@proveanything/smartlinks 1.15.18 → 1.15.19

package/README.md

@@ -41,10 +41,10 @@ If you're new to the SDK, this is the easiest path:
 - **Fetch collections/products** → see [Quick start](README.md#quick-start)
 - **Authenticate admins or end users** → see [Authentication](README.md#authentication)
 - **Upload and manage files** → see [Assets](README.md#assets)
-- **Browse the full surface area** → use [API_SUMMARY.md](API_SUMMARY.md) as reference
+- **Browse the full surface area** → use [API_SUMMARY.md](docs/API_SUMMARY.md) as reference
 
 For the full list of functions and types, see the API summary:
-→ [API Summary](API_SUMMARY.md)
+→ [API Summary](docs/API_SUMMARY.md)
 
 **Documentation:**
 - [AI & Chat Completions](docs/ai.md) - Chat completions, RAG, voice integration

package/dist/api/authKit.d.ts

@@ -18,6 +18,11 @@ export declare namespace authKit {
      *   `trustDevice: true`), pass it here to skip the challenge entirely as long as it's
      *   still valid. If it's revoked/expired, the server silently falls back to requiring a
      *   fresh challenge — `login()` just returns `MFA_REQUIRED` again, no special handling.
+     *
+     * Security errors (thrown as `SmartlinksApiError`, see {@link LoginSecurityErrorCode}):
+     * - `ACCOUNT_TEMPORARILY_LOCKED` (429) — `err.details.retryAfterSeconds` says how long to wait.
+     * - `PASSWORD_EXPIRED` (403) — `err.details.resetToken` is short-lived; route into
+     *   {@link completePasswordReset} to change the password in place.
      */
     function login(clientId: string, email: string, password: string, trustedDeviceToken?: string): Promise<AuthLoginResponse>;
     /**
@@ -25,6 +30,11 @@ export declare namespace authKit {
      *
      * Not gated by step-up MFA — a brand-new user has no enrolled factors yet, so there's
      * nothing to challenge against.
+     *
+     * The new password is validated against the collection's `passwordPolicy` — may throw
+     * a {@link PasswordPolicyErrorCode} (400). The same validation applies to
+     * {@link completePasswordReset} and {@link changePassword}. Read the policy for a live
+     * checklist from `authKit.load(clientId)` → `config.security.passwordPolicy`.
      */
     function register(clientId: string, data: {
         email: string;

package/dist/api/authKit.js

@@ -22,6 +22,11 @@ export var authKit;
      *   `trustDevice: true`), pass it here to skip the challenge entirely as long as it's
      *   still valid. If it's revoked/expired, the server silently falls back to requiring a
      *   fresh challenge — `login()` just returns `MFA_REQUIRED` again, no special handling.
+     *
+     * Security errors (thrown as `SmartlinksApiError`, see {@link LoginSecurityErrorCode}):
+     * - `ACCOUNT_TEMPORARILY_LOCKED` (429) — `err.details.retryAfterSeconds` says how long to wait.
+     * - `PASSWORD_EXPIRED` (403) — `err.details.resetToken` is short-lived; route into
+     *   {@link completePasswordReset} to change the password in place.
      */
     async function login(clientId, email, password, trustedDeviceToken) {
         const body = { email, password };
@@ -40,6 +45,11 @@ export var authKit;
      *
      * Not gated by step-up MFA — a brand-new user has no enrolled factors yet, so there's
      * nothing to challenge against.
+     *
+     * The new password is validated against the collection's `passwordPolicy` — may throw
+     * a {@link PasswordPolicyErrorCode} (400). The same validation applies to
+     * {@link completePasswordReset} and {@link changePassword}. Read the policy for a live
+     * checklist from `authKit.load(clientId)` → `config.security.passwordPolicy`.
      */
     async function register(clientId, data) {
         return post(`/authkit/${encodeURIComponent(clientId)}/auth/register`, data);

package/dist/api/proof.d.ts

@@ -12,11 +12,34 @@ export declare namespace proof {
     /**
      * Create a proof for a product (admin only).
      * POST /admin/collection/:collectionId/product/:productId/proof
+     *
+     * Pass the proof's content in a `proof` block, keyed by zone (see {@link ProofWrite}):
+     * ```ts
+     * proof.create(collectionId, productId, {
+     *   proof: {
+     *     values: { colour: 'red' },   // public + owner readable, owner + admin writable
+     *     data:   { serialNo: 1001 },  // public + owner readable, ADMIN-only writable
+     *     admin:  { costPrice: 4.20 }, // admin-only
+     *   },
+     *   claimable: true,
+     * })
+     * ```
+     * Note: a top-level `data`/`admin` on the request body is legacy — top-level
+     * `data` gets folded into the values bag, so use `proof.data` for `proof.data`.
      */
-    function create(collectionId: string, productId: string, values: ProofCreateRequest): Promise<ProofResponse>;
+    function create(collectionId: string, productId: string, request: ProofCreateRequest): Promise<ProofResponse>;
     /**
      * Update a proof for a product (admin only).
      * PUT /admin/collection/:collectionId/product/:productId/proof/:proofId
+     *
+     * Pass the fields to change **at the root**, keyed by zone (see {@link ProofWrite}):
+     * ```ts
+     * proof.update(collectionId, productId, proofId, {
+     *   data:   { serialNo: 1002 },   // → proof.data (admin-only writable)
+     *   values: { colour: 'blue' },   // → proof.values
+     * })
+     * ```
+     * Object zones deep-merge, so you can change one field without wiping the rest.
      */
     function update(collectionId: string, productId: string, proofId: string, values: ProofUpdateRequest): Promise<ProofResponse>;
     /**

package/dist/api/proof.js

@@ -26,15 +26,38 @@ export var proof;
     /**
      * Create a proof for a product (admin only).
      * POST /admin/collection/:collectionId/product/:productId/proof
+     *
+     * Pass the proof's content in a `proof` block, keyed by zone (see {@link ProofWrite}):
+     * ```ts
+     * proof.create(collectionId, productId, {
+     *   proof: {
+     *     values: { colour: 'red' },   // public + owner readable, owner + admin writable
+     *     data:   { serialNo: 1001 },  // public + owner readable, ADMIN-only writable
+     *     admin:  { costPrice: 4.20 }, // admin-only
+     *   },
+     *   claimable: true,
+     * })
+     * ```
+     * Note: a top-level `data`/`admin` on the request body is legacy — top-level
+     * `data` gets folded into the values bag, so use `proof.data` for `proof.data`.
      */
-    async function create(collectionId, productId, values) {
+    async function create(collectionId, productId, request) {
         const path = `/admin/collection/${encodeURIComponent(collectionId)}/product/${encodeURIComponent(productId)}/proof`;
-        return post(path, values);
+        return post(path, request);
     }
     proof.create = create;
     /**
      * Update a proof for a product (admin only).
      * PUT /admin/collection/:collectionId/product/:productId/proof/:proofId
+     *
+     * Pass the fields to change **at the root**, keyed by zone (see {@link ProofWrite}):
+     * ```ts
+     * proof.update(collectionId, productId, proofId, {
+     *   data:   { serialNo: 1002 },   // → proof.data (admin-only writable)
+     *   values: { colour: 'blue' },   // → proof.values
+     * })
+     * ```
+     * Object zones deep-merge, so you can change one field without wiping the rest.
      */
     async function update(collectionId, productId, proofId, values) {
         const path = `/admin/collection/${encodeURIComponent(collectionId)}/product/${encodeURIComponent(productId)}/proof/${encodeURIComponent(proofId)}`;

