@proveanything/smartlinks 1.15.6 → 1.15.10

package/dist/types/itemContext.js

@@ -0,0 +1,2 @@
+// src/types/itemContext.ts
+export {};

package/dist/types/nfc.d.ts

@@ -39,3 +39,41 @@ export interface NfcClaimTagRequest {
     codeId: string;
     data: Record<string, any>;
 }
+/**
+ * Outcome of validating the NFC/QR tag that brought the visitor to a
+ * SmartLinks app.
+ *
+ * - `valid` — fresh, genuine tap. SUN counter advanced (or a non-consuming
+ *   lookup succeeded).
+ * - `rescan` — genuine tag, but this exact tap was already seen (refresh,
+ *   back button, or a non-advancing SUN counter).
+ * - `invalid` — validation rejected the payload outright (bad crypto,
+ *   unknown tag, tampered URL) — i.e. a fake/counterfeit tag or serial.
+ * - `error` — network/transport failure; authenticity could not be
+ *   confirmed either way.
+ */
+export type TagStatus = 'valid' | 'rescan' | 'invalid' | 'error';
+/**
+ * Result of resolving the tag identifiers on the entry URL, handed to
+ * sub-apps so they can render status-appropriate UX instead of a generic
+ * error. See docs/tag-context.md for the full contract.
+ */
+export interface TagContext {
+    /** Always present when a `TagContext` is delivered at all. */
+    status: TagStatus;
+    /** Identifiers, when known. */
+    tagId?: string;
+    claimSetId?: string;
+    codeId?: string;
+    /** SUN counter values, present when validation returned them. */
+    count?: number;
+    previousCount?: number;
+    /** Arbitrary tag-level payload returned by validation/lookup. */
+    data?: Record<string, unknown>;
+    /** How the identifiers were resolved. */
+    source: 'nfc-validate' | 'nfc-lookup' | 'tag-index' | 'none';
+    /** Epoch ms at resolution time. */
+    validatedAt: number;
+    /** Human-readable message for `invalid` / `error`. */
+    errorMessage?: string;
+}

package/dist/types/widgets.d.ts

@@ -1,3 +1,5 @@
+import type { TagContext } from './nfc';
+import type { ItemContext } from './itemContext';
 /**
  * Structured navigation request emitted via the `onNavigate` prop when a
  * widget or container needs to navigate the parent platform shell to another
@@ -62,6 +64,19 @@ export interface SmartLinksWidgetProps {
     onNavigate?: (request: NavigationRequest | string) => void;
     /** Base URL of the full public portal, used for constructing deep links */
     publicPortalUrl?: string;
+    /**
+     * Authenticity context for the specific item (proof) the URL points at,
+     * resolved via an NFC tap or a serial proof URL. `undefined` for
+     * collection- and product-only URLs, where there's no item to verify.
+     * See docs/item-context.md.
+     */
+    itemContext?: ItemContext;
+    /**
+     * @deprecated Use `itemContext.tag` instead. Kept for one release for
+     * backward compatibility with scanner-aware apps that read raw NFC/SUN
+     * data directly. See docs/item-context.md.
+     */
+    tag?: TagContext;
     /** Responsive size hint */
     size?: 'compact' | 'standard' | 'large';
     /** BCP-47 language code (e.g. `'en'`, `'fr'`) */

