@proveanything/smartlinks 2.0.22 → 2.0.25

package/dist/context.d.ts

@@ -0,0 +1,18 @@
+export interface SmartLinksContext {
+    collectionId?: string;
+    appId?: string;
+    productId?: string;
+    proofId?: string;
+    /** Any other declared view params (e.g. pageId, voteId, orientation, tvMode). */
+    [key: string]: string | undefined;
+}
+/**
+ * Merge the app's context from `overrides` (e.g. container props) → URL hash query → URL search,
+ * with the FIRST source winning (props override the URL, hash overrides search). Safe in non-browser
+ * environments (returns just the overrides). Empty-string values are kept (a param that was set to "").
+ *
+ * @example
+ *   // Works identically whether embedded as a page (URL) or a container (props):
+ *   const { collectionId, productId } = SL.readContext(containerProps)
+ */
+export declare function readContext(overrides?: Record<string, string | undefined>): SmartLinksContext;

package/dist/context.js

@@ -0,0 +1,48 @@
+// src/context.ts
+// Read the app's runtime CONTEXT (collectionId, appId, productId, proofId, and any app-specific
+// params) regardless of how the app was delivered. A public app renders the SAME page whether it is:
+//   - a PAGE (index.html / HashRouter) — context arrives in the URL search and/or the hash query, or
+//   - a COMPONENT (PublicContainer) — context arrives as props from the parent.
+// This helper merges those sources with a clear precedence so apps stop hand-rolling the
+// `containerProps || hash || search` chain. See docs/design/public-views.md.
+function readSearchParamsInto(out, usp) {
+    usp.forEach((value, key) => {
+        if (out[key] == null && value != null)
+            out[key] = value; // first writer wins
+    });
+}
+/**
+ * Merge the app's context from `overrides` (e.g. container props) → URL hash query → URL search,
+ * with the FIRST source winning (props override the URL, hash overrides search). Safe in non-browser
+ * environments (returns just the overrides). Empty-string values are kept (a param that was set to "").
+ *
+ * @example
+ *   // Works identically whether embedded as a page (URL) or a container (props):
+ *   const { collectionId, productId } = SL.readContext(containerProps)
+ */
+export function readContext(overrides) {
+    const out = {};
+    // 1. overrides (container props) win.
+    if (overrides) {
+        for (const [key, value] of Object.entries(overrides)) {
+            if (value != null && out[key] == null)
+                out[key] = value;
+        }
+    }
+    try {
+        if (typeof window !== 'undefined' && window.location) {
+            // 2. hash query (e.g. "#/preview?collectionId=..&pageId=..") — the CDN/hash-router form.
+            const hash = window.location.hash || '';
+            const q = hash.indexOf('?');
+            if (q >= 0)
+                readSearchParamsInto(out, new URLSearchParams(hash.slice(q + 1)));
+            // 3. search string.
+            if (window.location.search)
+                readSearchParamsInto(out, new URLSearchParams(window.location.search));
+        }
+    }
+    catch (_a) {
+        /* non-browser / bad URL — return what we have */
+    }
+    return out;
+}

package/dist/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.0.22  |  Generated: 2026-09-25T18:07:22.478Z
+Version: 2.0.25  |  Generated: 2026-09-27T12:31:16.701Z
 
 This is a concise summary of all available API functions and types.
 
@@ -2132,6 +2132,7 @@ interface AppFunctionDef {
   authority?: AppFunctionAuthority;
   elevated?: boolean;
   capabilities?: string[];
+  dataScope?: 'collection' | 'global';
   apiVersion?: string;
   handler?: string;
 }
@@ -2145,6 +2146,40 @@ interface AppManifestFunctions {
 }
 ```
 
+**AppDataOpts** (interface)
+```typescript
+interface AppDataOpts {
+  scope?: 'collection' | 'global';
+  productId?: string;
+  variantId?: string;
+  batchId?: string;
+  dataId?: string;
+  queries?: Record<string, any>;
+}
+```
+
+**AppDataHandle** (interface)
+```typescript
+interface AppDataHandle {
+  get(opts?: AppDataOpts): Promise<any>;
+  set(data: any, opts?: AppDataOpts): Promise<any>;
+  getData(opts?: AppDataOpts): Promise<any>;
+  setData(data: any, opts?: AppDataOpts): Promise<any>;
+  delete(opts?: AppDataOpts): Promise<any>;
+}
+```
+
+**ServerFunctionSl** (interface)
+```typescript
+interface ServerFunctionSl {
+  appRecords: any;
+  products: any;
+  attestations: any;
+  appData: AppDataHandle & { global: AppDataHandle; collection: AppDataHandle };
+  app(appId: string): { data: Pick<AppDataHandle, 'get' | 'getData'> };
+}
+```
+
 **ServerFunctionCaller** (interface)
 ```typescript
 interface ServerFunctionCaller {
@@ -2161,7 +2196,7 @@ interface ServerFunctionCaller {
 interface ServerFunctionContext {
   collectionId: string;
   appId: string;
-  sl: any;
+  sl: ServerFunctionSl;
   secrets: {
   get(ref: string): Promise<string | null>;
   app(ref: string): Promise<string | null>;
@@ -2172,6 +2207,18 @@ interface ServerFunctionContext {
 }
 ```
 
+**ServerFunctionHttpEvent<TBody = any>** (interface)
+```typescript
+interface ServerFunctionHttpEvent<TBody = any> {
+  method: string;
+  body: TBody;
+  query: Record<string, any>;
+  headers: Record<string, any>;
+  rawBody?: string | Buffer | null;
+  contentType?: string | null;
+}
+```
+
 **AppAdminConfig** (interface)
 ```typescript
 interface AppAdminConfig {
@@ -2233,6 +2280,25 @@ interface AppAdminConfig {
 }
 ```
 
+**PublicViewParams** (interface)
+```typescript
+interface PublicViewParams {
+  required?: string[];
+  optional?: string[];
+}
+```
+
+**PublicView** (interface)
+```typescript
+interface PublicView {
+  id: string;
+  title: string;
+  route?: string;
+  set?: Record<string, string>;
+  params?: PublicViewParams;
+}
+```
+
 **AppManifest** (interface)
 ```typescript
 interface AppManifest {
@@ -2267,6 +2333,7 @@ interface AppManifest {
   components: AppContainerComponent[];
   };
   linkable?: DeepLinkEntry[];
+  publicViews?: PublicView[];
   executor?: AppManifestExecutor;
   functions?: AppManifestFunctions;
   [key: string]: any;

package/dist/docs/app-manifest.md

@@ -332,6 +332,48 @@ See the [Deep Link Discovery guide](deep-link-discovery.md) for the full dual-so
 | `path` | string | ❌ | Hash route within the app (defaults to `"/"` if omitted) |
 | `params` | object | ❌ | App-specific query params appended to the URL — do **not** include platform params (`collectionId`, `productId`, etc.) |
 
