@proveanything/smartlinks 1.15.18 → 1.15.20

package/README.md

@@ -41,10 +41,10 @@ If you're new to the SDK, this is the easiest path:
 - **Fetch collections/products** → see [Quick start](README.md#quick-start)
 - **Authenticate admins or end users** → see [Authentication](README.md#authentication)
 - **Upload and manage files** → see [Assets](README.md#assets)
-- **Browse the full surface area** → use [API_SUMMARY.md](API_SUMMARY.md) as reference
+- **Browse the full surface area** → use [API_SUMMARY.md](docs/API_SUMMARY.md) as reference
 
 For the full list of functions and types, see the API summary:
-→ [API Summary](API_SUMMARY.md)
+→ [API Summary](docs/API_SUMMARY.md)
 
 **Documentation:**
 - [AI & Chat Completions](docs/ai.md) - Chat completions, RAG, voice integration

package/dist/api/authKit.d.ts

@@ -1,4 +1,4 @@
-import type { AuthLoginResponse, AppleLoginOptions, RefreshResponse, LogoutResponse, PhoneSendCodeResponse, PhoneVerifyResponse, PasswordResetRequestResponse, VerifyResetTokenResponse, PasswordResetCompleteResponse, EmailVerificationActionResponse, EmailVerifyTokenResponse, AuthKitConfig, MagicLinkSendResponse, MagicLinkVerifyResponse, UserProfile, UpdateProfileResponse, ProfileUpdateData, SuccessResponse, SendWhatsAppRequest, SendWhatsAppResponse, ExchangeWhatsAppSessionResponse, VerifyWhatsAppResponse, WhatsAppStatusResponse, SendSmsVerifyRequest, SendSmsVerifyResponse, VerifySmsResponse, UpsertContactRequest, UpsertContactResponse, MfaChallengeSendResponse, MfaFinalizeResponse, MfaEnrollSendResponse, MfaEnrolledResponse, MfaFactorsResponse, TrustedDevice } from "../types/authKit";
+import type { AuthLoginResponse, AppleLoginOptions, RefreshResponse, LogoutResponse, PhoneSendCodeResponse, PhoneVerifyResponse, PasswordResetRequestResponse, VerifyResetTokenResponse, PasswordResetCompleteResponse, EmailVerificationActionResponse, EmailVerifyTokenResponse, AuthKitConfig, AuthKitConfigInput, MagicLinkSendResponse, MagicLinkVerifyResponse, UserProfile, UpdateProfileResponse, ProfileUpdateData, SuccessResponse, SendWhatsAppRequest, SendWhatsAppResponse, ExchangeWhatsAppSessionResponse, VerifyWhatsAppResponse, WhatsAppStatusResponse, SendSmsVerifyRequest, SendSmsVerifyResponse, VerifySmsResponse, UpsertContactRequest, UpsertContactResponse, MfaChallengeSendResponse, MfaFinalizeResponse, MfaEnrollSendResponse, MfaEnrolledResponse, MfaFactorsResponse, TrustedDevice } from "../types/authKit";
 /**
  * Namespace containing helper functions for the new AuthKit API.
  * Legacy collection-based authKit helpers retained (marked as *Legacy*).
@@ -18,6 +18,11 @@ export declare namespace authKit {
      *   `trustDevice: true`), pass it here to skip the challenge entirely as long as it's
      *   still valid. If it's revoked/expired, the server silently falls back to requiring a
      *   fresh challenge — `login()` just returns `MFA_REQUIRED` again, no special handling.
+     *
+     * Security errors (thrown as `SmartlinksApiError`, see {@link LoginSecurityErrorCode}):
+     * - `ACCOUNT_TEMPORARILY_LOCKED` (429) — `err.details.retryAfterSeconds` says how long to wait.
+     * - `PASSWORD_EXPIRED` (403) — `err.details.resetToken` is short-lived; route into
+     *   {@link completePasswordReset} to change the password in place.
      */
     function login(clientId: string, email: string, password: string, trustedDeviceToken?: string): Promise<AuthLoginResponse>;
     /**
@@ -25,6 +30,11 @@ export declare namespace authKit {
      *
      * Not gated by step-up MFA — a brand-new user has no enrolled factors yet, so there's
      * nothing to challenge against.
+     *
+     * The new password is validated against the collection's `passwordPolicy` — may throw
+     * a {@link PasswordPolicyErrorCode} (400). The same validation applies to
+     * {@link completePasswordReset} and {@link changePassword}. Read the policy for a live
+     * checklist from `authKit.load(clientId)` → `config.security.passwordPolicy`.
      */
     function register(clientId: string, data: {
         email: string;
@@ -221,10 +231,24 @@ export declare namespace authKit {
     }>;
     /** Revoke a single trusted device by id (authenticated). */
     function revokeTrustedDevice(clientId: string, id: string): Promise<SuccessResponse>;
+    /**
+     * Load the **public** AuthKit config for a client (no auth). Returns branding +
+     * the public security subset (`security.passwordPolicy` + `security.session`);
+     * `security.lockout` is admin-only and never included here. Use this in the login
+     * UI to render password checklists and drive idle sign-out.
+     */
     function load(authKitId: string): Promise<AuthKitConfig>;
+    /** Get the full AuthKit config, including admin-only fields like `security.lockout` (admin auth). */
     function get(collectionId: string, authKitId: string): Promise<AuthKitConfig>;
     function list(collectionId: string, admin?: boolean): Promise<AuthKitConfig[]>;
-    function create(collectionId: string, data: any): Promise<AuthKitConfig>;
-    function update(collectionId: string, authKitId: string, data: any): Promise<AuthKitConfig>;
+    /** Create an AuthKit client config (admin). Accepts the account `security` policy — see {@link AuthKitConfigInput}. */
+    function create(collectionId: string, data: AuthKitConfigInput): Promise<AuthKitConfig>;
+    /**
+     * Update an AuthKit client config (admin). This is how the account **security
+     * policy** is written — pass a `security` block ({@link AuthKitSecurityConfig}).
+     * The server validates it and enforces it; the login UI reads the public subset
+     * back via {@link load}.
+     */
+    function update(collectionId: string, authKitId: string, data: AuthKitConfigInput): Promise<AuthKitConfig>;
     function remove(collectionId: string, authKitId: string): Promise<void>;
 }