package/dist/utils/conditions.d.ts

@@ -1,3 +1,4 @@
+import type { ItemContext } from '../types/itemContext';
 /**
  * Geographic region definitions for country-based conditions
  */
@@ -108,11 +109,36 @@ export interface ValueCondition extends BaseCondition {
     value: string | number | boolean;
 }
 /**
- * Item status condition
+ * Item status condition — one condition type for everything conditions
+ * need to know about "the item," so sub-apps don't have to juggle a
+ * separate authenticity condition alongside this one.
+ *
+ * Two families of `statusType`, kept in one enum on purpose:
+ * - **Claim/ownership** (unchanged): `isClaimable`, `notClaimable`,
+ *   `isVirtual`, `notVirtual`, `hasProof`, `noProof`. These read
+ *   `params.proof` — whether a resolved proof record was supplied at all,
+ *   and its claim/virtual flags. `noProof` only means "nothing was even
+ *   attempted"; it does NOT distinguish that from "an identifier was
+ *   passed but didn't resolve" — see `invalidProof` below for that case.
+ * - **Authenticity** (reads `params.itemContext` — see `ItemContext`,
+ *   docs/item-context.md): `isAuthentic`, `notAuthentic`, `invalidProof`,
+ *   `isFirstScan`, `isRescan`.
+ *   - `invalidProof` is specifically "an identifier was passed and resolution
+ *     was attempted, but it came back invalid or not-found" — the "someone
+ *     scanned a fake tag / typed a bad serial" case, as opposed to `noProof`
+ *     ("nothing was on the URL to check at all").
+ *   - `isAuthentic` is true for both a fresh tap and a rescan — use
+ *     `isFirstScan` / `isRescan` when the fresh-vs-duplicate distinction
+ *     matters. `isFirstScan` is the common "this is good, show the full
+ *     experience" check (authentic AND not seen before, `status === 'valid'`).
+ *     `isRescan` is authentic but a duplicate/replayed tap
+ *     (`status === 'rescan'`) — e.g. a page refresh or the back button —
+ *     for suppressing "first scan" celebration UX without treating the tag
+ *     as fake.
  */
 export interface ItemStatusCondition extends BaseCondition {
     type: 'itemStatus';
-    statusType: 'isClaimable' | 'notClaimable' | 'noProof' | 'hasProof' | 'isVirtual' | 'notVirtual';
+    statusType: 'isClaimable' | 'notClaimable' | 'noProof' | 'hasProof' | 'isVirtual' | 'notVirtual' | 'isAuthentic' | 'notAuthentic' | 'invalidProof' | 'isFirstScan' | 'isRescan';
 }
 /**
  * Facet-based condition — gates on the facet values assigned to the current product.
@@ -263,6 +289,8 @@ export interface ConditionParams {
     proof?: ProofInfo;
     /** Collection information */
     collection?: CollectionInfo;
+    /** Authenticity context for the item (proof) the URL points at, if any */
+    itemContext?: ItemContext;
     /** Statistics/tracking information */
     stats?: StatsInfo;
     /** Function to fetch conditions by ID (optional) */
@@ -300,7 +328,9 @@ export interface ConditionDebugOptions {
  * - **date** - Time-based conditions (before, after, between dates)
  * - **geofence** - Location-based restrictions
  * - **value** - Custom field comparisons
- * - **itemStatus** - Proof/item status checks (claimable, virtual, etc.)
+ * - **itemStatus** - Proof/item status checks: claimable, virtual, presence
+ *   (`hasProof`/`noProof`), and authenticity (`isAuthentic`/`notAuthentic`/
+ *   `invalidProof`/`isFirstScan`/`isRescan`)
  * - **condition** - Nested condition references
  *
  * Conditions can be combined with AND or OR logic.