+#### `publicViews`
+
+Declares the app's **public views** — **standalone, external screens** served over your single public
+bundle (`index.html` → HashRouter): a display board, a kiosk/TV screen, a dashboard, a public share
+page. Without this, those routes/modes are invisible to the platform and the Dev Hub. Each view is a
+`route` + fixed `set` params + caller `params`.
+
+> **Public views are NOT portal.** They are completely external and independent. Their only input is
+> **URL parameters** (often a `collectionId`, as a plain param). They expect **no** portal wrapper, **no**
+> host-managed auth/session, and **no** physical-twin context (no QR/NFC/tag scan). They open at a URL
+> and stand alone. For the two **portal** surfaces — where the app renders *inside* portal, and the
+> entry points portal menus link to — see below.
+
+```json
+"publicViews": [
+  { "id": "board", "title": "Display board", "route": "/display",
+    "params": { "required": ["collectionId"], "optional": ["orientation"] } },
+  { "id": "tv",    "title": "TV / big screen", "route": "/", "set": { "tvMode": "true" },
+    "params": { "required": ["collectionId", "voteId"] } }
+]
+```
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `id` | string | ✅ | Stable id, unique within the app |
+| `title` | string | ✅ | Human label (Dev Hub dropdown, platform pickers) |
+| `route` | string | ❌ | Hash route within the public bundle (defaults to `"/"`) |
+| `set` | object | ❌ | Query params this view PINS (e.g. `{ "tvMode": "true" }`), merged under caller params |
+| `params` | `{ required?: string[]; optional?: string[] }` | ❌ | The params the caller supplies via the URL |
+
+Read the URL params with **`SL.readContext()`** (merges hash → search) instead of hand-rolling it.
+
+##### Public views vs the two portal surfaces
+
+An app can have any combination of three setup styles. Only public views are external:
+
+| Style | Declared by | Lives | Context |
+|-------|-------------|-------|---------|
+| **Portal components** — where the app renders inside portal (collection / product / batch / variant / proof) | module registry `components.*` (set at publish) | Inside portal | Physical twin (QR/NFC scan) |
+| **Portal deep links** — the entry points portal menus/tabs/side-menus link to (e.g. list view vs calendar view) | `linkable` / `DeepLinkEntry` | Inside portal | Portal (menu picks the entry) |
+| **Public views** — standalone external screens | `publicViews` (this block) | Outside portal | URL params only |
+
 #### `records`
 
 Declares which `app.records` record types the app stores, and which scopes each type supports. Required for any app that follows the [App Records Pattern](app-records-pattern.md). Omit if the app does not use scoped records.

package/dist/docs/server-functions.md

@@ -320,7 +320,8 @@ Prefer the platform primitives above over a dependency; when you do need one, pi
 | Hash / HMAC-sign / verify / encrypt | `crypto.subtle` (Web Crypto) | — |
 | Random id / bytes | `crypto.randomUUID()` / `crypto.getRandomValues()` | — |
 | Read or write SmartLinks data | `ctx.sl.*` (records, products, attestations, …) | the matching `sl:<res>:<read\|write>` |
-| Read/write general or app-wide data (config, URLs, counters, arrays) | `ctx.sl.appData.get()` / `ctx.sl.appData.set({…})` — pass `{ scope: 'global' }` for app-wide (shared by every install; global writes need collection authority) | `sl:data:read` / `sl:data:write` |
+| Read/write your app's own data (config, URLs, counters, arrays) | `ctx.sl.appData.get()` / `ctx.sl.appData.set({…})` — collection-scoped by default; `ctx.sl.appData.global.*` (or `{ scope:'global' }`, or declare `dataScope:'global'`) for the app-wide bucket. It's your OWN namespace, so **any** authority may read/write it | `sl:data:read` / `sl:data:write` |
+| Read ANOTHER app's data (as the caller may see it) | `ctx.sl.app('other-app').data.get()` — caller-authority, this collection, public-filtered, read-only | `sl:data:read` |
 | Guarantee a UNIQUE claim (pool of numbers, one-per-user, idempotency key) | `ctx.sl.appRecords.create({ ref: 'ball:57' })` — the DB unique index rejects a duplicate `ref` (catch = "already taken") | `sl:records:write` |
 
 Notes:
@@ -403,13 +404,25 @@ from your app").
 > trusted. When untrusted third-party apps arrive, gate *elevated* (`public` + `collection`)
 > invocation of a **non-enabled** app behind install/consent — the app-scoped resolver is the seam.
 
-The request body is delivered to the handler as `event.body` (query string as
-`event.query`). A function only runs on its own surface — calling an `admin` function on
-the public endpoint is a `403`. The response is `{ ok: true, result }` on success, or
-`{ error, message }` (HTTP 400) if the handler returned an error. On the **admin surface**
-the response also includes `logs` (your `ctx.log` lines) and `durationMs` for quick
-debugging; the **public surface returns only `result`** (a public caller never sees your
-internal logs). `GET` on either endpoint lists the functions callable on that surface.
+The handler receives the request as `event`: `event.body` (parsed JSON), `event.query`,
+`event.headers`, `event.rawBody` (raw bytes, for XML/form/other inputs), and `event.contentType`.
+A function only runs on its own surface — calling an `admin` function on the public endpoint is a
+`403`. `GET` on either endpoint lists the functions callable on that surface.
+
+**Response contract — your return IS the response (no envelope):**
+- Return a **plain value** → it becomes the JSON body, HTTP `200`. (`SL.functions.call()` gives you
+  that value directly — `res.value`, not `res.result.value`.)
+- Return a web-standard **`Response`** → passed through verbatim: your status, headers, content-type
+  and body (XML, CSV, text, binary, redirect, custom status). `Response` is a runtime global.
+  ```js
+  return new Response(toXml(data), { status: 200, headers: { "content-type": "application/xml" } })
+  ```
+- **Throw** → HTTP `500` `{ error: "FUNCTION_ERROR", message, code }`. For *expected* errors (400/404/
+  409…), return a `Response` with your own status + body.
+
+One rule: **plain object ⇒ 200; want any other status/headers/content-type ⇒ return a `Response`.**
+Timing comes back in an `X-SL-Function-Duration-Ms` header (admin surface); your `ctx.log` lines land
+in the collection's Errors & Activity feed — the body stays purely your output.
 