package/dist/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 1.15.18  |  Generated: 2026-08-19T06:40:47.505Z
+Version: 1.15.19  |  Generated: 2026-08-20T18:06:08.134Z
 
 This is a concise summary of all available API functions and types.
 
@@ -3464,6 +3464,55 @@ interface AuthKitConfig {
   supportEmail?: string
   redirectUrl?: string
   updatedAt?: string
+  * Per-collection security policy. On the public config endpoint only
+  * `passwordPolicy` + `session` are returned (the client renders password
+  * checklists / idle sign-out from them); `lockout` is admin-only and enforced
+  * server-side. See {@link AuthKitSecurityConfig}.
+  security?: AuthKitSecurityConfig
+}
+```
+
+**AuthKitSecurityConfig** (interface)
+```typescript
+interface AuthKitSecurityConfig {
+  passwordPolicy?: AuthKitPasswordPolicy
+  session?: AuthKitSessionPolicy
+  lockout?: AuthKitLockoutPolicy
+}
+```
+
+**AuthKitPasswordPolicy** (interface)
+```typescript
+interface AuthKitPasswordPolicy {
+  minLength?: number
+  requireUppercase?: boolean
+  requireLowercase?: boolean
+  requireNumber?: boolean
+  requireSymbol?: boolean
+  blockCommonPasswords?: boolean
+  expiryDays?: number
+  historyCount?: number
+}
+```
+
+**AuthKitSessionPolicy** (interface)
+```typescript
+interface AuthKitSessionPolicy {
+  inactivityTimeoutMinutes?: number
+  inactivityWarningSeconds?: number
+  absoluteTimeoutHours?: number
+  rememberMe?: boolean
+}
+```
+
+**AuthKitLockoutPolicy** (interface)
+```typescript
+interface AuthKitLockoutPolicy {
+  enabled?: boolean
+  maxFailedAttempts?: number
+  attemptWindowMinutes?: number
+  lockoutMinutes?: number
+  notifyUserOnLockout?: boolean
 }
 ```
 
@@ -3475,6 +3524,10 @@ interface AuthKitConfig {
 
 **VerifyStatus** = `'pending' | 'verified' | 'failed' | 'expired' | 'unknown'`
 
+**PasswordPolicyErrorCode** = ``
+
+**LoginSecurityErrorCode** = ``
+
 ### batch
 
 **FirebaseTimestamp** (interface)
@@ -7279,14 +7332,36 @@ interface Proof {
 }
 ```
 
-**ProofCreateRequest** (interface)
+**ProofWrite** (interface)
 ```typescript
-interface ProofCreateRequest {
-  values: ProofValues
+interface ProofWrite {
+  * Choose the proof's ID (serial, NFC id, etc.). Honoured **on create only** —
+  * the ledger doc becomes `{productId}-{id}`. Omit to auto-generate. Ignored on
+  * update (a proof's ID is immutable).
+  id?: string
+  values?: ProofValues
   data?: Record<string, JsonValue>
   admin?: Record<string, JsonValue>
+  owner?: Record<string, JsonValue>
+  claimable?: boolean
+  [key: string]: JsonValue | Record<string, JsonValue> | ProofValues | undefined
+}
+```
+
+**ProofCreateRequest** (interface)
+```typescript
+interface ProofCreateRequest {
+  * The proof to create, by zone (mirrors the proof document). This is the clear,
+  * recommended shape — `create(collectionId, productId, { proof: {...} })`.
+  proof?: ProofWrite
+  values?: ProofValues
   claimable?: boolean
   virtual?: boolean
+  core?: ProofWrite
+  * @deprecated On the request body this is folded into the **values bag**
+  * (public + owner-writable) — NOT `proof.data`. Use `proof.data`.
+  data?: Record<string, JsonValue>
+  admin?: Record<string, JsonValue>
 }
 ```
 
@@ -7343,7 +7418,7 @@ interface RedeemGrantOptions {
 
 **ProofResponse** = `Proof`
 
-**ProofUpdateRequest** = `Partial<ProofCreateRequest>`
+**ProofUpdateRequest** = `Partial<ProofWrite> & { proof?: ProofWrite }`
 
 **ProofClaimRequest** = `Record<string, any>`
 
@@ -8748,10 +8823,10 @@ Gets current account information for the logged in user. Returns user, owner, ac
 ### authKit
 
 **login**(clientId: string, email: string, password: string, trustedDeviceToken?: string) → `Promise<AuthLoginResponse>`
-Login with email + password (public). When the client's MFA policy requires a step-up, the server returns **403 `MFA_REQUIRED`** instead of a session — `login()` throws a `SmartlinksApiError` with `err.errorResponse?.errorCode === 'MFA_REQUIRED'` and the challenge details in `err.details` (see {@link MfaRequiredDetails}). Route the caller to {@link mfaChallengeSend} on that error; this method's return type is unchanged. returned one (via {@link mfaChallengeVerify}/{@link mfaRecoveryCode} with `trustDevice: true`), pass it here to skip the challenge entirely as long as it's still valid. If it's revoked/expired, the server silently falls back to requiring a fresh challenge — `login()` just returns `MFA_REQUIRED` again, no special handling.
+Login with email + password (public). When the client's MFA policy requires a step-up, the server returns **403 `MFA_REQUIRED`** instead of a session — `login()` throws a `SmartlinksApiError` with `err.errorResponse?.errorCode === 'MFA_REQUIRED'` and the challenge details in `err.details` (see {@link MfaRequiredDetails}). Route the caller to {@link mfaChallengeSend} on that error; this method's return type is unchanged. returned one (via {@link mfaChallengeVerify}/{@link mfaRecoveryCode} with `trustDevice: true`), pass it here to skip the challenge entirely as long as it's still valid. If it's revoked/expired, the server silently falls back to requiring a fresh challenge — `login()` just returns `MFA_REQUIRED` again, no special handling. Security errors (thrown as `SmartlinksApiError`, see {@link LoginSecurityErrorCode}): - `ACCOUNT_TEMPORARILY_LOCKED` (429) — `err.details.retryAfterSeconds` says how long to wait. - `PASSWORD_EXPIRED` (403) — `err.details.resetToken` is short-lived; route into {@link completePasswordReset} to change the password in place.
 