package/dist/api/authKit.js

@@ -22,6 +22,11 @@ export var authKit;
      *   `trustDevice: true`), pass it here to skip the challenge entirely as long as it's
      *   still valid. If it's revoked/expired, the server silently falls back to requiring a
      *   fresh challenge — `login()` just returns `MFA_REQUIRED` again, no special handling.
+     *
+     * Security errors (thrown as `SmartlinksApiError`, see {@link LoginSecurityErrorCode}):
+     * - `ACCOUNT_TEMPORARILY_LOCKED` (429) — `err.details.retryAfterSeconds` says how long to wait.
+     * - `PASSWORD_EXPIRED` (403) — `err.details.resetToken` is short-lived; route into
+     *   {@link completePasswordReset} to change the password in place.
      */
     async function login(clientId, email, password, trustedDeviceToken) {
         const body = { email, password };
@@ -40,6 +45,11 @@ export var authKit;
      *
      * Not gated by step-up MFA — a brand-new user has no enrolled factors yet, so there's
      * nothing to challenge against.
+     *
+     * The new password is validated against the collection's `passwordPolicy` — may throw
+     * a {@link PasswordPolicyErrorCode} (400). The same validation applies to
+     * {@link completePasswordReset} and {@link changePassword}. Read the policy for a live
+     * checklist from `authKit.load(clientId)` → `config.security.passwordPolicy`.
      */
     async function register(clientId, data) {
         return post(`/authkit/${encodeURIComponent(clientId)}/auth/register`, data);
@@ -434,11 +444,18 @@ export var authKit;
     /* ===================================
      * Collection-based AuthKit
      * =================================== */
+    /**
+     * Load the **public** AuthKit config for a client (no auth). Returns branding +
+     * the public security subset (`security.passwordPolicy` + `security.session`);
+     * `security.lockout` is admin-only and never included here. Use this in the login
+     * UI to render password checklists and drive idle sign-out.
+     */
     async function load(authKitId) {
         const path = `/authKit/${encodeURIComponent(authKitId)}/config`;
         return request(path);
     }
     authKit.load = load;
+    /** Get the full AuthKit config, including admin-only fields like `security.lockout` (admin auth). */
     async function get(collectionId, authKitId) {
         const path = `/admin/collection/${encodeURIComponent(collectionId)}/authKit/${encodeURIComponent(authKitId)}`;
         return request(path);
@@ -450,11 +467,18 @@ export var authKit;
         return request(path);
     }
     authKit.list = list;
+    /** Create an AuthKit client config (admin). Accepts the account `security` policy — see {@link AuthKitConfigInput}. */
     async function create(collectionId, data) {
         const path = `/admin/collection/${encodeURIComponent(collectionId)}/authKit`;
         return post(path, data);
     }
     authKit.create = create;
+    /**
+     * Update an AuthKit client config (admin). This is how the account **security
+     * policy** is written — pass a `security` block ({@link AuthKitSecurityConfig}).
+     * The server validates it and enforces it; the login UI reads the public subset
+     * back via {@link load}.
+     */
     async function update(collectionId, authKitId, data) {
         const path = `/admin/collection/${encodeURIComponent(collectionId)}/authKit/${encodeURIComponent(authKitId)}`;
         return put(path, data);

