@proveanything/smartlinks 1.16.5 → 1.16.6

package/dist/api/attestations.d.ts

@@ -1,4 +1,4 @@
-import type { Attestation, CreateAttestationInput, ListAttestationsParams, ListAttestationsResponse, AttestationSummaryParams, AttestationSummaryResponse, PublicAttestationSummaryResponse, AttestationLatestParams, AttestationLatestResponse, PublicAttestationLatestResponse, AttestationVerifyParams, ChainVerifyResult, AttestationTreeSummaryParams, AttestationTreeSummaryResponse, PublicAttestationTreeSummaryResponse, AttestationTreeLatestParams, AttestationTreeLatestResponse, PublicAttestationTreeLatestResponse, PublicListAttestationsResponse } from "../types/attestations";
+import type { Attestation, CreateAttestationInput, ListAttestationsParams, ListAttestationsResponse, AttestationSummaryParams, AttestationSummaryResponse, PublicAttestationSummaryResponse, AttestationLatestParams, AttestationLatestResponse, PublicAttestationLatestResponse, AttestationVerifyParams, ChainVerifyResult, AttestationTreeSummaryParams, AttestationTreeSummaryResponse, PublicAttestationTreeSummaryResponse, AttestationTreeLatestParams, AttestationTreeLatestResponse, PublicAttestationTreeLatestResponse, PublicListAttestationsResponse, OwnerAttestationInput, CreateOwnerAttestationResponse } from "../types/attestations";
 /**
  * Postgres-backed Attestations API (v2).
  *
@@ -10,9 +10,12 @@ import type { Attestation, CreateAttestationInput, ListAttestationsParams, ListA
  *
  * ### Admin vs Public
  * - **Admin** endpoints (`/admin/collection/:id/attestations`) require a valid
- *   admin session or bearer token.  All three data zones are returned.
- * - **Public** endpoints (`/public/collection/:id/attestations`) are read-only.
- *   Owner elevation is available via `Authorization: Bearer <Firebase ID token>`.
+ *   admin session or bearer token.  All three data zones are returned, and the
+ *   business can write any zone/visibility ({@link create}).
+ * - **Public** endpoints (`/public/collection/:id/attestations`) are read-only,
+ *   EXCEPT {@link publicCreate}: the proof OWNER may author an attestation on
+ *   their own item (value + ownerData, visibility public|owner — never the admin
+ *   zone). Owner elevation is via `Authorization: Bearer <Firebase ID token>`.
  *
  * @see docs/attestations.md
  */
@@ -207,6 +210,23 @@ export declare namespace attestations {
      * ```
      */
     function publicList(collectionId: string, params: ListAttestationsParams): Promise<PublicListAttestationsResponse>;
+    /**
+     * Create an OWNER-authored attestation (public write) — the counterpart to the
+     * admin {@link create}. The authenticated caller must OWN the linked proof
+     * (identity, not a read grant). Guardrails enforced server-side: they may write
+     * `value` + `ownerData` only (`adminData` is dropped), `visibility` is clamped
+     * to `'public' | 'owner'`, and `authorId` is forced to the caller. The record
+     * joins the same tamper-evident hash chain.
+     * POST /public/collection/:collectionId/attestations
+     * ```ts
+     * await attestations.publicCreate('coll_123', {
+     *   subjectType: 'proof', subjectId: 'proof_1',
+     *   attestationType: 'condition-report',
+     *   value: { grade: 'excellent' }, visibility: 'public',
+     * })
+     * ```
+     */
+    function publicCreate(collectionId: string, data: OwnerAttestationInput): Promise<CreateOwnerAttestationResponse>;
     /**
      * Time-series summary (public).
      *