 **register**(clientId: string, data: { email: string; password: string; displayName?: string; accountData?: Record<string, any> }) → `Promise<AuthLoginResponse>`
-Register a new user (public). Not gated by step-up MFA — a brand-new user has no enrolled factors yet, so there's nothing to challenge against.
+Register a new user (public). Not gated by step-up MFA — a brand-new user has no enrolled factors yet, so there's nothing to challenge against. The new password is validated against the collection's `passwordPolicy` — may throw a {@link PasswordPolicyErrorCode} (400). The same validation applies to {@link completePasswordReset} and {@link changePassword}. Read the policy for a live checklist from `authKit.load(clientId)` → `config.security.passwordPolicy`.
 
 **googleLogin**(clientId: string, idToken: string, trustedDeviceToken?: string) → `Promise<AuthLoginResponse>`
 Google OAuth login via ID token (public). Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape. {@link mfaChallengeVerify}/{@link mfaRecoveryCode} (with `trustDevice: true`) to skip the challenge on this device, same as {@link login}.
@@ -9952,14 +10027,14 @@ List all Proofs for a Collection.
 
 **create**(collectionId: string,
     productId: string,
-    values: ProofCreateRequest) → `Promise<ProofResponse>`
-Create a proof for a product (admin only). POST /admin/collection/:collectionId/product/:productId/proof
+    request: ProofCreateRequest) → `Promise<ProofResponse>`
+Create a proof for a product (admin only). POST /admin/collection/:collectionId/product/:productId/proof Pass the proof's content in a `proof` block, keyed by zone (see {@link ProofWrite}): ```ts proof.create(collectionId, productId, { proof: { values: { colour: 'red' },   // public + owner readable, owner + admin writable data:   { serialNo: 1001 },  // public + owner readable, ADMIN-only writable admin:  { costPrice: 4.20 }, // admin-only }, claimable: true, }) ``` Note: a top-level `data`/`admin` on the request body is legacy — top-level `data` gets folded into the values bag, so use `proof.data` for `proof.data`.
 
 **update**(collectionId: string,
     productId: string,
     proofId: string,
     values: ProofUpdateRequest) → `Promise<ProofResponse>`
-Update a proof for a product (admin only). PUT /admin/collection/:collectionId/product/:productId/proof/:proofId
+Update a proof for a product (admin only). PUT /admin/collection/:collectionId/product/:productId/proof/:proofId Pass the fields to change **at the root**, keyed by zone (see {@link ProofWrite}): ```ts proof.update(collectionId, productId, proofId, { data:   { serialNo: 1002 },   // → proof.data (admin-only writable) values: { colour: 'blue' },   // → proof.values }) ``` Object zones deep-merge, so you can change one field without wiping the rest.
 
 **claim**(collectionId: string,
     productId: string,

package/dist/docs/auth-kit.md

@@ -502,6 +502,79 @@ await authKit.completePasswordReset(clientId, tokenFromUrl, 'newSecurePassword')
 
 ---
 
+## Account security policy
+
+Each collection can configure account-security rules (via the admin console). **The API
+enforces all of it**; your login UI reads the policy for UX only (a live password checklist,
+idle sign-out). Read it from the config:
+
+```ts
+const config = await authKit.load(clientId);
+const policy  = config.security?.passwordPolicy; // min length, char classes, block-common
+const session = config.security?.session;        // inactivity + absolute timeouts, rememberMe
+```
+
+`lockout` values are admin-only and never returned here.
+
+### Password policy
+
+`register`, `completePasswordReset`, and `changePassword` validate the new password
+server-side and throw a `SmartlinksApiError` with a {@link PasswordPolicyErrorCode}:
+
+| `errorCode` (400) | Meaning |
+|---|---|
+| `PASSWORD_TOO_SHORT` | below `minLength` |
+| `PASSWORD_REQUIREMENTS_NOT_MET` | missing a required character class |
+| `PASSWORD_TOO_COMMON` | on the common/breached list |
+| `PASSWORD_RECENTLY_USED` | matched one of the last `historyCount` passwords |
+
+Render a live checklist from `policy` so users see the rules before submitting.
+
+### Lockout
+
+After too many failed logins the account is temporarily locked. `login` throws:
+
+```ts
+try {
+  await authKit.login(clientId, email, password);
+} catch (err) {
+  if (err.errorCode === 'ACCOUNT_TEMPORARILY_LOCKED') {
+    const mins = Math.ceil(err.details.retryAfterSeconds / 60);
+    show(`Too many attempts. Try again in ${mins} minute(s).`);
+  }
+}
+```
+
+Failed MFA challenges count toward the same lock. Locking responds identically for unknown
+accounts (no enumeration).
+
+### Password expiry
+
+If a password is older than `passwordPolicy.expiryDays`, a valid login is refused with
+**403 `PASSWORD_EXPIRED`** carrying a short-lived `resetToken` — send the user straight into
+the reset form to change it in place:
+
+```ts
+catch (err) {
+  if (err.errorCode === 'PASSWORD_EXPIRED') {
+    await authKit.completePasswordReset(clientId, err.details.resetToken, newPassword);
+  }
+}
+```
+
+### Session lifetime
+
+- **Absolute timeout** (`session.absoluteTimeoutHours`) is enforced server-side on the native
+  refresh path: once the session is too old, `refreshToken` throws **401 `SESSION_EXPIRED`**
+  (see {@link RefreshErrorCode}) — clear storage and route to login. Web sessions use the
+  stateless bearer token and rely on inactivity sign-out below.
+- **Inactivity timeout** (`session.inactivityTimeoutMinutes` / `inactivityWarningSeconds`) is
+  **client-enforced** — sign the user out after idle, warning first. Sync across tabs.
+- **`session.rememberMe: false`** → don't persist tokens to durable storage; treat the session
+  as browser-scoped.
+
+---
+
 ## Relationship to other parts of the SDK
 