package/dist/api/proof.d.ts

@@ -1,4 +1,4 @@
-import { ProofResponse, ProofCreateRequest, ProofUpdateRequest, ProofClaimRequest, ProofGrant, CreateGrantOptions, RedeemGrantOptions, RedeemGrantResult } from "../types/proof";
+import { ProofResponse, ProofCreateRequest, ProofUpdateRequest, ProofClaimRequest, ProofGrant, CreateGrantOptions, RedeemGrantOptions, RedeemGrantResult, ProofTransfer, TransferProofOptions, TransferProofResult } from "../types/proof";
 export declare namespace proof {
     /**
      * Retrieves a single Proof by Collection ID, Product ID, and Proof ID.
@@ -12,11 +12,34 @@ export declare namespace proof {
     /**
      * Create a proof for a product (admin only).
      * POST /admin/collection/:collectionId/product/:productId/proof
+     *
+     * Pass the proof's content in a `proof` block, keyed by zone (see {@link ProofWrite}):
+     * ```ts
+     * proof.create(collectionId, productId, {
+     *   proof: {
+     *     values: { colour: 'red' },   // public + owner readable, owner + admin writable
+     *     data:   { serialNo: 1001 },  // public + owner readable, ADMIN-only writable
+     *     admin:  { costPrice: 4.20 }, // admin-only
+     *   },
+     *   claimable: true,
+     * })
+     * ```
+     * Note: a top-level `data`/`admin` on the request body is legacy — top-level
+     * `data` gets folded into the values bag, so use `proof.data` for `proof.data`.
      */
-    function create(collectionId: string, productId: string, values: ProofCreateRequest): Promise<ProofResponse>;
+    function create(collectionId: string, productId: string, request: ProofCreateRequest): Promise<ProofResponse>;
     /**
      * Update a proof for a product (admin only).
      * PUT /admin/collection/:collectionId/product/:productId/proof/:proofId
+     *
+     * Pass the fields to change **at the root**, keyed by zone (see {@link ProofWrite}):
+     * ```ts
+     * proof.update(collectionId, productId, proofId, {
+     *   data:   { serialNo: 1002 },   // → proof.data (admin-only writable)
+     *   values: { colour: 'blue' },   // → proof.values
+     * })
+     * ```
+     * Object zones deep-merge, so you can change one field without wiping the rest.
      */
     function update(collectionId: string, productId: string, proofId: string, values: ProofUpdateRequest): Promise<ProofResponse>;
     /**
@@ -122,4 +145,37 @@ export declare namespace proof {
      * {@link setGrantToken} so subsequent data requests carry the token.
      */
     function redeemGrant(collectionId: string, productId: string, proofId: string, token: string, options?: RedeemGrantOptions): Promise<RedeemGrantResult>;
+    /**
+     * Start a push transfer of a proof (current owner / collection admin only).
+     *
+     * Directed — hand it to a named recipient who then calls {@link acceptTransfer}:
+     * ```ts
+     * await proof.transfer(collectionId, productId, proofId, { toEmail: 'buyer@example.com' })
+     * ```
+     * Open release — make the proof claimable by anyone:
+     * ```ts
+     * await proof.transfer(collectionId, productId, proofId, { release: true })
+     * ```
+     */
+    function transfer(collectionId: string, productId: string, proofId: string, options: TransferProofOptions): Promise<TransferProofResult>;
+    /**
+     * Accept a directed transfer (the named recipient only). Completes the ownership
+     * move — the proof's `userId` becomes the caller and the previous owner's private
+     * data and share grants are cleared/voided.
+     */
+    function acceptTransfer(collectionId: string, productId: string, proofId: string): Promise<{
+        ok: boolean;
+        proof: ProofResponse;
+    }>;
+    /** Cancel a pending push transfer (current owner / collection admin only). */
+    function cancelTransfer(collectionId: string, productId: string, proofId: string): Promise<{
+        ok: boolean;
+    }>;
+    /**
+     * Get the active transfer/status for a proof (owner, collection admin, or the
+     * named recipient). Returns `{ transfer: null }` when nothing is in flight.
+     */
+    function getTransfer(collectionId: string, productId: string, proofId: string): Promise<{
+        transfer: ProofTransfer | null;
+    }>;
 }