package/dist/api/attestations.js

@@ -23,9 +23,12 @@ function buildAttestationQuery(params) {
  *
  * ### Admin vs Public
  * - **Admin** endpoints (`/admin/collection/:id/attestations`) require a valid
- *   admin session or bearer token.  All three data zones are returned.
- * - **Public** endpoints (`/public/collection/:id/attestations`) are read-only.
- *   Owner elevation is available via `Authorization: Bearer <Firebase ID token>`.
+ *   admin session or bearer token.  All three data zones are returned, and the
+ *   business can write any zone/visibility ({@link create}).
+ * - **Public** endpoints (`/public/collection/:id/attestations`) are read-only,
+ *   EXCEPT {@link publicCreate}: the proof OWNER may author an attestation on
+ *   their own item (value + ownerData, visibility public|owner — never the admin
+ *   zone). Owner elevation is via `Authorization: Bearer <Firebase ID token>`.
  *
  * @see docs/attestations.md
  */
@@ -273,6 +276,27 @@ export var attestations;
         return request(path);
     }
     attestations.publicList = publicList;
+    /**
+     * Create an OWNER-authored attestation (public write) — the counterpart to the
+     * admin {@link create}. The authenticated caller must OWN the linked proof
+     * (identity, not a read grant). Guardrails enforced server-side: they may write
+     * `value` + `ownerData` only (`adminData` is dropped), `visibility` is clamped
+     * to `'public' | 'owner'`, and `authorId` is forced to the caller. The record
+     * joins the same tamper-evident hash chain.
+     * POST /public/collection/:collectionId/attestations
+     * ```ts
+     * await attestations.publicCreate('coll_123', {
+     *   subjectType: 'proof', subjectId: 'proof_1',
+     *   attestationType: 'condition-report',
+     *   value: { grade: 'excellent' }, visibility: 'public',
+     * })
+     * ```
+     */
+    async function publicCreate(collectionId, data) {
+        const path = `/public/collection/${encodeURIComponent(collectionId)}/attestations`;
+        return post(path, data);
+    }
+    attestations.publicCreate = publicCreate;
     /**
      * Time-series summary (public).
      *

package/dist/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 1.16.5  |  Generated: 2026-09-05T15:46:49.017Z
+Version: 1.16.6  |  Generated: 2026-09-06T07:49:21.444Z
 
 This is a concise summary of all available API functions and types.
 
@@ -2797,6 +2797,22 @@ interface CreateAttestationInput {
 }
 ```
 
+**OwnerAttestationInput** (interface)
+```typescript
+interface OwnerAttestationInput {
+  subjectType: AttestationSubjectType
+  subjectId: string
+  attestationType: string
+  recordedAt?: string
+  visibility?: 'public' | 'owner'
+  value?: Record<string, any>
+  ownerData?: Record<string, any>
+  unit?: string
+  source?: string
+  metadata?: Record<string, any>
+}
+```
+
 **ListAttestationsResponse** (interface)
 ```typescript
 interface ListAttestationsResponse {
@@ -2804,6 +2820,13 @@ interface ListAttestationsResponse {
 }
 ```
 
+**CreateOwnerAttestationResponse** (interface)
+```typescript
+interface CreateOwnerAttestationResponse {
+  attestation: Attestation
+}
+```
+
 **PublicListAttestationsResponse** (interface)
 ```typescript
 interface PublicListAttestationsResponse {
@@ -9063,6 +9086,10 @@ Tree latest snapshot — most-recent record per type across a container subtree
     params: ListAttestationsParams) → `Promise<PublicListAttestationsResponse>`
 List attestations for a subject (public). Records with `visibility='admin'` are always excluded. Records with `visibility='owner'` are included only when the caller provides a valid Firebase ID token that resolves to the subject owner. The `audience` field in the response indicates the tier that was served. ```typescript const { attestations: records, audience } = await attestations.publicList('coll_123', { subjectType: 'proof', subjectId:   'proof-uuid', }) ```
 
+**publicCreate**(collectionId: string,
+    data: OwnerAttestationInput) → `Promise<CreateOwnerAttestationResponse>`
+Create an OWNER-authored attestation (public write) — the counterpart to the admin {@link create}. The authenticated caller must OWN the linked proof (identity, not a read grant). Guardrails enforced server-side: they may write `value` + `ownerData` only (`adminData` is dropped), `visibility` is clamped to `'public' | 'owner'`, and `authorId` is forced to the caller. The record joins the same tamper-evident hash chain. POST /public/collection/:collectionId/attestations ```ts await attestations.publicCreate('coll_123', { subjectType: 'proof', subjectId: 'proof_1', attestationType: 'condition-report', value: { grade: 'excellent' }, visibility: 'public', }) ```
+
 **publicSummary**(collectionId: string,
     params: AttestationSummaryParams) → `Promise<PublicAttestationSummaryResponse>`
 Time-series summary (public). Always served at `audience='public'`.  Same parameters as the admin version. `attestationType` are required

package/dist/docs/attestations.md

@@ -159,6 +159,15 @@ The middleware resolves the UID and checks ownership:
 
 When ownership is confirmed the request is served at `audience='owner'`, which includes `ownerData`.
 