 | Concern | Where it lives |

package/dist/index.d.ts

@@ -17,7 +17,7 @@ export type { AdditionalGtin, ISODateString, JsonPrimitive, JsonValue, ProductCr
 export type { TranslationLookupMode, TranslationContentType, TranslationQuality, TranslationItemStatus, TranslationContextValue, TranslationContext, TranslationLookupRequestBase, TranslationLookupSingleRequest, TranslationLookupBatchRequest, TranslationLookupRequest, TranslationLookupItem, TranslationLookupResponse, ResolvedTranslationItem, ResolvedTranslationResponse, TranslationHashOptions, TranslationResolveOptions, TranslationRecord, TranslationListParams, TranslationListResponse, TranslationUpdateRequest, } from "./types/translations";
 export type { FacetBucket, FacetDefinition, FacetDefinitionWriteInput, FacetGetParams, FacetListParams, FacetListResponse, FacetNamespaceListResponse, FacetQueryRequest, FacetQueryResponse, FacetValue, FacetValueDefinition, FacetValueGetParams, FacetValueListParams, FacetValueListResponse, FacetValueResponse, FacetValueWriteInput, PublicFacetListParams, } from "./types/facets";
 export type { Collection, CollectionResponse, CollectionCreateRequest, CollectionUpdateRequest, DomainTarget, HubAvailabilityResponse, } from "./types/collection";
-export type { Proof, ProofResponse, ProofCreateRequest, ProofUpdateRequest, ProofClaimRequest, ProofGrant, GrantScope, GrantAudience, CreateGrantOptions, RedeemGrantOptions, RedeemGrantResult, } from "./types/proof";
+export type { Proof, ProofResponse, ProofWrite, ProofCreateRequest, ProofUpdateRequest, ProofClaimRequest, ProofGrant, GrantScope, GrantAudience, CreateGrantOptions, RedeemGrantOptions, RedeemGrantResult, } from "./types/proof";
 export type { QrShortCodeLookupResponse, } from "./types/qr";
 export type { ReverseTagLookupParams, ReverseTagLookupResponse, } from "./types/tags";
 export type { AdminMobileCapability, ActionableCapability, AdminMobileHostId, AdminMobileEvent, AdminMobileEventCallback, AdminMobileEventSubscriber, ScannerEventSubscriber, // @deprecated — use AdminMobileEventCallback
@@ -25,4 +25,4 @@ AdminMobileHostContext, AdminMobileComponentManifest, AdminMobileBundleManifest,
 MobileAdminBundleManifest, } from './mobile-admin/types';
 export { HostCapabilityUnavailableError, HostPermissionDeniedError, HostTimeoutError, } from './mobile-admin/errors';
 export type { NativeCapability, NativeFacade, ShareFacade, ClipboardFacade, HapticImpactStyle, HapticNotificationStyle, HapticsFacade, NetworkStatus, NetworkFacade, DeviceInfo, DeviceFacade, StorageFacade, QrScanOptions, QrFacade, AuthFacade, NfcReadResult, NfcFacade, RfidScanOptions, RfidFacade, EventsFacade, WebSourceMode, WebSourceConfig, WebSourceFacade, } from './native/types';
-export type { AuthKitUser, UserProfile, ProfileUpdateData, UpdateProfileResponse, SuccessResponse, AuthLoginResponse, AppleLoginOptions, AuthKitErrorCode, RefreshResponse, LogoutResponse, RefreshErrorCode, MagicLinkSendResponse, MagicLinkVerifyResponse, PhoneSendCodeResponse, PhoneVerifyResponse, PasswordResetRequestResponse, VerifyResetTokenResponse, PasswordResetCompleteResponse, EmailVerificationActionResponse, EmailVerifyTokenResponse, VerifyStatus, WhatsAppReplyCta, WhatsAppReplyOptions, WhatsAppContactData, SendWhatsAppRequest, SendWhatsAppResponse, ExchangeWhatsAppSessionResponse, VerifyWhatsAppResponse, WhatsAppStatusResponse, SendSmsVerifyRequest, SendSmsVerifyResponse, VerifySmsResponse, UpsertContactRequest, UpsertContactResponse, AuthKitBrandingConfig, AuthKitConfig, } from './types/authKit';
+export type { AuthKitUser, UserProfile, ProfileUpdateData, UpdateProfileResponse, SuccessResponse, AuthLoginResponse, AppleLoginOptions, AuthKitErrorCode, RefreshResponse, LogoutResponse, RefreshErrorCode, MagicLinkSendResponse, MagicLinkVerifyResponse, PhoneSendCodeResponse, PhoneVerifyResponse, PasswordResetRequestResponse, VerifyResetTokenResponse, PasswordResetCompleteResponse, EmailVerificationActionResponse, EmailVerifyTokenResponse, VerifyStatus, WhatsAppReplyCta, WhatsAppReplyOptions, WhatsAppContactData, SendWhatsAppRequest, SendWhatsAppResponse, ExchangeWhatsAppSessionResponse, VerifyWhatsAppResponse, WhatsAppStatusResponse, SendSmsVerifyRequest, SendSmsVerifyResponse, VerifySmsResponse, UpsertContactRequest, UpsertContactResponse, AuthKitBrandingConfig, AuthKitConfig, AuthKitSecurityConfig, AuthKitPasswordPolicy, AuthKitSessionPolicy, AuthKitLockoutPolicy, PasswordPolicyErrorCode, LoginSecurityErrorCode, } from './types/authKit';