package/dist/utils/conditions.js

@@ -173,7 +173,9 @@ async function evaluateConditionEntry(condition, params) {
  * - **date** - Time-based conditions (before, after, between dates)
  * - **geofence** - Location-based restrictions
  * - **value** - Custom field comparisons
- * - **itemStatus** - Proof/item status checks (claimable, virtual, etc.)
+ * - **itemStatus** - Proof/item status checks: claimable, virtual, presence
+ *   (`hasProof`/`noProof`), and authenticity (`isAuthentic`/`notAuthentic`/
+ *   `invalidProof`/`isFirstScan`/`isRescan`)
  * - **condition** - Nested condition references
  *
  * Conditions can be combined with AND or OR logic.
@@ -817,6 +819,7 @@ async function validateFacet(condition, params) {
  * Validate item status condition
  */
 async function validateItemStatus(condition, params) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
     switch (condition.statusType) {
         case 'isClaimable':
             return {
@@ -848,6 +851,36 @@ async function validateItemStatus(condition, params) {
                 passed: !!(params.proof && !params.proof.virtual),
                 detail: 'Checked proof.virtual for falsiness.',
             };
+        case 'isAuthentic':
+            return {
+                passed: !!((_a = params.itemContext) === null || _a === void 0 ? void 0 : _a.isAuthentic),
+                detail: 'Checked itemContext.isAuthentic for truthiness.',
+                context: { itemContextStatus: (_b = params.itemContext) === null || _b === void 0 ? void 0 : _b.status },
+            };
+        case 'notAuthentic':
+            return {
+                passed: !!(params.itemContext && !params.itemContext.isAuthentic),
+                detail: 'Checked that an itemContext was resolved and isAuthentic is false.',
+                context: { itemContextStatus: (_c = params.itemContext) === null || _c === void 0 ? void 0 : _c.status },
+            };
+        case 'invalidProof':
+            return {
+                passed: ((_d = params.itemContext) === null || _d === void 0 ? void 0 : _d.status) === 'invalid' || ((_e = params.itemContext) === null || _e === void 0 ? void 0 : _e.status) === 'not-found',
+                detail: 'Checked that resolution was attempted and came back invalid or not-found (as opposed to noProof, where nothing was attempted at all).',
+                context: { itemContextStatus: (_f = params.itemContext) === null || _f === void 0 ? void 0 : _f.status },
+            };
+        case 'isFirstScan':
+            return {
+                passed: ((_g = params.itemContext) === null || _g === void 0 ? void 0 : _g.status) === 'valid',
+                detail: 'Checked that itemContext is authentic and this is the first time it has been seen (status === valid, not rescan).',
+                context: { itemContextStatus: (_h = params.itemContext) === null || _h === void 0 ? void 0 : _h.status },
+            };
+        case 'isRescan':
+            return {
+                passed: ((_j = params.itemContext) === null || _j === void 0 ? void 0 : _j.status) === 'rescan' || !!((_k = params.itemContext) === null || _k === void 0 ? void 0 : _k.isRescan),
+                detail: 'Checked that itemContext is authentic but a duplicate/replayed tap (status === rescan).',
+                context: { itemContextStatus: (_l = params.itemContext) === null || _l === void 0 ? void 0 : _l.status },
+            };
         default:
             return {
                 passed: false,

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 1.15.6  |  Generated: 2026-07-19T08:21:33.985Z
+Version: 1.15.10  |  Generated: 2026-07-19T13:35:07.171Z
 
 This is a concise summary of all available API functions and types.
 
@@ -1447,7 +1447,6 @@ interface AppConfigSettings {
   addOns?: string[]
   requestedBasePlanId?: string
   itemRecordMode?: 'registered' | 'owned' | null
-  virtualItemsEnabled?: boolean
   system?: SystemBlock
 }
 ```
@@ -3698,8 +3697,6 @@ interface Collection {
   secondaryColor?: string
   portalUrl?: string // URL for the collection's portal (if applicable)
   allowAutoGenerateClaims?: boolean
-  variants: boolean // does this collection support variants?
-  batches: boolean // does this collection support batches?
   defaultAuthKitId: string // default auth kit for this collection, used for auth
 }
 ```
@@ -5881,6 +5878,23 @@ interface InteractionEventContext {
 
 **EffectConfig** = ``
 
+### itemContext
+
+**ItemContext** (interface)
+```typescript
+interface ItemContext {
+  isAuthentic: boolean
+  status: ItemContextStatus
+  source: 'nfc' | 'serial'
+  errorMessage?: string
+  isRescan?: boolean
+  tag?: TagContext
+  checkedAt: number
+}
+```
+
+**ItemContextStatus** = ``
+
 ### jobs
 