package/dist/api/proof.js

@@ -26,15 +26,38 @@ export var proof;
     /**
      * Create a proof for a product (admin only).
      * POST /admin/collection/:collectionId/product/:productId/proof
+     *
+     * Pass the proof's content in a `proof` block, keyed by zone (see {@link ProofWrite}):
+     * ```ts
+     * proof.create(collectionId, productId, {
+     *   proof: {
+     *     values: { colour: 'red' },   // public + owner readable, owner + admin writable
+     *     data:   { serialNo: 1001 },  // public + owner readable, ADMIN-only writable
+     *     admin:  { costPrice: 4.20 }, // admin-only
+     *   },
+     *   claimable: true,
+     * })
+     * ```
+     * Note: a top-level `data`/`admin` on the request body is legacy — top-level
+     * `data` gets folded into the values bag, so use `proof.data` for `proof.data`.
      */
-    async function create(collectionId, productId, values) {
+    async function create(collectionId, productId, request) {
         const path = `/admin/collection/${encodeURIComponent(collectionId)}/product/${encodeURIComponent(productId)}/proof`;
-        return post(path, values);
+        return post(path, request);
     }
     proof.create = create;
     /**
      * Update a proof for a product (admin only).
      * PUT /admin/collection/:collectionId/product/:productId/proof/:proofId
+     *
+     * Pass the fields to change **at the root**, keyed by zone (see {@link ProofWrite}):
+     * ```ts
+     * proof.update(collectionId, productId, proofId, {
+     *   data:   { serialNo: 1002 },   // → proof.data (admin-only writable)
+     *   values: { colour: 'blue' },   // → proof.values
+     * })
+     * ```
+     * Object zones deep-merge, so you can change one field without wiping the rest.
      */
     async function update(collectionId, productId, proofId, values) {
         const path = `/admin/collection/${encodeURIComponent(collectionId)}/product/${encodeURIComponent(productId)}/proof/${encodeURIComponent(proofId)}`;
@@ -200,4 +223,53 @@ export var proof;
         return post(`${grantBase(collectionId, productId, proofId)}/redeem`, body);
     }
     proof.redeemGrant = redeemGrant;
+    // ---------------------------------------------------------------------------
+    // Ownership transfer — moving a proof's single owner from A to B
+    //
+    // A proof always has exactly one owner (`proof.userId`). A transfer moves that
+    // owner with the current owner's consent: either DIRECTED to a named recipient
+    // (who accepts) or an OPEN RELEASE (the proof becomes claimable by anyone).
+    // Contested pull-claims + dispute resolution are a later addition.
+    // ---------------------------------------------------------------------------
+    function transferBase(collectionId, productId, proofId) {
+        return `/public/collection/${encodeURIComponent(collectionId)}/product/${encodeURIComponent(productId)}/proof/${encodeURIComponent(proofId)}/transfer`;
+    }
+    /**
+     * Start a push transfer of a proof (current owner / collection admin only).
+     *
+     * Directed — hand it to a named recipient who then calls {@link acceptTransfer}:
+     * ```ts
+     * await proof.transfer(collectionId, productId, proofId, { toEmail: 'buyer@example.com' })
+     * ```
+     * Open release — make the proof claimable by anyone:
+     * ```ts
+     * await proof.transfer(collectionId, productId, proofId, { release: true })
+     * ```
+     */
+    async function transfer(collectionId, productId, proofId, options) {
+        return post(transferBase(collectionId, productId, proofId), Object.assign({}, options));
+    }
+    proof.transfer = transfer;
+    /**
+     * Accept a directed transfer (the named recipient only). Completes the ownership
+     * move — the proof's `userId` becomes the caller and the previous owner's private
+     * data and share grants are cleared/voided.
+     */
+    async function acceptTransfer(collectionId, productId, proofId) {
+        return post(`${transferBase(collectionId, productId, proofId)}/accept`, {});
+    }
+    proof.acceptTransfer = acceptTransfer;
+    /** Cancel a pending push transfer (current owner / collection admin only). */
+    async function cancelTransfer(collectionId, productId, proofId) {
+        return post(`${transferBase(collectionId, productId, proofId)}/cancel`, {});
+    }
+    proof.cancelTransfer = cancelTransfer;
+    /**
+     * Get the active transfer/status for a proof (owner, collection admin, or the
+     * named recipient). Returns `{ transfer: null }` when nothing is in flight.
+     */
+    async function getTransfer(collectionId, productId, proofId) {
+        return request(transferBase(collectionId, productId, proofId));
+    }
+    proof.getTransfer = getTransfer;
 })(proof || (proof = {}));