package/dist/openapi.yaml

@@ -8401,7 +8401,7 @@ paths:
     post:
       tags:
         - authKit
-      summary: Login with email + password (public).
+      summary: authKit.login
       operationId: authKit_login
       security: []
       parameters:
@@ -19381,8 +19381,69 @@ components:
           type: string
         updatedAt:
           type: string
+        security:
+          $ref: "#/components/schemas/AuthKitSecurityConfig"
       required:
         - id
+    AuthKitSecurityConfig:
+      type: object
+      properties:
+        passwordPolicy:
+          $ref: "#/components/schemas/AuthKitPasswordPolicy"
+        session:
+          $ref: "#/components/schemas/AuthKitSessionPolicy"
+        lockout:
+          $ref: "#/components/schemas/AuthKitLockoutPolicy"
+    AuthKitPasswordPolicy:
+      type: object
+      properties:
+        minLength:
+          type: number
+        requireUppercase:
+          type: boolean
+        requireLowercase:
+          type: boolean
+        requireNumber:
+          type: boolean
+        requireSymbol:
+          type: boolean
+        blockCommonPasswords:
+          type: boolean
+        expiryDays:
+          type: number
+        historyCount:
+          type: number
+    AuthKitSessionPolicy:
+      type: object
+      properties:
+        inactivityTimeoutMinutes:
+          type: number
+        inactivityWarningSeconds:
+          type: number
+        absoluteTimeoutHours:
+          type: number
+        rememberMe:
+          type: boolean
+    AuthKitLockoutPolicy:
+      type: object
+      properties:
+        enabled:
+          type: boolean
+        maxFailedAttempts:
+          type: number
+        attemptWindowMinutes:
+          type: number
+        lockoutMinutes:
+          type: number
+        notifyUserOnLockout:
+          type: boolean
+    PasswordPolicyErrorCode:
+      type: string
+      enum:
+        - PASSWORD_TOO_SHORT
+        - PASSWORD_REQUIREMENTS_NOT_MET
+        - PASSWORD_TOO_COMMON
+        - PASSWORD_RECENTLY_USED
     FirebaseTimestamp:
       type: object
       properties:
@@ -24994,9 +25055,11 @@ components:
         - tokenId
         - userId
         - values
-    ProofCreateRequest:
+    ProofWrite:
       type: object
       properties:
+        id:
+          type: string
         values:
           $ref: "#/components/schemas/ProofValues"
         data:
@@ -25007,12 +25070,33 @@ components:
           type: object
           additionalProperties:
             $ref: "#/components/schemas/JsonValue"
+        owner:
+          type: object
+          additionalProperties:
+            $ref: "#/components/schemas/JsonValue"
+        claimable:
+          type: boolean
+    ProofCreateRequest:
+      type: object
+      properties:
+        proof:
+          $ref: "#/components/schemas/ProofWrite"
+        values:
+          $ref: "#/components/schemas/ProofValues"
         claimable:
           type: boolean
         virtual:
           type: boolean
-      required:
-        - values
+        core:
+          $ref: "#/components/schemas/ProofWrite"
+        data:
+          type: object
+          additionalProperties:
+            $ref: "#/components/schemas/JsonValue"
+        admin:
+          type: object
+          additionalProperties:
+            $ref: "#/components/schemas/JsonValue"
     ProofFieldsConfig:
       type: object
       properties:
@@ -25096,9 +25180,6 @@ components:
       properties:
         guestName:
           type: string
-    ProofResponse:
-      type: object
-      additionalProperties: true
     QrShortCodeLookupResponse:
       type: object
       properties:

package/dist/types/authKit.d.ts

@@ -89,8 +89,11 @@ export interface LogoutResponse {
  * - `INVALID_REFRESH_TOKEN` (401) — unknown / expired / revoked / wrong client → `logout()` + route to login.
  * - `REFRESH_TOKEN_REUSE_DETECTED` (401) — a consumed token was replayed; the **entire session
  *   family was revoked server-side**. Hard logout: clear storage, force re-login.
+ * - `SESSION_EXPIRED` (401) — the session hit the collection's absolute session timeout
+ *   (`security.session.absoluteTimeoutHours`). Clear storage and route to login. Distinct from
+ *   `INVALID_REFRESH_TOKEN` so the UI can message "your session expired" rather than an error.
  */
-export type RefreshErrorCode = 'MISSING_REFRESH_TOKEN' | 'INVALID_REFRESH_TOKEN' | 'REFRESH_TOKEN_REUSE_DETECTED';
+export type RefreshErrorCode = 'MISSING_REFRESH_TOKEN' | 'INVALID_REFRESH_TOKEN' | 'REFRESH_TOKEN_REUSE_DETECTED' | 'SESSION_EXPIRED';
 /**
  * Options for {@link authKit.appleLogin}. All fields are optional — only the
  * `identityToken` (passed as a positional argument) is required by the server.
@@ -397,4 +400,67 @@ export interface AuthKitConfig {
     supportEmail?: string;
     redirectUrl?: string;
     updatedAt?: string;
+    /**
+     * Per-collection security policy. On the public config endpoint only
+     * `passwordPolicy` + `session` are returned (the client renders password
+     * checklists / idle sign-out from them); `lockout` is admin-only and enforced
+     * server-side. See {@link AuthKitSecurityConfig}.
+     */
+    security?: AuthKitSecurityConfig;
+}
+/**
+ * Per-collection account-security policy. The API **enforces** all of this; the
+ * client uses `passwordPolicy` (live checklist) and `session` (idle sign-out) for UX.
+ */
+export interface AuthKitSecurityConfig {
+    passwordPolicy?: AuthKitPasswordPolicy;
+    session?: AuthKitSessionPolicy;
+    /** Admin-only; never returned on the public config endpoint. */
+    lockout?: AuthKitLockoutPolicy;
+}
+export interface AuthKitPasswordPolicy {
+    minLength?: number;
+    requireUppercase?: boolean;
+    requireLowercase?: boolean;
+    requireNumber?: boolean;
+    requireSymbol?: boolean;
+    blockCommonPasswords?: boolean;
+    /** 0 = never expires. */
+    expiryDays?: number;
+    /** 0 = reuse allowed. */
+    historyCount?: number;
+}
+export interface AuthKitSessionPolicy {
+    /** 0 = never (client-enforced idle sign-out). */
+    inactivityTimeoutMinutes?: number;
+    inactivityWarningSeconds?: number;
+    /** 0 = use token lifetime. Enforced server-side on the native refresh path (→ `SESSION_EXPIRED`). */
+    absoluteTimeoutHours?: number;
+    rememberMe?: boolean;
+}
+/** Admin-only lockout policy (operational; not exposed publicly). */
+export interface AuthKitLockoutPolicy {
+    enabled?: boolean;
+    maxFailedAttempts?: number;
+    attemptWindowMinutes?: number;
+    lockoutMinutes?: number;
+    notifyUserOnLockout?: boolean;
 }
+/**
+ * Password-policy validation errors (400) returned by `register`, `completePasswordReset`,
+ * and `changePassword`. Surfaced via `SmartlinksApiError.errorCode`.
+ * - `PASSWORD_TOO_SHORT` — below `passwordPolicy.minLength`.
+ * - `PASSWORD_REQUIREMENTS_NOT_MET` — missing a required character class.
+ * - `PASSWORD_TOO_COMMON` — matched the common/breached list.
+ * - `PASSWORD_RECENTLY_USED` — matched one of the last `historyCount` passwords.
+ */
+export type PasswordPolicyErrorCode = 'PASSWORD_TOO_SHORT' | 'PASSWORD_REQUIREMENTS_NOT_MET' | 'PASSWORD_TOO_COMMON' | 'PASSWORD_RECENTLY_USED';
+/**
+ * Security errors returned by `login`. Surfaced via `SmartlinksApiError.errorCode`,
+ * with extra fields in `SmartlinksApiError.details`:
+ * - `ACCOUNT_TEMPORARILY_LOCKED` (429) — too many failed attempts; `details.retryAfterSeconds`
+ *   says how long to wait. Show a "try again in N minutes" message.
+ * - `PASSWORD_EXPIRED` (403) — password older than `passwordPolicy.expiryDays`; `details.resetToken`
+ *   is a short-lived token — send the user straight into `completePasswordReset()` to change it in place.
+ */
+export type LoginSecurityErrorCode = 'ACCOUNT_TEMPORARILY_LOCKED' | 'PASSWORD_EXPIRED';