 **Job** (interface)
@@ -6411,6 +6425,24 @@ interface NfcClaimTagRequest {
 }
 ```
 
+**TagContext** (interface)
+```typescript
+interface TagContext {
+  status: TagStatus
+  tagId?: string
+  claimSetId?: string
+  codeId?: string
+  count?: number
+  previousCount?: number
+  data?: Record<string, unknown>
+  source: 'nfc-validate' | 'nfc-lookup' | 'tag-index' | 'none'
+  validatedAt: number
+  errorMessage?: string
+}
+```
+
+**TagStatus** = `'valid' | 'rescan' | 'invalid' | 'error'`
+
 ### order
 
 **OrderItem** (interface)
@@ -7695,6 +7727,15 @@ interface SmartLinksWidgetProps {
   * accepted for backward compatibility.
   onNavigate?: (request: NavigationRequest | string) => void
   publicPortalUrl?: string
+  * Authenticity context for the specific item (proof) the URL points at,
+  * resolved via an NFC tap or a serial proof URL. `undefined` for
+  * collection- and product-only URLs, where there's no item to verify.
+  * See docs/item-context.md.
+  itemContext?: ItemContext
+  * @deprecated Use `itemContext.tag` instead. Kept for one release for
+  * backward compatibility with scanner-aware apps that read raw NFC/SUN
+  * data directly. See docs/item-context.md.
+  tag?: TagContext
   size?: 'compact' | 'standard' | 'large'
   lang?: string
   translations?: Record<string, string>
@@ -7864,6 +7905,7 @@ interface ConditionParams {
   product?: ProductInfo
   proof?: ProofInfo
   collection?: CollectionInfo
+  itemContext?: ItemContext
   stats?: StatsInfo
   fetchCondition?: (collectionId: string, conditionId: string) => Promise<ConditionSet | null>
   getLocation?: () => Promise<{ latitude: number; longitude: number }>

package/docs/appConfig.md

@@ -36,7 +36,6 @@ export interface AppConfigSettings {
 
   /** How the account handles individual physical items. */
   itemRecordMode?: 'registered' | 'owned' | null;
-  virtualItemsEnabled?: boolean;
 
   // ── SYSTEM-OWNED, PUBLIC (reconcile writes; client read-only) ─────
   /** Resolved entitlement truth. Read this to gate features. */
@@ -245,6 +244,25 @@ Always resolve flags through `appConfiguration.isFeatureEnabled(collectionId, fl
 if you already have a `system` block from elsewhere — never read
 `cfg.system.features[flag]` directly.
 
+#### 4.4.1 Common feature flags
+
+`features` is an open map — any microapp can define its own key — but
+these are the major, cross-cutting flags most integrations will care
+about:
+
+| Flag           | Gates                                                                 |
+| -------------- | ---------------------------------------------------------------------- |
+| `analytics`    | Analytics surfaces (dashboards, reporting, event exploration).       |
+| `crm`          | Customer interaction / CRM — contact records, broadcasts, segments. Sub-features hang off the `crm.*` dotted prefix, e.g. `crm.broadcasts`, `crm.segments`. |
+| `hub`          | The Hub module.                                                      |
+| `portal`       | QR code scan portals.                                                |
+| `virtualItems` | Virtual items — algorithmic per-item IDs with no persistent row (battery serials, scan-to-collect points, bulk QR sheets). Replaces the old root-level `virtualItemsEnabled` boolean, which has been removed (§8) — resolve this like any other feature flag, not as a separate config key. Independent of `itemRecordMode`. |
+| `batches`      | Batch support. Used to be the `Collection.batches` boolean; that field has been removed — this flag is now the only source of truth. |
+| `variants`     | Variant support. Used to be the `Collection.variants` boolean; that field has been removed — this flag is now the only source of truth. |
+
+Same resolution rule as any flag (§4.4) — don't read these off
+`cfg.system.features` directly, always go through `isFeatureEnabled()`.
+
 ### 4.5 `meters`
 
 Map keyed by add-on key. Apps reporting usage should call the
@@ -407,18 +425,14 @@ with a stale local copy.
 Clients MUST NOT write directly to `system` or `systemPrivate`.
 `entitlements-reconcile` merges user-owned fields through untouched.
 
-## 8. Item handling (`itemRecordMode`, `virtualItemsEnabled`)
+## 8. Item handling (`itemRecordMode`)
 
-Two **independent** root-level, user-owned keys describing how the
-account treats individual physical items. Reconcile never touches
-them.
+A root-level, user-owned key describing how the account treats
+individual physical items. Reconcile never touches it.
 
-Three axes (do NOT conflate):
+Two axes (do NOT conflate):
 
-1. **Virtual items** — `virtualItemsEnabled: boolean`. Algorithmic