package/dist/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 1.15.18  |  Generated: 2026-08-19T06:40:47.505Z
+Version: 1.15.20  |  Generated: 2026-08-25T07:03:45.544Z
 
 This is a concise summary of all available API functions and types.
 
@@ -3464,6 +3464,55 @@ interface AuthKitConfig {
   supportEmail?: string
   redirectUrl?: string
   updatedAt?: string
+  * Per-collection security policy. On the public config endpoint only
+  * `passwordPolicy` + `session` are returned (the client renders password
+  * checklists / idle sign-out from them); `lockout` is admin-only and enforced
+  * server-side. See {@link AuthKitSecurityConfig}.
+  security?: AuthKitSecurityConfig
+}
+```
+
+**AuthKitSecurityConfig** (interface)
+```typescript
+interface AuthKitSecurityConfig {
+  passwordPolicy?: AuthKitPasswordPolicy
+  session?: AuthKitSessionPolicy
+  lockout?: AuthKitLockoutPolicy
+}
+```
+
+**AuthKitPasswordPolicy** (interface)
+```typescript
+interface AuthKitPasswordPolicy {
+  minLength?: number
+  requireUppercase?: boolean
+  requireLowercase?: boolean
+  requireNumber?: boolean
+  requireSymbol?: boolean
+  blockCommonPasswords?: boolean
+  expiryDays?: number
+  historyCount?: number
+}
+```
+
+**AuthKitSessionPolicy** (interface)
+```typescript
+interface AuthKitSessionPolicy {
+  inactivityTimeoutMinutes?: number
+  inactivityWarningSeconds?: number
+  absoluteTimeoutHours?: number
+  rememberMe?: boolean
+}
+```
+
+**AuthKitLockoutPolicy** (interface)
+```typescript
+interface AuthKitLockoutPolicy {
+  enabled?: boolean
+  maxFailedAttempts?: number
+  attemptWindowMinutes?: number
+  lockoutMinutes?: number
+  notifyUserOnLockout?: boolean
 }
 ```
 
@@ -3475,6 +3524,12 @@ interface AuthKitConfig {
 
 **VerifyStatus** = `'pending' | 'verified' | 'failed' | 'expired' | 'unknown'`
 
+**AuthKitConfigInput** = ``
+
+**PasswordPolicyErrorCode** = ``
+
+**LoginSecurityErrorCode** = ``
+
 ### batch
 
 **FirebaseTimestamp** (interface)
@@ -7279,14 +7334,36 @@ interface Proof {
 }
 ```
 