package/dist/types/proof.d.ts

@@ -40,16 +40,71 @@ export interface Proof {
     values: ProofValues;
 }
 export type ProofResponse = Proof;
-export interface ProofCreateRequest {
-    values: ProofValues;
-    /** Business-writable public spec data. */
+/**
+ * The proof's writable content, addressed by zone. Its keys mirror the proof
+ * document, so what you pass is what the proof looks like. Each zone has its own
+ * read/write visibility:
+ *
+ * | Zone     | Stored at      | Readable by            | Writable by   |
+ * |----------|----------------|------------------------|---------------|
+ * | `values` | `proof.values` | public + owner + admin | owner + admin |
+ * | `data`   | `proof.data`   | public + owner + admin | admin only    |
+ * | `admin`  | `proof.admin`  | admin only             | admin only    |
+ * | `owner`  | `proof.owner`  | admin only             | admin only    |
+ *
+ * Use `data` for business fields everyone should *see* but only the business
+ * should *set* (e.g. a serial number). Use `admin` for fields only the business
+ * should see at all. On update, object zones deep-merge.
+ */
+export interface ProofWrite {
+    /**
+     * Choose the proof's ID (serial, NFC id, etc.). Honoured **on create only** —
+     * the ledger doc becomes `{productId}-{id}`. Omit to auto-generate. Ignored on
+     * update (a proof's ID is immutable).
+     */
+    id?: string;
+    /** Owner + business-writable consumer data. Public + owner readable. → `proof.values` */
+    values?: ProofValues;
+    /** Business spec data (e.g. serialNo). Public + owner readable, admin-only writable. → `proof.data` */
     data?: Record<string, JsonValue>;
-    /** Business-only spec data. */
+    /** Business-only spec data — admin-only read & write (stripped from public + owner). → `proof.admin` */
     admin?: Record<string, JsonValue>;
+    /** Business-only root data — admin-only. → `proof.owner` */
+    owner?: Record<string, JsonValue>;
+    /** Is this proof available to be claimed. */
+    claimable?: boolean;
+    /** Any other named root field. */
+    [key: string]: JsonValue | Record<string, JsonValue> | ProofValues | undefined;
+}
+export interface ProofCreateRequest {
+    /**
+     * The proof to create, by zone (mirrors the proof document). This is the clear,
+     * recommended shape — `create(collectionId, productId, { proof: {...} })`.
+     */
+    proof?: ProofWrite;
+    /** Owner + business-writable consumer data (→ `proof.values`). Same as `proof.values`. */
+    values?: ProofValues;
+    /** Canonical root `claimable` flag (also accepted as `proof.claimable`). */
     claimable?: boolean;
     virtual?: boolean;
+    /** @deprecated Legacy alias for `proof`. Use `proof`. */
+    core?: ProofWrite;
+    /**
+     * @deprecated On the request body this is folded into the **values bag**
+     * (public + owner-writable) — NOT `proof.data`. Use `proof.data`.
+     */
+    data?: Record<string, JsonValue>;
+    /** @deprecated Not routed to `proof.admin` on create — use `proof.admin`. */
+    admin?: Record<string, JsonValue>;
 }
-export type ProofUpdateRequest = Partial<ProofCreateRequest>;
+/**
+ * Update passes the proof's fields **at the root** — `update(c, p, id, { data: {...} })`
+ * sets `proof.data`, `{ values: {...} }` sets `proof.values`, etc. (A `proof` block is
+ * also accepted and routed the same way.) Object zones deep-merge.
+ */
+export type ProofUpdateRequest = Partial<ProofWrite> & {
+    proof?: ProofWrite;
+};
 export type ProofClaimRequest = Record<string, any>;
 /**
  * `'public'` (default, omitted) reads/writes `proof.values[key]`.

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 1.15.18  |  Generated: 2026-08-19T06:40:47.505Z
+Version: 1.15.19  |  Generated: 2026-08-20T18:06:08.134Z
 
 This is a concise summary of all available API functions and types.
 
@@ -3464,6 +3464,55 @@ interface AuthKitConfig {
   supportEmail?: string
   redirectUrl?: string
   updatedAt?: string
+  * Per-collection security policy. On the public config endpoint only
+  * `passwordPolicy` + `session` are returned (the client renders password
+  * checklists / idle sign-out from them); `lockout` is admin-only and enforced
+  * server-side. See {@link AuthKitSecurityConfig}.
+  security?: AuthKitSecurityConfig
+}
+```
+
+**AuthKitSecurityConfig** (interface)
+```typescript
+interface AuthKitSecurityConfig {
+  passwordPolicy?: AuthKitPasswordPolicy
+  session?: AuthKitSessionPolicy
+  lockout?: AuthKitLockoutPolicy
+}
+```
+
+**AuthKitPasswordPolicy** (interface)
+```typescript
+interface AuthKitPasswordPolicy {
+  minLength?: number
+  requireUppercase?: boolean
+  requireLowercase?: boolean
+  requireNumber?: boolean
+  requireSymbol?: boolean
+  blockCommonPasswords?: boolean
+  expiryDays?: number
+  historyCount?: number
+}
+```
+
+**AuthKitSessionPolicy** (interface)
+```typescript
+interface AuthKitSessionPolicy {
+  inactivityTimeoutMinutes?: number
+  inactivityWarningSeconds?: number
+  absoluteTimeoutHours?: number
+  rememberMe?: boolean
+}
+```
+
+**AuthKitLockoutPolicy** (interface)
+```typescript
+interface AuthKitLockoutPolicy {
+  enabled?: boolean
+  maxFailedAttempts?: number
+  attemptWindowMinutes?: number
+  lockoutMinutes?: number
+  notifyUserOnLockout?: boolean
 }
 ```
 
@@ -3475,6 +3524,10 @@ interface AuthKitConfig {
 
 **VerifyStatus** = `'pending' | 'verified' | 'failed' | 'expired' | 'unknown'`
 
+**PasswordPolicyErrorCode** = ``
+
+**LoginSecurityErrorCode** = ``
+
 ### batch
 
 **FirebaseTimestamp** (interface)
@@ -7279,14 +7332,36 @@ interface Proof {
 }
 ```
 