 The admin surface is collection-admin gated, so an admin function's `caller` authority runs
 at admin level, attributed to the signed-in admin. The public surface resolves auth if a
@@ -434,7 +447,7 @@ So the end-to-end path is: *write → register the release → enable on a colle
 Every invocation is recorded as an **execution** activity event, carrying your `ctx.log`
 lines. Where to look, easiest first:
 
-- **Admin-surface response** — `logs` + `durationMs` come straight back in the JSON.
+- **Admin-surface response** — timing comes back in the `X-SL-Function-Duration-Ms` header (logs are in Errors & Activity, not the body).
 - **Deployed test mode** — see below; real run, isolated logging.
 - **Owner console** — the collection's **Advanced → Errors & Activity → events** tab,
   filtered to **source = execution**: each run shows as `function <name> ok` (or an error),

package/dist/http.d.ts

@@ -52,6 +52,14 @@ export declare function initializeApi(options: {
      * Preserved across re-initialization when not supplied.
      */
     appId?: string;
+    /**
+     * Declares that a bearer token will arrive asynchronously (e.g. handed by the host over
+     * postMessage in a dev/direct embed). Until setBearerToken() is called, outgoing requests wait
+     * rather than firing unauthenticated. Ignored if a bearerToken is already present.
+     */
+    awaitAuth?: boolean;
+    /** How long (ms) to wait for the async token before letting requests proceed anyway. Default 8000. */
+    awaitAuthTimeoutMs?: number;
     iframeAutoResize?: boolean;
     logger?: Logger;
     /**

package/dist/http.js

@@ -52,6 +52,16 @@ let grantToken = undefined;
  * app-scoped when this is set. Explicit `appId` on a call always overrides it.
  */
 let appContextId = undefined;
+/**
+ * Auth-ready gate. When an app declares (initializeApi({ awaitAuth: true })) that its bearer token
+ * will arrive ASYNCHRONOUSLY — e.g. a dev app embedded in the console that receives its token over
+ * postMessage — outgoing requests await this until setBearerToken() is called, so the app's first
+ * calls don't race the token and 401. Resolved by default (no gating); a timeout resolves it anyway
+ * so a token that never arrives can't hang the app forever.
+ */
+let authReady = Promise.resolve();
+let resolveAuthReady = null;
+function ensureAuthReady() { return authReady; }
 /** Whether initializeApi has been successfully called at least once. */
 let initialized = false;
 /** Safely returns the current browser hostname, or an empty string in non-browser / Node environments. */
@@ -481,6 +491,18 @@ export function initializeApi(options) {
         }
     }
     // else: preserve the existing runtime bearerToken.
+    // Open the auth-ready gate when the caller declares a token is coming but none is set yet, so
+    // requests wait for setBearerToken() instead of firing unauthenticated. A timeout releases it.
+    if (options.awaitAuth && !bearerToken && !resolveAuthReady) {
+        authReady = new Promise((res) => {
+            var _a;
+            resolveAuthReady = res;
+            setTimeout(() => { if (resolveAuthReady) {
+                resolveAuthReady = null;
+                res();
+            } }, (_a = options.awaitAuthTimeoutMs) !== null && _a !== void 0 ? _a : 8000);
+        });
+    }
     proxyMode = !!options.proxyMode;
     // Auto-enable ngrok skip header if domain contains .ngrok.io and user did not explicitly set the flag.
     // Infer ngrok usage from common domains (.ngrok.io or .ngrok-free.dev)
@@ -530,6 +552,12 @@ export function setExtraHeaders(headers) {
  * login or logout event.
  */
 export function setBearerToken(token) {
+    // Release any auth-ready gate the moment a real token arrives (even if the value is unchanged),
+    // so requests that were waiting for the async handoff can proceed.
+    if (token && resolveAuthReady) {
+        resolveAuthReady();
+        resolveAuthReady = null;
+    }
     if (token === bearerToken)
         return;
     bearerToken = token;
@@ -1189,6 +1217,7 @@ export async function proxyUploadFormData(path, formData, onProgress) {
  * Node-safe: IndexedDB calls are no-ops when IDB is unavailable.
  */
 export async function request(path) {
+    await ensureAuthReady();
     const skipCache = shouldSkipCache(path);
     const cacheKey = buildCacheKey(path);
     const ttl = skipCache ? 0 : getTtlForPath(path);
@@ -1314,6 +1343,7 @@ export async function request(path) {
  * Returns the parsed JSON as T, or throws an Error.
  */
 export async function post(path, body, extraHeaders) {
+    await ensureAuthReady();
     if (proxyMode) {
         logDebug('[smartlinks] POST via proxy', { path, body: safeBodyPreview(body) });
         const result = await proxyRequest("POST", path, body, extraHeaders);
@@ -1375,6 +1405,7 @@ export async function post(path, body, extraHeaders) {
  * Returns the parsed JSON as T, or throws an Error.
  */
 export async function put(path, body, extraHeaders) {
+    await ensureAuthReady();
     if (proxyMode) {
         logDebug('[smartlinks] PUT via proxy', { path, body: safeBodyPreview(body) });
         const result = await proxyRequest("PUT", path, body, extraHeaders);
@@ -1436,6 +1467,7 @@ export async function put(path, body, extraHeaders) {
  * Returns the parsed JSON as T, or throws an Error.
  */
 export async function patch(path, body, extraHeaders) {
+    await ensureAuthReady();
     if (proxyMode) {
         logDebug('[smartlinks] PATCH via proxy', { path, body: safeBodyPreview(body) });
         const result = await proxyRequest("PATCH", path, body, extraHeaders);
@@ -1648,6 +1680,7 @@ export async function requestStream(path, options) {
  * Returns the parsed JSON as T, or throws an Error.
  */
 export async function del(path, extraHeaders) {
+    await ensureAuthReady();
     if (proxyMode) {
         logDebug('[smartlinks] DELETE via proxy', { path });
         const result = await proxyRequest("DELETE", path, undefined, extraHeaders);