-**ProofCreateRequest** (interface)
+**ProofWrite** (interface)
 ```typescript
-interface ProofCreateRequest {
-  values: ProofValues
+interface ProofWrite {
+  * Choose the proof's ID (serial, NFC id, etc.). Honoured **on create only** —
+  * the ledger doc becomes `{productId}-{id}`. Omit to auto-generate. Ignored on
+  * update (a proof's ID is immutable).
+  id?: string
+  values?: ProofValues
   data?: Record<string, JsonValue>
   admin?: Record<string, JsonValue>
+  owner?: Record<string, JsonValue>
+  claimable?: boolean
+  [key: string]: JsonValue | Record<string, JsonValue> | ProofValues | undefined
+}
+```
+
+**ProofCreateRequest** (interface)
+```typescript
+interface ProofCreateRequest {
+  * The proof to create, by zone (mirrors the proof document). This is the clear,
+  * recommended shape — `create(collectionId, productId, { proof: {...} })`.
+  proof?: ProofWrite
+  values?: ProofValues
   claimable?: boolean
   virtual?: boolean
+  core?: ProofWrite
+  * @deprecated On the request body this is folded into the **values bag**
+  * (public + owner-writable) — NOT `proof.data`. Use `proof.data`.
+  data?: Record<string, JsonValue>
+  admin?: Record<string, JsonValue>
 }
 ```
 
