — including after a page reload or app restart, by persisting `handle.id` and calling {@link resumeUpload}. ```ts const handle = await asset.createResumableUpload({ file, scope, appId }) localStorage.setItem('pendingUpload', handle.id)   // survives reload const uploaded = await handle.start({ onProgress: p => setPct(p) }) ```
+
+**resumeUpload**(handleId: string, file: File) → `Promise<ResumableUploadHandle>`
+Resume a previously-created resumable upload after a reload/app restart. Pass the persisted `handle.id` and the same `File`; the transfer continues from the offset storage already holds rather than restarting.
+
 ### async
 
 **enqueueAsyncJob**(collectionId: string,
@@ -9893,6 +9991,30 @@ Get proofs for a batch (admin only). GET /admin/collection/:collectionId/product
     data: { targetProductId: string }) → `Promise<ProofResponse>`
 Migrate a proof to a different product within the same collection (admin only). Because the Firestore ledger document ID is `{productId}-{proofId}`, a proof cannot simply be re-assigned to another product by updating a field — the document must be re-keyed. This endpoint handles that atomically: 1. Reads the source ledger document (`{sourceProductId}-{proofId}`). 2. Writes a new document (`{targetProductId}-{proofId}`) with `productId` and `proofGroup` updated. The short `proofId` (nanoid) is unchanged. 3. Writes a migration history entry to the new document's `history` subcollection (snapshot of the original proof + migration metadata). 4. Copies all subcollections — `assets`, `attestations`, `history` — from the old document to the new one. 5. Deletes the old subcollections and then the old document. Repeated migrations are safe — each one appends a history record; no migration metadata is stored on the proof document itself. ```typescript const migrated = await proof.migrate('coll_123', 'prod_old', 'proof_abc', { targetProductId: 'prod_new', }) console.log(migrated.productId) // 'prod_new' ```
 
+**createGrant**(collectionId: string,
+    productId: string,
+    proofId: string,
+    options: CreateGrantOptions) → `Promise<ProofGrant>`
+Create a share grant on a proof (owner / collection admin only). The returned grant includes `token` — the opaque bearer secret, available ONLY on this response. Embed it in a share link and hand recipients {@link redeemGrant} / {@link setGrantToken}.
+
+**listGrants**(collectionId: string,
+    productId: string,
+    proofId: string) → `Promise<ProofGrant[]>`
+List the active + past grants on a proof (owner / collection admin only). Tokens are never returned here.
+
+**revokeGrant**(collectionId: string,
+    productId: string,
+    proofId: string,
+    grantId: string) → `Promise<void>`
+Revoke a grant by id (owner / collection admin only). Takes effect immediately.
+
+**redeemGrant**(collectionId: string,
+    productId: string,
+    proofId: string,
+    token: string,
+    options?: RedeemGrantOptions) → `Promise<RedeemGrantResult>`
+Redeem a grant token (anonymous or signed-in). Records the redemption and returns the granted scope, or — for a `verify_owner` grant — an ownership assertion (never the account). After redeeming, call {@link setGrantToken} so subsequent data requests carry the token.
+
 ### publicClient
 
 **chat**(collectionId: string,