+**Owner write** — the proof owner may also *author* an attestation on their own item via `POST /api/v1/public/collection/:collectionId/attestations` (`attestations.publicCreate`). It is the public counterpart to the admin write, with tight guardrails:
+
+- the caller must be authenticated and **own the linked proof** (identity — a read grant is not enough); a subject with no linked proof is rejected;
+- they may write `value` and `ownerData` only — **`adminData` is dropped** (the business zone);
+- `visibility` is clamped to `'public' | 'owner'` (never `'admin'`), defaulting to `'owner'`;
+- `authorId` is forced to the caller and `metadata.authorType = 'owner'` is stamped.
+
+The record joins the same append-only, hash-chained log as business/system writes. Business writes (any zone/visibility) remain admin-only.
+
 ### Visibility vs audience
 
 `visibility` is a property of an **individual record** set at write time.  `audience` describes the **caller's tier** resolved at read time.  The server applies:

package/dist/openapi.yaml

@@ -10270,6 +10270,37 @@ paths:
           description: Unauthorized
         404:
           description: Not found
+    post:
+      tags:
+        - attestations
+      summary: "Create an OWNER-authored attestation (public write) — the counterpart to the admin {@link create}."
+      operationId: attestations_publicCreate
+      security: []
+      parameters:
+        - name: collectionId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/CreateOwnerAttestationResponse"
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OwnerAttestationInput"
   /public/collection/{collectionId}/attestations/latest:
     get:
       tags:
@@ -18782,6 +18813,39 @@ components:
         - subjectType
         - subjectId
         - attestationType
+    OwnerAttestationInput:
+      type: object
+      properties:
+        subjectType:
+          $ref: "#/components/schemas/AttestationSubjectType"
+        subjectId:
+          type: string
+        attestationType:
+          type: string
+        recordedAt:
+          type: string
+        visibility:
+          type: string
+          enum:
+            - public
+            - owner
+        value:
+          type: object
+          additionalProperties: true
+        ownerData:
+          type: object
+          additionalProperties: true
+        unit:
+          type: string
+        source:
+          type: string
+        metadata:
+          type: object
+          additionalProperties: true
+      required:
+        - subjectType
+        - subjectId
+        - attestationType
     ListAttestationsResponse:
       type: object
       properties:
@@ -18791,6 +18855,13 @@ components:
             $ref: "#/components/schemas/Attestation"
       required:
         - attestations
+    CreateOwnerAttestationResponse:
+      type: object
+      properties:
+        attestation:
+          $ref: "#/components/schemas/Attestation"
+      required:
+        - attestation
     PublicListAttestationsResponse:
       type: object
       properties:

package/dist/types/attestations.d.ts

@@ -128,9 +128,31 @@ export interface CreateAttestationInput {
     authorId?: string;
     metadata?: Record<string, any>;
 }
+/**
+ * Owner-authored attestation input (public write). The proof OWNER adds an
+ * attestation to their own item. Restricted vs {@link CreateAttestationInput}:
+ * no `adminData` (business-only zone), `visibility` limited to `'public' | 'owner'`,
+ * and `authorId` is forced to the caller by the server (so it's omitted here).
+ */
+export interface OwnerAttestationInput {
+    subjectType: AttestationSubjectType;
+    subjectId: string;
+    attestationType: string;
+    recordedAt?: string;
+    /** `'public'` | `'owner'` only — defaults to `'owner'`. */
+    visibility?: 'public' | 'owner';
+    value?: Record<string, any>;
+    ownerData?: Record<string, any>;
+    unit?: string;
+    source?: string;
+    metadata?: Record<string, any>;
+}
 export interface ListAttestationsResponse {
     attestations: Attestation[];
 }
+export interface CreateOwnerAttestationResponse {
+    attestation: Attestation;
+}
 export interface PublicListAttestationsResponse {
     attestations: Attestation[];
     /** Resolved audience tier; governs which data zones are populated */

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 1.16.5  |  Generated: 2026-09-05T15:46:49.017Z
+Version: 1.16.6  |  Generated: 2026-09-06T07:49:21.444Z
 
 This is a concise summary of all available API functions and types.
 
@@ -2797,6 +2797,22 @@ interface CreateAttestationInput {
 }
 ```
 
+**OwnerAttestationInput** (interface)
+```typescript
+interface OwnerAttestationInput {
+  subjectType: AttestationSubjectType
+  subjectId: string
+  attestationType: string
+  recordedAt?: string
+  visibility?: 'public' | 'owner'
+  value?: Record<string, any>
+  ownerData?: Record<string, any>
+  unit?: string
+  source?: string
+  metadata?: Record<string, any>
+}
+```
+
 **ListAttestationsResponse** (interface)
 ```typescript
 interface ListAttestationsResponse {
@@ -2804,6 +2820,13 @@ interface ListAttestationsResponse {
 }
 ```
 
+**CreateOwnerAttestationResponse** (interface)
+```typescript
+interface CreateOwnerAttestationResponse {
+  attestation: Attestation
+}
+```
+
 **PublicListAttestationsResponse** (interface)
 ```typescript
 interface PublicListAttestationsResponse {
@@ -9063,6 +9086,10 @@ Tree latest snapshot — most-recent record per type across a container subtree
     params: ListAttestationsParams) → `Promise<PublicListAttestationsResponse>`
 List attestations for a subject (public). Records with `visibility='admin'` are always excluded. Records with `visibility='owner'` are included only when the caller provides a valid Firebase ID token that resolves to the subject owner. The `audience` field in the response indicates the tier that was served. ```typescript const { attestations: records, audience } = await attestations.publicList('coll_123', { subjectType: 'proof', subjectId:   'proof-uuid', }) ```
 