-   IDs, no per-item row. Battery serials, scan-to-collect points,
-   bulk QR sheets. Can be on with `itemRecordMode` off.
-2. **Item records** — `itemRecordMode`. Materialise a persistent row
+1. **Item records** — `itemRecordMode`. Materialise a persistent row
    per physical item. `null` / missing = **disabled** (no separate
    `"none"` enum — reads collapse to `mode === "off"` via the
    `useItemRecordMode()` hook).
@@ -426,7 +440,15 @@ Three axes (do NOT conflate):
      provenance without a customer relationship.
    - `"owned"` — tag row + owner + interaction history. Requires
      `basePlanId >= "engage"`. Enables claim / transfer / CRM.
-3. **CRM** — downstream consequence of `owned`; not a peer flag.
+2. **CRM** — downstream consequence of `owned`; not a peer flag.
+
+**Virtual items are not part of this key.** Algorithmic IDs with no
+per-item row (battery serials, scan-to-collect points, bulk QR sheets)
+used to be a separate root-level `virtualItemsEnabled: boolean` — that
+field has been removed. Virtual items are now gated by the `virtualItems`
+feature flag under `system.features` (§4.4.1), same as every other
+feature — resolve it with `isFeatureEnabled(collectionId, 'virtualItems')`.
+It's independent of `itemRecordMode` and can be on with item records off.
 
 **Billing:** the usage ledger stamps `tier` at event time from
 `itemRecordMode`. Writes with `mode === null` MUST be rejected. Mode
@@ -447,46 +469,3 @@ CRM visibility), not just a capability flag.
   features yet.
 - `systemOverrides` (old root-level key) → `systemPrivate.overrides`.
   One-off backfill moves the block and re-runs reconcile.
-
-## 10. Change log
-
-- **2026-07-17**: Initial contract published; `appConfig.system` becomes
-  canonical entitlements source of truth. `entitlements` group deprecated.
-- **2026-07-17**: Added `systemOverrides` for additive comps; reconcile
-  records `system.appliedOverrides`.
-- **2026-07-18**: Renamed `systemOverrides` → `systemPrivate.overrides`
-  and formalised the three-tier access model (user / system /
-  systemPrivate). API strips `systemPrivate` for non-admin readers.
-  Added `system.accountType` derived from
-  `systemPrivate.overrides.accountType`. Added top-of-doc TypeScript
-  definition.
-- **2026-07-18**: Added SDK helpers `appConfiguration.getAppConfig()`
-  (typed + cached), `isFeatureEnabled()` (async, cache-backed feature
-  gate), and `isFeatureEnabledSync()` (cache-only, for callers that can't
-  await). Renamed the exported TypeScript type to `AppConfigSettings`
-  to avoid a name collision with the existing per-module `AppConfig`
-  type in `src/types/collection.ts`.
-- **2026-07-18**: `/public/collection/:id/app/config` (`collection.getAppsConfig()`)
-  now returns the `appConfig` entitlements data (`system`, `addOns`,
-  `requestedBasePlanId`, `itemRecordMode`, `virtualItemsEnabled`) merged
-  alongside its existing app-catalog `apps[]`. `appConfiguration.getAppConfig()`
-  was repointed at this endpoint (dropping its `admin` option — this endpoint
-  is public-only); the settings-group endpoint (`appConfiguration.getConfig({ appId: 'appConfig' })`)
-  is still the only way to reach `systemPrivate`. See §3.1 for why the two
-  endpoints' `apps[]` fields are shaped differently and shouldn't be conflated.
-- **2026-07-18**: `system.features` changed from "only truthy flags appear"
-  to explicit `Record<string, boolean>` overrides. Added the `accountType`
-  default rule (§4.4): enterprise accounts default every flag to on unless
-  explicitly `false`; standard accounts default off unless explicitly `true`.
-  Added `appConfiguration.resolveFeature(system, flag)` — the pure resolver
-  behind `isFeatureEnabled()`/`isFeatureEnabledSync()`, exposed only for the
-  rare case of already holding a `system` block from somewhere other than
-  `getAppConfig()`. There is no separate admin feature-check path — `system`
-  is public data on every read, so admin surfaces should call
-  `isFeatureEnabled()` like everything else. Reading `cfg.system.features[flag]`
-  directly is no longer correct for enterprise accounts — always resolve
-  through one of these three.
-- **2026-07-19**: Corrected flag naming convention (§4.4): flags are
-  camelCase (e.g. `customDomain`), not snake_case, and may use a dotted
-  grouping prefix for a topic/module (e.g. `crm.broadcasts`). Updated all
-  examples in this doc accordingly.

package/docs/containers.md

@@ -231,6 +231,8 @@ All standard widget props apply:
 | `productId`       | string         | ❌       | Product context                         |