package/dist/iframe.d.ts

@@ -21,6 +21,20 @@ export declare namespace iframe {
     export function disableAutoIframeResize(): void;
     /** Send a custom message to parent (browser-only). */
     export function sendParentCustom(type: string, payload: Record<string, any>): void;
+    /**
+     * Ask the embedding host (parent window) to hand this app a bearer token, for DIRECT (non-proxied)
+     * mode. Posts `{ type: 'smartlinks:request-auth' }` and resolves with the token from the host's
+     * `{ type: 'smartlinks:auth', bearerToken }` reply, or `null` on timeout / when not embedded.
+     *
+     * Use in a first-party/dev embed where the host owns the session and hands it down (the console dev
+     * preview), then feed it to the SDK:
+     *   SL.initializeApi({ baseURL, proxyMode: false, awaitAuth: true })
+     *   SL.iframe.requestParentAuth().then(t => t && SL.setBearerToken(t))
+     * Untrusted third-party embeds should use proxyMode instead (never hold the user's token).
+     */
+    export function requestParentAuth(opts?: {
+        timeoutMs?: number;
+    }): Promise<string | null>;
     /** Returns true if running inside an iframe (browser). */
     export function isIframe(): boolean;
     /** Returns true if ResizeObserver is supported in current environment. */

package/dist/iframe.js

@@ -122,6 +122,49 @@ export var iframe;
         postParentMessage(type, payload);
     }
     iframe.sendParentCustom = sendParentCustom;
+    /**
+     * Ask the embedding host (parent window) to hand this app a bearer token, for DIRECT (non-proxied)
+     * mode. Posts `{ type: 'smartlinks:request-auth' }` and resolves with the token from the host's
+     * `{ type: 'smartlinks:auth', bearerToken }` reply, or `null` on timeout / when not embedded.
+     *
+     * Use in a first-party/dev embed where the host owns the session and hands it down (the console dev
+     * preview), then feed it to the SDK:
+     *   SL.initializeApi({ baseURL, proxyMode: false, awaitAuth: true })
+     *   SL.iframe.requestParentAuth().then(t => t && SL.setBearerToken(t))
+     * Untrusted third-party embeds should use proxyMode instead (never hold the user's token).
+     */
+    function requestParentAuth(opts) {
+        if (!inIframe())
+            return Promise.resolve(null);
+        return new Promise((resolve) => {
+            var _a;
+            let done = false;
+            const finish = (v) => {
+                if (done)
+                    return;
+                done = true;
+                clearTimeout(timer);
+                try {
+                    window.removeEventListener('message', onMsg);
+                }
+                catch ( /* ignore */_a) { /* ignore */ }
+                resolve(v);
+            };
+            const onMsg = (e) => {
+                const d = e && e.data;
+                if (d && d.type === 'smartlinks:auth' && typeof d.bearerToken === 'string' && d.bearerToken) {
+                    finish(d.bearerToken);
+                }
+            };
+            const timer = setTimeout(() => finish(null), (_a = opts === null || opts === void 0 ? void 0 : opts.timeoutMs) !== null && _a !== void 0 ? _a : 8000);
+            try {
+                window.addEventListener('message', onMsg);
+            }
+            catch ( /* ignore */_b) { /* ignore */ }
+            postParentMessage('smartlinks:request-auth', {});
+        });
+    }
+    iframe.requestParentAuth = requestParentAuth;
     /** Returns true if running inside an iframe (browser). */
     function isIframe() {
         return inIframe();

package/dist/index.d.ts

@@ -2,6 +2,8 @@ export { initializeApi, isInitialized, hasAuthCredentials, configureSdkCache, in
 export * from "./api/index.js";
 export * from "./types/index.js";
 export { iframe } from "./iframe.js";
+export { readContext } from "./context.js";
+export type { SmartLinksContext } from "./context.js";
 export type { InvalidateCacheOptions } from "./http.js";
 export * as cache from './cache.js';
 export { IframeResponder, isAdminFromRoles, buildIframeSrc, } from './iframeResponder.js';

package/dist/index.js

@@ -5,6 +5,8 @@ export * from "./api/index.js";
 export * from "./types/index.js";
 // Iframe namespace
 export { iframe } from "./iframe.js";
+// App context reader (props → hash → search), for pages and containers alike
+export { readContext } from "./context.js";
 import * as cache_1 from './cache.js';
 export { cache_1 as cache };
 // IframeResponder (also exported via iframe namespace)

package/dist/openapi.yaml

@@ -18255,6 +18255,11 @@ components:
           type: array
           items:
             type: string
+        dataScope:
+          type: string
+          enum:
+            - collection
+            - global
         apiVersion:
           type: string
         handler:
@@ -18274,6 +18279,41 @@ components:
       required:
         - files
         - definitions
+    AppDataOpts:
+      type: object
+      properties:
+        scope:
+          type: string
+          enum:
+            - collection
+            - global
+        productId:
+          type: string
+        variantId:
+          type: string
+        batchId:
+          type: string
+        dataId:
+          type: string
+        queries:
+          type: object
+          additionalProperties: true
+    AppDataHandle:
+      type: object
+      properties: {}
+    ServerFunctionSl:
+      type: object
+      properties:
+        appRecords: {}
+        products: {}
+        attestations: {}
+        appData:
+          $ref: "#/components/schemas/AppDataHandle"
+      required:
+        - appRecords
+        - products
+        - attestations
+        - appData
     ServerFunctionCaller:
       type: object
       properties:
@@ -18298,7 +18338,8 @@ components:
           type: string
         appId:
           type: string
-        sl: {}
+        sl:
+          $ref: "#/components/schemas/ServerFunctionSl"
         secrets:
           type: object
           additionalProperties: true
@@ -18314,6 +18355,30 @@ components:
         - secrets
         - caller
         - fetch
+    ServerFunctionHttpEvent:
+      type: object
+      properties:
+        method:
+          type: string
+        body:
+          type: object
+          additionalProperties: true
+        query:
+          type: object
+          additionalProperties: true
+        headers:
+          type: object
+          additionalProperties: true
+        rawBody:
+          type: object
+          additionalProperties: true
+        contentType:
+          type: string
+      required:
+        - method
+        - body
+        - query
+        - headers
     AppAdminConfig:
       type: object
       properties:
@@ -18397,6 +18462,35 @@ components:
         - scope
         - name
         - type
+    PublicViewParams:
+      type: object
+      properties:
+        required:
+          type: array
+          items:
+            type: string
+        optional:
+          type: array
+          items:
+            type: string
+    PublicView:
+      type: object
+      properties:
+        id:
+          type: string
+        title:
+          type: string
+        route:
+          type: string
+        set:
+          type: object
+          additionalProperties:
+            type: string
+        params:
+          $ref: "#/components/schemas/PublicViewParams"
+      required:
+        - id
+        - title
     AppManifest:
       type: object
       properties:
@@ -18472,6 +18566,10 @@ components:
           type: array
           items:
             $ref: "#/components/schemas/DeepLinkEntry"
+        publicViews:
+          type: array
+          items:
+            $ref: "#/components/schemas/PublicView"
         executor:
           $ref: "#/components/schemas/AppManifestExecutor"
         functions:

package/dist/testing/index.d.ts

@@ -24,6 +24,25 @@ export interface TestSlImpl {
     attestations?: {
         create?(fields: any): any;
     };
+    /**
+     * THIS app's own data. Provide impls to assert calls, or omit to use a built-in in-memory store
+     * (so a counter test actually persists across calls within the test). `.global`/`.collection` and
+     * per-call `{ scope }` share the same store in the harness.
+     */
+    appData?: {
+        get?(opts?: any): any;
+        set?(data: any, opts?: any): any;
+        getData?(opts?: any): any;
+        setData?(data: any, opts?: any): any;
+        delete?(opts?: any): any;
+    };
+    /** Cross-app reads: return another app's data as the caller would see it. Keyed by appId. */
+    app?: (appId: string) => {
+        data?: {
+            get?(opts?: any): any;
+            getData?(opts?: any): any;
+        };
+    };
 }
 export interface TestCaller {
     userId?: string | null;

package/dist/testing/index.js

@@ -102,6 +102,36 @@ export function createFunctionTestContext(opts) {
             create: gated('attestations', 'write', at.create && at.create.bind(at), 'create'),
         },
     };
+    // appData — own-data (capability-gated only, no role gate). Delegates to a provided impl, else a
+    // built-in in-memory store so read-modify-write (e.g. a counter) works across calls in one test.
+    const ad = impl.appData || {};
+    const memConfig = {};
+    const memData = {};
+    const deepMerge = (t, s) => { for (const k of Object.keys(s || {}))
+        t[k] = (s[k] && typeof s[k] === 'object' && !Array.isArray(s[k])) ? deepMerge(t[k] || {}, s[k]) : s[k]; return t; };
+    const makeAppData = () => ({
+        get: gated('data', 'read', ad.get ? ad.get.bind(ad) : (async () => (Object.assign({}, memConfig))), 'get'),
+        set: gated('data', 'write', ad.set ? ad.set.bind(ad) : (async (data) => deepMerge(memConfig, data)), 'set'),
+        getData: gated('data', 'read', ad.getData ? ad.getData.bind(ad) : (async (opts = {}) => (opts.dataId ? memData[opts.dataId] : Object.values(memData))), 'getData'),
+        setData: gated('data', 'write', ad.setData ? ad.setData.bind(ad) : (async (data, opts = {}) => { if (opts.dataId)
+            memData[opts.dataId] = data; return data; }), 'setData'),
+        delete: gated('data', 'write', ad.delete ? ad.delete.bind(ad) : (async (opts = {}) => { if (opts.dataId)
+            delete memData[opts.dataId];
+        else
+            for (const k of Object.keys(memConfig))
+                delete memConfig[k]; }), 'delete'),
+    });
+    sl.appData = Object.assign(makeAppData(), { global: makeAppData(), collection: makeAppData() });
+    sl.app = (appId) => {
+        const other = (impl.app && impl.app(appId)) || {};
+        const od = other.data || {};
+        return {
+            data: {
+                get: gated('data', 'read', od.get ? od.get.bind(od) : (async () => null), 'app.get'),
+                getData: gated('data', 'read', od.getData ? od.getData.bind(od) : (async () => []), 'app.getData'),
+            },
+        };
+    };
     const secretsMap = opts.secrets || {};
     const baseFetch = opts.fetch || (typeof fetch !== 'undefined' ? fetch : undefined);
     const via = (def.trigger && def.trigger.type) || 'http';