-**ProofCreateRequest** (interface)
+**ProofWrite** (interface)
 ```typescript
-interface ProofCreateRequest {
-  values: ProofValues
+interface ProofWrite {
+  * Choose the proof's ID (serial, NFC id, etc.). Honoured **on create only** —
+  * the ledger doc becomes `{productId}-{id}`. Omit to auto-generate. Ignored on
+  * update (a proof's ID is immutable).
+  id?: string
+  values?: ProofValues
   data?: Record<string, JsonValue>
   admin?: Record<string, JsonValue>
+  owner?: Record<string, JsonValue>
+  claimable?: boolean
+  [key: string]: JsonValue | Record<string, JsonValue> | ProofValues | undefined
+}
+```
+
+**ProofCreateRequest** (interface)
+```typescript
+interface ProofCreateRequest {
+  * The proof to create, by zone (mirrors the proof document). This is the clear,
+  * recommended shape — `create(collectionId, productId, { proof: {...} })`.
+  proof?: ProofWrite
+  values?: ProofValues
   claimable?: boolean
   virtual?: boolean
+  core?: ProofWrite
+  * @deprecated On the request body this is folded into the **values bag**
+  * (public + owner-writable) — NOT `proof.data`. Use `proof.data`.
+  data?: Record<string, JsonValue>
+  admin?: Record<string, JsonValue>
 }
 ```
 
@@ -7343,7 +7418,7 @@ interface RedeemGrantOptions {
 
 **ProofResponse** = `Proof`
 
-**ProofUpdateRequest** = `Partial<ProofCreateRequest>`
+**ProofUpdateRequest** = `Partial<ProofWrite> & { proof?: ProofWrite }`
 
 **ProofClaimRequest** = `Record<string, any>`
 
@@ -8748,10 +8823,10 @@ Gets current account information for the logged in user. Returns user, owner, ac
 ### authKit
 
 **login**(clientId: string, email: string, password: string, trustedDeviceToken?: string) → `Promise<AuthLoginResponse>`
-Login with email + password (public). When the client's MFA policy requires a step-up, the server returns **403 `MFA_REQUIRED`** instead of a session — `login()` throws a `SmartlinksApiError` with `err.errorResponse?.errorCode === 'MFA_REQUIRED'` and the challenge details in `err.details` (see {@link MfaRequiredDetails}). Route the caller to {@link mfaChallengeSend} on that error; this method's return type is unchanged. returned one (via {@link mfaChallengeVerify}/{@link mfaRecoveryCode} with `trustDevice: true`), pass it here to skip the challenge entirely as long as it's still valid. If it's revoked/expired, the server silently falls back to requiring a fresh challenge — `login()` just returns `MFA_REQUIRED` again, no special handling.
+Login with email + password (public). When the client's MFA policy requires a step-up, the server returns **403 `MFA_REQUIRED`** instead of a session — `login()` throws a `SmartlinksApiError` with `err.errorResponse?.errorCode === 'MFA_REQUIRED'` and the challenge details in `err.details` (see {@link MfaRequiredDetails}). Route the caller to {@link mfaChallengeSend} on that error; this method's return type is unchanged. returned one (via {@link mfaChallengeVerify}/{@link mfaRecoveryCode} with `trustDevice: true`), pass it here to skip the challenge entirely as long as it's still valid. If it's revoked/expired, the server silently falls back to requiring a fresh challenge — `login()` just returns `MFA_REQUIRED` again, no special handling. Security errors (thrown as `SmartlinksApiError`, see {@link LoginSecurityErrorCode}): - `ACCOUNT_TEMPORARILY_LOCKED` (429) — `err.details.retryAfterSeconds` says how long to wait. - `PASSWORD_EXPIRED` (403) — `err.details.resetToken` is short-lived; route into {@link completePasswordReset} to change the password in place.
 
 **register**(clientId: string, data: { email: string; password: string; displayName?: string; accountData?: Record<string, any> }) → `Promise<AuthLoginResponse>`
-Register a new user (public). Not gated by step-up MFA — a brand-new user has no enrolled factors yet, so there's nothing to challenge against.
+Register a new user (public). Not gated by step-up MFA — a brand-new user has no enrolled factors yet, so there's nothing to challenge against. The new password is validated against the collection's `passwordPolicy` — may throw a {@link PasswordPolicyErrorCode} (400). The same validation applies to {@link completePasswordReset} and {@link changePassword}. Read the policy for a live checklist from `authKit.load(clientId)` → `config.security.passwordPolicy`.
 
 **googleLogin**(clientId: string, idToken: string, trustedDeviceToken?: string) → `Promise<AuthLoginResponse>`
 Google OAuth login via ID token (public). Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape. {@link mfaChallengeVerify}/{@link mfaRecoveryCode} (with `trustDevice: true`) to skip the challenge on this device, same as {@link login}.
@@ -9952,14 +10027,14 @@ List all Proofs for a Collection.
 
 **create**(collectionId: string,
     productId: string,
-    values: ProofCreateRequest) → `Promise<ProofResponse>`
-Create a proof for a product (admin only). POST /admin/collection/:collectionId/product/:productId/proof
+    request: ProofCreateRequest) → `Promise<ProofResponse>`
+Create a proof for a product (admin only). POST /admin/collection/:collectionId/product/:productId/proof Pass the proof's content in a `proof` block, keyed by zone (see {@link ProofWrite}): ```ts proof.create(collectionId, productId, { proof: { values: { colour: 'red' },   // public + owner readable, owner + admin writable data:   { serialNo: 1001 },  // public + owner readable, ADMIN-only writable admin:  { costPrice: 4.20 }, // admin-only }, claimable: true, }) ``` Note: a top-level `data`/`admin` on the request body is legacy — top-level `data` gets folded into the values bag, so use `proof.data` for `proof.data`.
 
 **update**(collectionId: string,
     productId: string,
     proofId: string,
     values: ProofUpdateRequest) → `Promise<ProofResponse>`
-Update a proof for a product (admin only). PUT /admin/collection/:collectionId/product/:productId/proof/:proofId
+Update a proof for a product (admin only). PUT /admin/collection/:collectionId/product/:productId/proof/:proofId Pass the fields to change **at the root**, keyed by zone (see {@link ProofWrite}): ```ts proof.update(collectionId, productId, proofId, { data:   { serialNo: 1002 },   // → proof.data (admin-only writable) values: { colour: 'blue' },   // → proof.values }) ``` Object zones deep-merge, so you can change one field without wiping the rest.
 