 | `proofId`         | string         | ❌       | Proof context                           |
 | `user`            | object         | ❌       | Current user info                       |
+| `itemContext`     | `ItemContext`  | ❌       | Authenticity context for the specific item (proof) the URL points at; `undefined` for collection/product-only URLs — see [item-context.md](item-context.md) |
+| `tag`             | `TagContext`   | ❌       | **Deprecated** — use `itemContext.tag` instead. Kept for one release. |
 | `onNavigate`      | function       | ❌       | Navigation callback (accepts `NavigationRequest` or legacy string) |
 | `size`            | string         | ❌       | `"compact"`, `"standard"`, or `"large"` |
 | `lang`            | string         | ❌       | Language code (e.g., `"en"`)            |

package/docs/item-context.md

@@ -0,0 +1,184 @@
+# Item Context (container prop)
+
+> **Copy this file into `node_modules/@proveanything/smartlinks/docs/item-context.md`** in the published SDK package.
+
+When the URL points at a specific item — either a **serial proof URL** or an
+**NFC tap** — the portal derives an `ItemContext` describing what it found
+and hands it to the container as the **`itemContext`** prop.
+
+For collection- and product-only URLs there is no item to describe, so
+`itemContext` is `undefined`. Sub-apps that don't care about authenticity
+can simply ignore the prop.
+
+The prop is named `itemContext` (not `item`) to make clear it's *context
+about the item*, not the item record itself. The underlying record is
+passed separately via `proof`, `product` and `collection` props.
+
+```tsx
+export default function MyContainer({ itemContext, collection, product, proof }) {
+  if (!itemContext) {
+    // Collection or product view — nothing to verify.
+    return <BrowseView collection={collection} product={product} />;
+  }
+  if (itemContext.isAuthentic) {
+    return <RealContent proof={proof} />;
+  }
+  if (itemContext.status === 'not-found' || itemContext.status === 'invalid') {
+    return <NotGenuine message={itemContext.errorMessage} />;
+  }
+  // status === 'error' — transport failure
+  return <TransientError message={itemContext.errorMessage} />;
+}
+```
+
+---
+
+## Shape
+
+```ts
+interface ItemContext {
+  /** True only for `valid` and `rescan`. Read this for the simple case. */
+  isAuthentic: boolean;
+
+  status:
+    | 'valid'        // genuine
+    | 'rescan'       // genuine, but this exact NFC tap has been seen before
+    | 'invalid'      // SDK rejected the NFC payload (bad crypto)
+    | 'not-found'    // identifier well-formed but 404
+    | 'error';       // transport / network failure — cannot tell
+
+  source: 'nfc' | 'serial';
+
+  /** Set for `invalid` / `not-found` / `error`. Safe to display. */
+  errorMessage?: string;
+
+  /** True when SDK reports this exact NFC tap was seen before. */
+  isRescan?: boolean;
+
+  /** Full NFC payload (SUN counter, tagId, claimSetId, codeId, mirror…). Present only when source === 'nfc'. */
+  tag?: TagContext;
+
+  /** Epoch ms when the check was derived. */
+  checkedAt: number;
+}
+```
+
+Also exported from `@proveanything/smartlinks` as `ItemContext` /
+`ItemContextStatus` (`src/types/itemContext.ts`). The nested `TagContext`
+shape is unchanged (`src/types/nfc.ts`).
+
+## When `itemContext` is present
+
+| URL points at                                  | itemContext         |
+| ---------------------------------------------- | -------------------- |
+| Collection root                                | `undefined`          |
+| Product page (no proof)                        | `undefined`          |
+| Serial proof URL (any outcome)                 | present, source `serial` |
+| NFC tap (any outcome)                          | present, source `nfc`    |
+
+## Status matrix (when present)
+
+| Situation                                             | source   | status        | isAuthentic |
+| ----------------------------------------------------- | -------- | ------------- | :---------: |
+| Fresh NFC tap, SUN counter validated                  | `nfc`    | `valid`       | ✅          |
+| Same NFC tap replayed / refresh                       | `nfc`    | `rescan`      | ✅          |
+| NFC payload rejected (bad crypto / bad params)        | `nfc`    | `invalid`     | ❌          |
+| Serial proof URL, proof fetched OK                    | `serial` | `valid`       | ✅          |
+| Serial proof URL, proof returned 404                  | `serial` | `not-found`   | ❌          |
+| Network / 5xx while resolving proof or NFC            | (either) | `error`       | ❌          |
+
+`isAuthentic === (status === 'valid' || status === 'rescan')`.