@@ -7341,9 +7418,51 @@ interface RedeemGrantOptions {
 }
 ```
 
+**ProofTransfer** (interface)
+```typescript
+interface ProofTransfer {
+  id: string
+  proofId: string
+  productId?: string | null
+  type: ProofTransferType
+  state: ProofTransferState
+  fromUserId?: string | null
+  toUserId?: string | null
+  toEmail?: string | null
+  initiatedByUserId?: string | null
+  initiatedByRole?: 'owner' | 'claimant' | 'admin' | null
+  disputeReason?: string | null
+  disputeDeadline?: string | null
+  completedAt?: string | null
+  createdAt: string
+  updatedAt: string
+}
+```
+
+**TransferProofOptions** (interface)
+```typescript
+interface TransferProofOptions {
+  toEmail?: string
+  toUserId?: string
+  toName?: string
+  release?: boolean
+  message?: string
+  notify?: boolean
+}
+```
+
+**TransferProofResult** (interface)
+```typescript
+interface TransferProofResult {
+  ok: boolean
+  mode: 'directed' | 'open_release'
+  transfer: ProofTransfer
+}
+```
+
 **ProofResponse** = `Proof`
 
-**ProofUpdateRequest** = `Partial<ProofCreateRequest>`
+**ProofUpdateRequest** = `Partial<ProofWrite> & { proof?: ProofWrite }`
 
 **ProofClaimRequest** = `Record<string, any>`
 
@@ -7355,6 +7474,10 @@ interface RedeemGrantOptions {
 
 **RedeemGrantResult** = ``
 
+**ProofTransferType** = `'directed' | 'open_release' | 'contested'`
+
+**ProofTransferState** = ``
+
 ### qr
 
 **QrShortCodeLookupResponse** (interface)
@@ -8748,10 +8871,10 @@ Gets current account information for the logged in user. Returns user, owner, ac
 ### authKit
 
 **login**(clientId: string, email: string, password: string, trustedDeviceToken?: string) → `Promise<AuthLoginResponse>`
-Login with email + password (public). When the client's MFA policy requires a step-up, the server returns **403 `MFA_REQUIRED`** instead of a session — `login()` throws a `SmartlinksApiError` with `err.errorResponse?.errorCode === 'MFA_REQUIRED'` and the challenge details in `err.details` (see {@link MfaRequiredDetails}). Route the caller to {@link mfaChallengeSend} on that error; this method's return type is unchanged. returned one (via {@link mfaChallengeVerify}/{@link mfaRecoveryCode} with `trustDevice: true`), pass it here to skip the challenge entirely as long as it's still valid. If it's revoked/expired, the server silently falls back to requiring a fresh challenge — `login()` just returns `MFA_REQUIRED` again, no special handling.
+Login with email + password (public). When the client's MFA policy requires a step-up, the server returns **403 `MFA_REQUIRED`** instead of a session — `login()` throws a `SmartlinksApiError` with `err.errorResponse?.errorCode === 'MFA_REQUIRED'` and the challenge details in `err.details` (see {@link MfaRequiredDetails}). Route the caller to {@link mfaChallengeSend} on that error; this method's return type is unchanged. returned one (via {@link mfaChallengeVerify}/{@link mfaRecoveryCode} with `trustDevice: true`), pass it here to skip the challenge entirely as long as it's still valid. If it's revoked/expired, the server silently falls back to requiring a fresh challenge — `login()` just returns `MFA_REQUIRED` again, no special handling. Security errors (thrown as `SmartlinksApiError`, see {@link LoginSecurityErrorCode}): - `ACCOUNT_TEMPORARILY_LOCKED` (429) — `err.details.retryAfterSeconds` says how long to wait. - `PASSWORD_EXPIRED` (403) — `err.details.resetToken` is short-lived; route into {@link completePasswordReset} to change the password in place.
 
 **register**(clientId: string, data: { email: string; password: string; displayName?: string; accountData?: Record<string, any> }) → `Promise<AuthLoginResponse>`
-Register a new user (public). Not gated by step-up MFA — a brand-new user has no enrolled factors yet, so there's nothing to challenge against.
+Register a new user (public). Not gated by step-up MFA — a brand-new user has no enrolled factors yet, so there's nothing to challenge against. The new password is validated against the collection's `passwordPolicy` — may throw a {@link PasswordPolicyErrorCode} (400). The same validation applies to {@link completePasswordReset} and {@link changePassword}. Read the policy for a live checklist from `authKit.load(clientId)` → `config.security.passwordPolicy`.
 
 **googleLogin**(clientId: string, idToken: string, trustedDeviceToken?: string) → `Promise<AuthLoginResponse>`
 Google OAuth login via ID token (public). Gated by step-up MFA — see {@link login} for the `MFA_REQUIRED` error shape. {@link mfaChallengeVerify}/{@link mfaRecoveryCode} (with `trustDevice: true`) to skip the challenge on this device, same as {@link login}.
@@ -8877,22 +9000,22 @@ List devices trusted to skip MFA challenges for the current user (authenticated)
 Revoke a single trusted device by id (authenticated).
 
 **load**(authKitId: string) → `Promise<AuthKitConfig>`
-Revoke a single trusted device by id (authenticated).
+Load the **public** AuthKit config for a client (no auth). Returns branding + the public security subset (`security.passwordPolicy` + `security.session`); `security.lockout` is admin-only and never included here. Use this in the login UI to render password checklists and drive idle sign-out.
 