package/dist/types/appManifest.d.ts

@@ -1,3 +1,5 @@
+/// <reference types="node" />
+/// <reference types="node" />
 /**
  * A bundle (widget or container) as returned by the collection widgets endpoint.
  *
@@ -258,6 +260,13 @@ export interface AppFunctionDef {
      * Grammar: `sl:<resource>:<read|write>`, `network` (or `network:<host>`), `secrets:<ref>`.
      */
     capabilities?: string[];
+    /**
+     * Default scope for `ctx.sl.appData.*` — `'collection'` (this collection; the default) or
+     * `'global'` (the app's app-wide bucket, shared by every collection that installed it). A function
+     * whose data is global-by-intent declares `'global'` and then just uses `appData.get()/set()`.
+     * Per-call `{ scope }` and the `appData.global` / `appData.collection` handles override this.
+     */
+    dataScope?: 'collection' | 'global';
     /** SDK/manifest API version this function targets (pinned for runtime compatibility). */
     apiVersion?: string;
     /** Exported handler name in the functions bundle. Defaults to `name`. */
@@ -268,6 +277,57 @@ export interface AppManifestFunctions {
     files: AppManifestFiles;
     definitions: AppFunctionDef[];
 }
+/** Scope + selector options for `ctx.sl.appData.*`. */
+export interface AppDataOpts {
+    /** `'collection'` (this collection) or `'global'` (the app's app-wide bucket). Defaults to the function's `dataScope`. */
+    scope?: 'collection' | 'global';
+    productId?: string;
+    variantId?: string;
+    batchId?: string;
+    /** For `getData`/`setData`/`delete`: the keyed data item id. */
+    dataId?: string;
+    queries?: Record<string, any>;
+}
+/** Read/write handle for an app's own durable data. `set` deep-merges the singleton config blob. */
+export interface AppDataHandle {
+    get(opts?: AppDataOpts): Promise<any>;
+    set(data: any, opts?: AppDataOpts): Promise<any>;
+    getData(opts?: AppDataOpts): Promise<any>;
+    setData(data: any, opts?: AppDataOpts): Promise<any>;
+    delete(opts?: AppDataOpts): Promise<any>;
+}
+/**
+ * The capability-gated SmartLinks surface handed to a server function. Two access modes:
+ *  - by APP identity — `appData` / `appRecords` are THIS app's OWN data (any scope), gated by the
+ *    declared capability only (the caller's role is irrelevant — it's the app's own namespace).
+ *  - by CALLER identity — everything else (products, attestations, and `app(id)` cross-app reads)
+ *    is bounded by what the invoking user could do through the permissioned API.
+ */
+export interface ServerFunctionSl {
+    /** THIS app's records (own namespace). */
+    appRecords: any;
+    /** Products, scoped by caller authority + declared capability. */
+    products: any;
+    /** Attestations, scoped by caller authority + declared capability. */
+    attestations: any;
+    /**
+     * THIS app's durable data/config. Default scope follows the function's declared `dataScope`
+     * (else `collection`). `appData.global` / `appData.collection` force a scope regardless.
+     * Own-data access is gated by `sl:data:read` / `sl:data:write` only.
+     */
+    appData: AppDataHandle & {
+        global: AppDataHandle;
+        collection: AppDataHandle;
+    };
+    /**
+     * Read ANOTHER app's data in this collection, by CALLER identity — only what the invoking user
+     * could read (admin sees all; otherwise public-filtered, private fields stripped). Read-only;
+     * never another app's private/global store, never another collection. Gated by `sl:data:read`.
+     */
+    app(appId: string): {
+        data: Pick<AppDataHandle, 'get' | 'getData'>;
+    };
+}
 /** Identity of whoever invoked a server function. */
 export interface ServerFunctionCaller {
     /** Authenticated user id, or `null` for anonymous/public/system invocations. */
@@ -297,7 +357,7 @@ export interface ServerFunctionContext {
      *                   only — never a global superuser.
      * Declared `capabilities` cap what these calls may do.
      */
-    sl: any;
+    sl: ServerFunctionSl;
     /**
      * Capability-gated secret access (both require the `secrets:<ref>` capability).
      * `get(ref)` resolves the collection's OWN secret first (a client's credential), then falls back
@@ -315,7 +375,29 @@ export interface ServerFunctionContext {
     /** Structured logging captured into run telemetry. */
     log: (message: string, data?: Record<string, any>) => void;
 }
-/** The signature every SmartLinks server function implements. */
+/** The HTTP request handed to an `http`-trigger function as `event`. */
+export interface ServerFunctionHttpEvent<TBody = any> {
+    method: string;
+    /** Parsed JSON body (when the request was JSON). */
+    body: TBody;
+    query: Record<string, any>;
+    /** Raw request headers (lower-cased keys). */
+    headers: Record<string, any>;
+    /** Raw request body bytes, when captured — for non-JSON inputs (XML, form, …). */
+    rawBody?: string | Buffer | null;
+    /** The request `content-type`, if any. */
+    contentType?: string | null;
+}
+/**
+ * The signature every SmartLinks server function implements.
+ *
+ * RETURN CONTRACT (http trigger): whatever you return **is** the HTTP response.
+ *  - a plain value → JSON body, HTTP 200 (no `{ ok, result }` envelope);
+ *  - a web-standard `Response` → passed through verbatim (your status, headers, content-type, body —
+ *    XML, CSV, binary, redirect, custom status);
+ *  - throwing → HTTP 500 `{ error, message, code }`. For expected errors, return a `Response` with
+ *    your own 4xx/5xx.
+ */
 export type ServerFunctionHandler<TEvent = any, TResult = any> = (ctx: ServerFunctionContext, event: TEvent) => Promise<TResult> | TResult;
 /**
  * Shape of `app.admin.json` -- the separate admin configuration file pointed to
@@ -403,6 +485,43 @@ export interface AppAdminConfig {
  * Setup, import, tunable, and metrics configuration lives in a separate
  * `app.admin.json` file. Use the `admin` field to locate and fetch it.
  */
+/** The caller-supplied params a public view expects. */
+export interface PublicViewParams {
+    /** Params the view REQUIRES to render (e.g. `['collectionId','pageId']`). */
+    required?: string[];
+    /** Params the view can use if present (e.g. `['orientation','theme']`). */
+    optional?: string[];
+}
+/**
+ * A declared PUBLIC VIEW of the app — a STANDALONE, freeform screen served over the app's single
+ * public bundle (`index.html` → HashRouter), enumerable/targetable by the platform + Dev Hub instead
+ * of guessing at undeclared hash routes. A view is `route` + fixed params (`set`) + caller `params`.
+ *
+ * PUBLIC VIEWS ARE NOT PORTAL. They are completely external, independent pages — display boards,
+ * projector/kiosk screens, dashboards, public share pages. Their ONLY input is URL parameters (often a
+ * `collectionId`, as a plain param). They expect NO portal wrapper, NO host-managed auth/session, and
+ * NO physical-twin context (no QR/NFC/tag scan). They open at a URL and stand alone.
+ *
+ * This is distinct from the two PORTAL-side surfaces, which are declared elsewhere and are context-fed
+ * by the physical twin the portal resolves:
+ *  - WHERE the app renders inside portal (collection/product/batch/variant/proof) → the module
+ *    registry `components.*` (see prove docs/design/module-registry-fields.md).
+ *  - The different entry points portal MENUS/TABS/SIDE-MENUS link to (e.g. one app with a list view
+ *    and a calendar view) → `linkable`/DeepLinkEntry below.
+ * See docs/design/public-views.md.
+ */
+export interface PublicView {
+    /** Stable id, unique within the app. */
+    id: string;
+    /** Human label (Dev Hub dropdown, platform pickers). */
+    title: string;
+    /** Hash route within the public bundle. Defaults to `/`. */
+    route?: string;
+    /** Query params this view PINS (e.g. `{ tvMode: 'true' }`), merged under the caller's params. */
+    set?: Record<string, string>;
+    /** The params the caller supplies via the URL. */
+    params?: PublicViewParams;
+}
 export interface AppManifest {
     $schema?: string;
     meta?: {
@@ -484,13 +603,24 @@ export interface AppManifest {
         components: AppContainerComponent[];
     };
     /**
-     * Static deep-linkable states built into this app.
-     * These are fixed routes that exist regardless of content — declared once at build time.
-     * Dynamic content entries (e.g. CMS pages) are stored separately in `appConfig.linkable`.
-     * Consumers should merge both sources to get the full set of navigable states.
+     * PORTAL deep-linkable states built into this app — the entry points the portal's menu system
+     * (bottom menu, side menus, tabs) can link to. Use these when one app has several ways to enter/load
+     * its portal component (e.g. a list view and a calendar view, or a viewer and an editor) that
+     * different parts of portal should link to independently. These live INSIDE portal.
+     * Fixed routes are declared here at build time; dynamic content entries (e.g. CMS pages) are stored
+     * separately in `appConfig.linkable` — merge both for the full navigable set.
      * @see DeepLinkEntry
      */
     linkable?: DeepLinkEntry[];
+    /**
+     * The app's PUBLIC VIEWS — STANDALONE, external screens (display boards, kiosks/TVs, dashboards,
+     * public pages) served over the single public bundle, so the platform + Dev Hub can enumerate,
+     * preview, and target them. Declares `route` + fixed `set` params + caller `params` per view.
+     * NOT portal: no portal wrapper, no host auth/session, no physical-twin context — URL params only.
+     * For portal surfaces use `components.*` (where it renders) and `linkable` (portal menu entries).
+     * See PublicView + docs/design/public-views.md.
+     */
+    publicViews?: PublicView[];
     /**
      * Executor bundle declaration. Present when the app ships a programmatic executor
      * for AI-driven configuration, server-side SEO, and LLM content generation.