+
+## How it's delivered
+
+**Direct-mounted containers** (default public mode):
+
+```tsx
+type Props = {
+  collection: Collection;
+  product?: Product;
+  proof?: Proof;
+  itemContext?: ItemContext;     // ← only when URL targets a specific item
+  // …plus the normal navigation / theme / auth props
+};
+```
+
+NFC-aware apps that need the raw SUN / tag payload read `itemContext.tag`.
+
+**Iframe containers**: the portal serialises `ItemContext` to JSON, base64-
+encodes it (UTF-8 safe) and appends it as an `itemContext` query param on
+the iframe URL — omitted entirely when there is no item context:
+
+```ts
+function readItemContext(): ItemContext | undefined {
+  const raw = new URLSearchParams(location.search).get('itemContext');
+  if (!raw) return undefined;
+  try { return JSON.parse(decodeURIComponent(escape(atob(raw)))); }
+  catch { return undefined; }
+}
+```
+
+## Guarantees
+
+- `itemContext` is present on every container mount whose URL targeted an
+  item (proof or NFC tap). Absent otherwise.
+- `SL.nfc.validate` is called at most once per `(claimSetId, codeId)` per
+  browser session — SUN counters are never double-consumed on refresh.
+- SSR uses `SL.nfc.lookupTag` (non-consuming) only.
+- `isAuthentic === true` implies the SDK either validated an NFC payload
+  or returned a full proof document. It is never inferred from URL shape.
+- The portal will **not** render its full-page error surface for a 404 on
+  a proof — that surfaces as `status: 'not-found'` on `itemContext`, and
+  the container is still mounted so it can present the message its own way.
+
+## What containers should do
+
+| Status        | Recommended UI                                                    |
+| ------------- | ------------------------------------------------------------------ |
+| `valid`       | Full experience. Show ownership, actions, etc.                    |
+| `rescan`      | Same as `valid`, optionally with a subtle "seen before" hint.     |
+| `invalid`     | Clear "this doesn't look genuine" message. Do NOT reveal data.    |
+| `not-found`   | "We don't recognise this item." Offer a link home.                 |
+| `error`       | Neutral "couldn't verify right now." Offer retry.                  |
+| _absent_      | Standard browse UI. Don't mention authenticity at all.             |
+
+## Gating UX with conditions
+
+Sub-apps should standardize on passing `itemContext` into `validateCondition()`
+and gating with `itemStatus` — the same condition type already used for
+claim/virtual checks, extended with authenticity `statusType`s that read
+`itemContext` instead of `proof`:
+
+```ts
+import { validateCondition } from '@proveanything/smartlinks';
+
+const showFakeWarning = await validateCondition({
+  condition: {
+    conditions: [{ type: 'itemStatus', statusType: 'invalidProof' }],
+  },
+  itemContext, // the prop delivered to the container
+});
+```
+
+- `isAuthentic` — passes when `itemContext.isAuthentic` is true (`valid`/`rescan`)
+- `notAuthentic` — passes when an `itemContext` was resolved but isn't authentic (`invalid`/`not-found`/`error`)
+- `invalidProof` — passes specifically when resolution was attempted and came back `invalid` or `not-found` — the "someone scanned a fake tag / typed a bad serial" case, as distinct from `noProof` ("nothing was on the URL to check at all")
+- `isFirstScan` — the single "this is good, show the full experience" check: authentic AND this is the first time it's been seen (`status === 'valid'`)
+- `isRescan` — authentic but a duplicate/replayed tap (`status === 'rescan'`) — use this to suppress "first scan" celebration UX without treating the tag as fake; `isAuthentic` alone is true for both `isFirstScan` and `isRescan` cases
+
+## Deprecated
+
+The old top-level `tag` prop (`TagContext`) is still forwarded for one
+release for backward compatibility with scanner-aware apps that read raw
+SUN data. New code should read `itemContext.tag` and treat `itemContext`
+as the source of truth.
+
+## Note on terminology
+
+Today the SDK still uses `proof` for a specific item record (a serialised
+instance of a product). "Item record" is under consideration as a clearer
+name — no API changes are planned imminently, but a future SDK version may
+support both `proof`- and `item record`-shaped names for the same
+functions/types side by side. `itemContext` is deliberately future-proof:
+it describes context about whatever the URL points at, regardless of what
+we ultimately call the record itself.

package/docs/utils.md

@@ -485,9 +485,12 @@ await utils.validateCondition({
 ```
 