 **get**(collectionId: string, authKitId: string) → `Promise<AuthKitConfig>`
-Revoke a single trusted device by id (authenticated).
+Get the full AuthKit config, including admin-only fields like `security.lockout` (admin auth).
 
 **list**(collectionId: string, admin?: boolean) → `Promise<AuthKitConfig[]>`
-Revoke a single trusted device by id (authenticated).
+Get the full AuthKit config, including admin-only fields like `security.lockout` (admin auth).
 
-**create**(collectionId: string, data: any) → `Promise<AuthKitConfig>`
-Revoke a single trusted device by id (authenticated).
+**create**(collectionId: string, data: AuthKitConfigInput) → `Promise<AuthKitConfig>`
+Create an AuthKit client config (admin). Accepts the account `security` policy — see {@link AuthKitConfigInput}.
 
-**update**(collectionId: string, authKitId: string, data: any) → `Promise<AuthKitConfig>`
-Revoke a single trusted device by id (authenticated).
+**update**(collectionId: string, authKitId: string, data: AuthKitConfigInput) → `Promise<AuthKitConfig>`
+Update an AuthKit client config (admin). This is how the account **security policy** is written — pass a `security` block ({@link AuthKitSecurityConfig}). The server validates it and enforces it; the login UI reads the public subset back via {@link load}.
 
 **remove**(collectionId: string, authKitId: string) → `Promise<void>`
-Revoke a single trusted device by id (authenticated).
+Update an AuthKit client config (admin). This is how the account **security policy** is written — pass a `security` block ({@link AuthKitSecurityConfig}). The server validates it and enforces it; the login UI reads the public subset back via {@link load}.
 
 ### batch
 
@@ -9952,14 +10075,14 @@ List all Proofs for a Collection.
 
 **create**(collectionId: string,
     productId: string,
-    values: ProofCreateRequest) → `Promise<ProofResponse>`
-Create a proof for a product (admin only). POST /admin/collection/:collectionId/product/:productId/proof
+    request: ProofCreateRequest) → `Promise<ProofResponse>`
+Create a proof for a product (admin only). POST /admin/collection/:collectionId/product/:productId/proof Pass the proof's content in a `proof` block, keyed by zone (see {@link ProofWrite}): ```ts proof.create(collectionId, productId, { proof: { values: { colour: 'red' },   // public + owner readable, owner + admin writable data:   { serialNo: 1001 },  // public + owner readable, ADMIN-only writable admin:  { costPrice: 4.20 }, // admin-only }, claimable: true, }) ``` Note: a top-level `data`/`admin` on the request body is legacy — top-level `data` gets folded into the values bag, so use `proof.data` for `proof.data`.
 
 **update**(collectionId: string,
     productId: string,
     proofId: string,
     values: ProofUpdateRequest) → `Promise<ProofResponse>`
-Update a proof for a product (admin only). PUT /admin/collection/:collectionId/product/:productId/proof/:proofId
+Update a proof for a product (admin only). PUT /admin/collection/:collectionId/product/:productId/proof/:proofId Pass the fields to change **at the root**, keyed by zone (see {@link ProofWrite}): ```ts proof.update(collectionId, productId, proofId, { data:   { serialNo: 1002 },   // → proof.data (admin-only writable) values: { colour: 'blue' },   // → proof.values }) ``` Object zones deep-merge, so you can change one field without wiping the rest.
 
 **claim**(collectionId: string,
     productId: string,
@@ -10026,6 +10149,27 @@ Revoke a grant by id (owner / collection admin only). Takes effect immediately.
     options?: RedeemGrantOptions) → `Promise<RedeemGrantResult>`
 Redeem a grant token (anonymous or signed-in). Records the redemption and returns the granted scope, or — for a `verify_owner` grant — an ownership assertion (never the account). After redeeming, call {@link setGrantToken} so subsequent data requests carry the token.
 
+**transfer**(collectionId: string,
+    productId: string,
+    proofId: string,
+    options: TransferProofOptions) → `Promise<TransferProofResult>`
+Start a push transfer of a proof (current owner / collection admin only). Directed — hand it to a named recipient who then calls {@link acceptTransfer}: ```ts await proof.transfer(collectionId, productId, proofId, { toEmail: 'buyer@example.com' }) ``` Open release — make the proof claimable by anyone: ```ts await proof.transfer(collectionId, productId, proofId, { release: true }) ```
+
+**acceptTransfer**(collectionId: string,
+    productId: string,
+    proofId: string) → `Promise<`
+Accept a directed transfer (the named recipient only). Completes the ownership move — the proof's `userId` becomes the caller and the previous owner's private data and share grants are cleared/voided.
+
+**cancelTransfer**(collectionId: string,
+    productId: string,
+    proofId: string) → `Promise<`
+Cancel a pending push transfer (current owner / collection admin only).
+
+**getTransfer**(collectionId: string,
+    productId: string,
+    proofId: string) → `Promise<`
+Get the active transfer/status for a proof (owner, collection admin, or the named recipient). Returns `{ transfer: null }` when nothing is in flight.
+
 ### publicClient
 
 **chat**(collectionId: string,