 **claim**(collectionId: string,
     productId: string,

package/docs/auth-kit.md

@@ -502,6 +502,79 @@ await authKit.completePasswordReset(clientId, tokenFromUrl, 'newSecurePassword')
 
 ---
 
+## Account security policy
+
+Each collection can configure account-security rules (via the admin console). **The API
+enforces all of it**; your login UI reads the policy for UX only (a live password checklist,
+idle sign-out). Read it from the config:
+
+```ts
+const config = await authKit.load(clientId);
+const policy  = config.security?.passwordPolicy; // min length, char classes, block-common
+const session = config.security?.session;        // inactivity + absolute timeouts, rememberMe
+```
+
+`lockout` values are admin-only and never returned here.
+
+### Password policy
+
+`register`, `completePasswordReset`, and `changePassword` validate the new password
+server-side and throw a `SmartlinksApiError` with a {@link PasswordPolicyErrorCode}:
+
+| `errorCode` (400) | Meaning |
+|---|---|
+| `PASSWORD_TOO_SHORT` | below `minLength` |
+| `PASSWORD_REQUIREMENTS_NOT_MET` | missing a required character class |
+| `PASSWORD_TOO_COMMON` | on the common/breached list |
+| `PASSWORD_RECENTLY_USED` | matched one of the last `historyCount` passwords |
+
+Render a live checklist from `policy` so users see the rules before submitting.
+
+### Lockout
+
+After too many failed logins the account is temporarily locked. `login` throws:
+
+```ts
+try {
+  await authKit.login(clientId, email, password);
+} catch (err) {
+  if (err.errorCode === 'ACCOUNT_TEMPORARILY_LOCKED') {
+    const mins = Math.ceil(err.details.retryAfterSeconds / 60);
+    show(`Too many attempts. Try again in ${mins} minute(s).`);
+  }
+}
+```
+
+Failed MFA challenges count toward the same lock. Locking responds identically for unknown
+accounts (no enumeration).
+
+### Password expiry
+
+If a password is older than `passwordPolicy.expiryDays`, a valid login is refused with
+**403 `PASSWORD_EXPIRED`** carrying a short-lived `resetToken` — send the user straight into
+the reset form to change it in place:
+
+```ts
+catch (err) {
+  if (err.errorCode === 'PASSWORD_EXPIRED') {
+    await authKit.completePasswordReset(clientId, err.details.resetToken, newPassword);
+  }
+}
+```
+
+### Session lifetime
+
+- **Absolute timeout** (`session.absoluteTimeoutHours`) is enforced server-side on the native
+  refresh path: once the session is too old, `refreshToken` throws **401 `SESSION_EXPIRED`**
+  (see {@link RefreshErrorCode}) — clear storage and route to login. Web sessions use the
+  stateless bearer token and rely on inactivity sign-out below.
+- **Inactivity timeout** (`session.inactivityTimeoutMinutes` / `inactivityWarningSeconds`) is
+  **client-enforced** — sign the user out after idle, warning first. Sync across tabs.
+- **`session.rememberMe: false`** → don't persist tokens to durable storage; treat the session
+  as browser-scoped.
+
+---
+
 ## Relationship to other parts of the SDK
 
 | Concern | Where it lives |

package/openapi.yaml

@@ -8401,7 +8401,7 @@ paths:
     post:
       tags:
         - authKit
-      summary: Login with email + password (public).
+      summary: authKit.login
       operationId: authKit_login
       security: []
       parameters:
@@ -19381,8 +19381,69 @@ components:
           type: string
         updatedAt:
           type: string
+        security:
+          $ref: "#/components/schemas/AuthKitSecurityConfig"
       required:
         - id
+    AuthKitSecurityConfig:
+      type: object
+      properties:
+        passwordPolicy:
+          $ref: "#/components/schemas/AuthKitPasswordPolicy"
+        session:
+          $ref: "#/components/schemas/AuthKitSessionPolicy"
+        lockout:
+          $ref: "#/components/schemas/AuthKitLockoutPolicy"
+    AuthKitPasswordPolicy:
+      type: object
+      properties:
+        minLength:
+          type: number
+        requireUppercase:
+          type: boolean
+        requireLowercase:
+          type: boolean
+        requireNumber:
+          type: boolean
+        requireSymbol:
+          type: boolean
+        blockCommonPasswords:
+          type: boolean
+        expiryDays:
+          type: number
+        historyCount:
+          type: number
+    AuthKitSessionPolicy:
+      type: object
+      properties:
+        inactivityTimeoutMinutes:
+          type: number
+        inactivityWarningSeconds:
+          type: number
+        absoluteTimeoutHours:
+          type: number
+        rememberMe:
+          type: boolean
+    AuthKitLockoutPolicy:
+      type: object
+      properties:
+        enabled:
+          type: boolean
+        maxFailedAttempts:
+          type: number
+        attemptWindowMinutes:
+          type: number
+        lockoutMinutes:
+          type: number
+        notifyUserOnLockout:
+          type: boolean
+    PasswordPolicyErrorCode:
+      type: string
+      enum:
+        - PASSWORD_TOO_SHORT
+        - PASSWORD_REQUIREMENTS_NOT_MET
+        - PASSWORD_TOO_COMMON
+        - PASSWORD_RECENTLY_USED
     FirebaseTimestamp:
       type: object
       properties:
@@ -24994,9 +25055,11 @@ components:
         - tokenId
         - userId
         - values
-    ProofCreateRequest:
+    ProofWrite:
       type: object
       properties:
+        id:
+          type: string
         values:
           $ref: "#/components/schemas/ProofValues"
         data:
@@ -25007,12 +25070,33 @@ components:
           type: object
           additionalProperties:
             $ref: "#/components/schemas/JsonValue"
+        owner:
+          type: object
+          additionalProperties:
+            $ref: "#/components/schemas/JsonValue"
+        claimable:
+          type: boolean
+    ProofCreateRequest:
+      type: object
+      properties:
+        proof:
+          $ref: "#/components/schemas/ProofWrite"
+        values:
+          $ref: "#/components/schemas/ProofValues"
         claimable:
           type: boolean
         virtual:
           type: boolean
-      required:
-        - values
+        core:
+          $ref: "#/components/schemas/ProofWrite"
+        data:
+          type: object
+          additionalProperties:
+            $ref: "#/components/schemas/JsonValue"
+        admin:
+          type: object
+          additionalProperties:
+            $ref: "#/components/schemas/JsonValue"
     ProofFieldsConfig:
       type: object
       properties:
@@ -25096,9 +25180,6 @@ components:
       properties:
         guestName:
           type: string
-    ProofResponse:
-      type: object
-      additionalProperties: true
     QrShortCodeLookupResponse:
       type: object
       properties:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proveanything/smartlinks",
-  "version": "1.15.18",
+  "version": "1.15.19",
   "description": "Official JavaScript/TypeScript SDK for the Smartlinks API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",