 #### Item Status Conditions
-Check proof/item status:
+Check proof/item status — claim/ownership state, and authenticity of the
+item (proof) the URL points at (via NFC tap or serial proof URL — see
+[item-context.md](item-context.md)):
 
 ```typescript
+// Claim/ownership — unchanged, reads `proof`
 await utils.validateCondition({
   condition: {
     type: 'and',
@@ -498,9 +501,38 @@ await utils.validateCondition({
   },
   proof: { claimable: true }
 })
+
+// Authenticity — reads `itemContext`
+await utils.validateCondition({
+  condition: {
+    type: 'and',
+    conditions: [{
+      type: 'itemStatus',
+      statusType: 'invalidProof'
+    }]
+  },
+  itemContext: { isAuthentic: false, status: 'invalid', source: 'nfc', checkedAt: Date.now() }
+})
+
+// Fresh scan vs. duplicate/replayed scan — both authentic, different UX
+await utils.validateCondition({
+  condition: {
+    type: 'and',
+    conditions: [{
+      type: 'itemStatus',
+      statusType: 'isRescan'
+    }]
+  },
+  itemContext: { isAuthentic: true, status: 'rescan', source: 'nfc', checkedAt: Date.now() }
+})
 ```
 
-Status types: `'isClaimable'`, `'notClaimable'`, `'noProof'`, `'hasProof'`, `'isVirtual'`, `'notVirtual'`
+Status types:
+- Claim/ownership (reads `proof`): `'isClaimable'`, `'notClaimable'`, `'isVirtual'`, `'notVirtual'`
+- Presence (reads `proof`): `'hasProof'`, `'noProof'` — `noProof` only means *nothing was attempted*, not that an attempt failed
+- Authenticity (reads `itemContext`): `'isAuthentic'`, `'notAuthentic'`, `'invalidProof'`, `'isFirstScan'`, `'isRescan'`
+  - `invalidProof` is specifically "an identifier was passed and resolution came back `invalid`/`not-found`", distinct from `noProof`'s "nothing on the URL to check at all"
+  - `isAuthentic` is true for both a fresh tap and a rescan. Use `isFirstScan` (authentic AND `status === 'valid'`) as the single "this is good, show the full experience" check, and `isRescan` (authentic but `status === 'rescan'`) to suppress "first scan" celebration UX without treating the tag as fake
 
 #### Version Conditions
 For A/B testing or versioned content:
@@ -720,6 +752,7 @@ See [examples/utils-demo.ts](../examples/utils-demo.ts) for comprehensive exampl
 - **[API Summary](API_SUMMARY.md)** - Complete SDK reference with all namespaces and functions
 - **[QR Codes](API_SUMMARY.md#qr)** - QR code lookup functions that work with generated paths
 - **[NFC](API_SUMMARY.md#nfc)** - NFC tag claiming and validation
+- **[Item Context](item-context.md)** - `itemContext` prop delivered to containers describing the item (proof) the URL points at and whether it's authentic
 - **[Collections](API_SUMMARY.md#collection)** - Collection management functions
 - **[Products](API_SUMMARY.md#product)** - Product CRUD operations
 - **[Batches](API_SUMMARY.md#batch)** - Batch management