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.0.22  |  Generated: 2026-09-25T18:07:22.478Z
+Version: 2.0.25  |  Generated: 2026-09-27T12:31:16.701Z
 
 This is a concise summary of all available API functions and types.
 
@@ -2132,6 +2132,7 @@ interface AppFunctionDef {
   authority?: AppFunctionAuthority;
   elevated?: boolean;
   capabilities?: string[];
+  dataScope?: 'collection' | 'global';
   apiVersion?: string;
   handler?: string;
 }
@@ -2145,6 +2146,40 @@ interface AppManifestFunctions {
 }
 ```
 
+**AppDataOpts** (interface)
+```typescript
+interface AppDataOpts {
+  scope?: 'collection' | 'global';
+  productId?: string;
+  variantId?: string;
+  batchId?: string;
+  dataId?: string;
+  queries?: Record<string, any>;
+}
+```
+
+**AppDataHandle** (interface)
+```typescript
+interface AppDataHandle {
+  get(opts?: AppDataOpts): Promise<any>;
+  set(data: any, opts?: AppDataOpts): Promise<any>;
+  getData(opts?: AppDataOpts): Promise<any>;
+  setData(data: any, opts?: AppDataOpts): Promise<any>;
+  delete(opts?: AppDataOpts): Promise<any>;
+}
+```
+
+**ServerFunctionSl** (interface)
+```typescript
+interface ServerFunctionSl {
+  appRecords: any;
+  products: any;
+  attestations: any;
+  appData: AppDataHandle & { global: AppDataHandle; collection: AppDataHandle };
+  app(appId: string): { data: Pick<AppDataHandle, 'get' | 'getData'> };
+}
+```
+
 **ServerFunctionCaller** (interface)
 ```typescript
 interface ServerFunctionCaller {
@@ -2161,7 +2196,7 @@ interface ServerFunctionCaller {
 interface ServerFunctionContext {
   collectionId: string;
   appId: string;
-  sl: any;
+  sl: ServerFunctionSl;
   secrets: {
   get(ref: string): Promise<string | null>;
   app(ref: string): Promise<string | null>;
@@ -2172,6 +2207,18 @@ interface ServerFunctionContext {
 }
 ```
 
+**ServerFunctionHttpEvent<TBody = any>** (interface)
+```typescript
+interface ServerFunctionHttpEvent<TBody = any> {
+  method: string;
+  body: TBody;
+  query: Record<string, any>;
+  headers: Record<string, any>;
+  rawBody?: string | Buffer | null;
+  contentType?: string | null;
+}
+```
+
 **AppAdminConfig** (interface)
 ```typescript
 interface AppAdminConfig {
@@ -2233,6 +2280,25 @@ interface AppAdminConfig {
 }
 ```
 
+**PublicViewParams** (interface)
+```typescript
+interface PublicViewParams {
+  required?: string[];
+  optional?: string[];
+}
+```
+
+**PublicView** (interface)
+```typescript
+interface PublicView {
+  id: string;
+  title: string;
+  route?: string;
+  set?: Record<string, string>;
+  params?: PublicViewParams;
+}
+```
+
 **AppManifest** (interface)
 ```typescript
 interface AppManifest {
@@ -2267,6 +2333,7 @@ interface AppManifest {
   components: AppContainerComponent[];
   };
   linkable?: DeepLinkEntry[];
+  publicViews?: PublicView[];
   executor?: AppManifestExecutor;
   functions?: AppManifestFunctions;
   [key: string]: any;

package/docs/app-manifest.md

@@ -332,6 +332,48 @@ See the [Deep Link Discovery guide](deep-link-discovery.md) for the full dual-so
 | `path` | string | ❌ | Hash route within the app (defaults to `"/"` if omitted) |
 | `params` | object | ❌ | App-specific query params appended to the URL — do **not** include platform params (`collectionId`, `productId`, etc.) |
 