+**publicCreate**(collectionId: string,
+    data: OwnerAttestationInput) → `Promise<CreateOwnerAttestationResponse>`
+Create an OWNER-authored attestation (public write) — the counterpart to the admin {@link create}. The authenticated caller must OWN the linked proof (identity, not a read grant). Guardrails enforced server-side: they may write `value` + `ownerData` only (`adminData` is dropped), `visibility` is clamped to `'public' | 'owner'`, and `authorId` is forced to the caller. The record joins the same tamper-evident hash chain. POST /public/collection/:collectionId/attestations ```ts await attestations.publicCreate('coll_123', { subjectType: 'proof', subjectId: 'proof_1', attestationType: 'condition-report', value: { grade: 'excellent' }, visibility: 'public', }) ```
+
 **publicSummary**(collectionId: string,
     params: AttestationSummaryParams) → `Promise<PublicAttestationSummaryResponse>`
 Time-series summary (public). Always served at `audience='public'`.  Same parameters as the admin version. `attestationType` are required

package/docs/attestations.md

@@ -159,6 +159,15 @@ The middleware resolves the UID and checks ownership:
 
 When ownership is confirmed the request is served at `audience='owner'`, which includes `ownerData`.
 
+**Owner write** — the proof owner may also *author* an attestation on their own item via `POST /api/v1/public/collection/:collectionId/attestations` (`attestations.publicCreate`). It is the public counterpart to the admin write, with tight guardrails:
+
+- the caller must be authenticated and **own the linked proof** (identity — a read grant is not enough); a subject with no linked proof is rejected;
+- they may write `value` and `ownerData` only — **`adminData` is dropped** (the business zone);
+- `visibility` is clamped to `'public' | 'owner'` (never `'admin'`), defaulting to `'owner'`;
+- `authorId` is forced to the caller and `metadata.authorType = 'owner'` is stamped.
+
+The record joins the same append-only, hash-chained log as business/system writes. Business writes (any zone/visibility) remain admin-only.
+
 ### Visibility vs audience
 
 `visibility` is a property of an **individual record** set at write time.  `audience` describes the **caller's tier** resolved at read time.  The server applies:

package/openapi.yaml

@@ -10270,6 +10270,37 @@ paths:
           description: Unauthorized
         404:
           description: Not found
+    post:
+      tags:
+        - attestations
+      summary: "Create an OWNER-authored attestation (public write) — the counterpart to the admin {@link create}."
+      operationId: attestations_publicCreate
+      security: []
+      parameters:
+        - name: collectionId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/CreateOwnerAttestationResponse"
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OwnerAttestationInput"
   /public/collection/{collectionId}/attestations/latest:
     get:
       tags:
@@ -18782,6 +18813,39 @@ components:
         - subjectType
         - subjectId
         - attestationType
+    OwnerAttestationInput:
+      type: object
+      properties:
+        subjectType:
+          $ref: "#/components/schemas/AttestationSubjectType"
+        subjectId:
+          type: string
+        attestationType:
+          type: string
+        recordedAt:
+          type: string
+        visibility:
+          type: string
+          enum:
+            - public
+            - owner
+        value:
+          type: object
+          additionalProperties: true
+        ownerData:
+          type: object
+          additionalProperties: true
+        unit:
+          type: string
+        source:
+          type: string
+        metadata:
+          type: object
+          additionalProperties: true
+      required:
+        - subjectType
+        - subjectId
+        - attestationType
     ListAttestationsResponse:
       type: object
       properties:
@@ -18791,6 +18855,13 @@ components:
             $ref: "#/components/schemas/Attestation"
       required:
         - attestations
+    CreateOwnerAttestationResponse:
+      type: object
+      properties:
+        attestation:
+          $ref: "#/components/schemas/Attestation"
+      required:
+        - attestation
     PublicListAttestationsResponse:
       type: object
       properties:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proveanything/smartlinks",
-  "version": "1.16.5",
+  "version": "1.16.6",
   "description": "Official JavaScript/TypeScript SDK for the Smartlinks API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",