+#### `publicViews`
+
+Declares the app's **public views** — **standalone, external screens** served over your single public
+bundle (`index.html` → HashRouter): a display board, a kiosk/TV screen, a dashboard, a public share
+page. Without this, those routes/modes are invisible to the platform and the Dev Hub. Each view is a
+`route` + fixed `set` params + caller `params`.
+
+> **Public views are NOT portal.** They are completely external and independent. Their only input is
+> **URL parameters** (often a `collectionId`, as a plain param). They expect **no** portal wrapper, **no**
+> host-managed auth/session, and **no** physical-twin context (no QR/NFC/tag scan). They open at a URL
+> and stand alone. For the two **portal** surfaces — where the app renders *inside* portal, and the
+> entry points portal menus link to — see below.
+
+```json
+"publicViews": [
+  { "id": "board", "title": "Display board", "route": "/display",
+    "params": { "required": ["collectionId"], "optional": ["orientation"] } },
+  { "id": "tv",    "title": "TV / big screen", "route": "/", "set": { "tvMode": "true" },
+    "params": { "required": ["collectionId", "voteId"] } }
+]
+```
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `id` | string | ✅ | Stable id, unique within the app |
+| `title` | string | ✅ | Human label (Dev Hub dropdown, platform pickers) |
+| `route` | string | ❌ | Hash route within the public bundle (defaults to `"/"`) |
+| `set` | object | ❌ | Query params this view PINS (e.g. `{ "tvMode": "true" }`), merged under caller params |
+| `params` | `{ required?: string[]; optional?: string[] }` | ❌ | The params the caller supplies via the URL |
+
+Read the URL params with **`SL.readContext()`** (merges hash → search) instead of hand-rolling it.
+
+##### Public views vs the two portal surfaces
+
+An app can have any combination of three setup styles. Only public views are external:
+
+| Style | Declared by | Lives | Context |
+|-------|-------------|-------|---------|
+| **Portal components** — where the app renders inside portal (collection / product / batch / variant / proof) | module registry `components.*` (set at publish) | Inside portal | Physical twin (QR/NFC scan) |
+| **Portal deep links** — the entry points portal menus/tabs/side-menus link to (e.g. list view vs calendar view) | `linkable` / `DeepLinkEntry` | Inside portal | Portal (menu picks the entry) |
+| **Public views** — standalone external screens | `publicViews` (this block) | Outside portal | URL params only |
+
 #### `records`
 
 Declares which `app.records` record types the app stores, and which scopes each type supports. Required for any app that follows the [App Records Pattern](app-records-pattern.md). Omit if the app does not use scoped records.

package/docs/server-functions.md

@@ -320,7 +320,8 @@ Prefer the platform primitives above over a dependency; when you do need one, pi
 | Hash / HMAC-sign / verify / encrypt | `crypto.subtle` (Web Crypto) | — |
 | Random id / bytes | `crypto.randomUUID()` / `crypto.getRandomValues()` | — |
 | Read or write SmartLinks data | `ctx.sl.*` (records, products, attestations, …) | the matching `sl:<res>:<read\|write>` |
-| Read/write general or app-wide data (config, URLs, counters, arrays) | `ctx.sl.appData.get()` / `ctx.sl.appData.set({…})` — pass `{ scope: 'global' }` for app-wide (shared by every install; global writes need collection authority) | `sl:data:read` / `sl:data:write` |
+| Read/write your app's own data (config, URLs, counters, arrays) | `ctx.sl.appData.get()` / `ctx.sl.appData.set({…})` — collection-scoped by default; `ctx.sl.appData.global.*` (or `{ scope:'global' }`, or declare `dataScope:'global'`) for the app-wide bucket. It's your OWN namespace, so **any** authority may read/write it | `sl:data:read` / `sl:data:write` |
+| Read ANOTHER app's data (as the caller may see it) | `ctx.sl.app('other-app').data.get()` — caller-authority, this collection, public-filtered, read-only | `sl:data:read` |
 | Guarantee a UNIQUE claim (pool of numbers, one-per-user, idempotency key) | `ctx.sl.appRecords.create({ ref: 'ball:57' })` — the DB unique index rejects a duplicate `ref` (catch = "already taken") | `sl:records:write` |
 
 Notes:
@@ -403,13 +404,25 @@ from your app").
 > trusted. When untrusted third-party apps arrive, gate *elevated* (`public` + `collection`)
 > invocation of a **non-enabled** app behind install/consent — the app-scoped resolver is the seam.
 
-The request body is delivered to the handler as `event.body` (query string as
-`event.query`). A function only runs on its own surface — calling an `admin` function on
-the public endpoint is a `403`. The response is `{ ok: true, result }` on success, or
-`{ error, message }` (HTTP 400) if the handler returned an error. On the **admin surface**
-the response also includes `logs` (your `ctx.log` lines) and `durationMs` for quick
-debugging; the **public surface returns only `result`** (a public caller never sees your
-internal logs). `GET` on either endpoint lists the functions callable on that surface.
+The handler receives the request as `event`: `event.body` (parsed JSON), `event.query`,
+`event.headers`, `event.rawBody` (raw bytes, for XML/form/other inputs), and `event.contentType`.
+A function only runs on its own surface — calling an `admin` function on the public endpoint is a
+`403`. `GET` on either endpoint lists the functions callable on that surface.
+
+**Response contract — your return IS the response (no envelope):**
+- Return a **plain value** → it becomes the JSON body, HTTP `200`. (`SL.functions.call()` gives you
+  that value directly — `res.value`, not `res.result.value`.)
+- Return a web-standard **`Response`** → passed through verbatim: your status, headers, content-type
+  and body (XML, CSV, text, binary, redirect, custom status). `Response` is a runtime global.
+  ```js
+  return new Response(toXml(data), { status: 200, headers: { "content-type": "application/xml" } })
+  ```
+- **Throw** → HTTP `500` `{ error: "FUNCTION_ERROR", message, code }`. For *expected* errors (400/404/
+  409…), return a `Response` with your own status + body.
+
+One rule: **plain object ⇒ 200; want any other status/headers/content-type ⇒ return a `Response`.**
+Timing comes back in an `X-SL-Function-Duration-Ms` header (admin surface); your `ctx.log` lines land
+in the collection's Errors & Activity feed — the body stays purely your output.
 
 The admin surface is collection-admin gated, so an admin function's `caller` authority runs
 at admin level, attributed to the signed-in admin. The public surface resolves auth if a
@@ -434,7 +447,7 @@ So the end-to-end path is: *write → register the release → enable on a colle
 Every invocation is recorded as an **execution** activity event, carrying your `ctx.log`
 lines. Where to look, easiest first:
 
-- **Admin-surface response** — `logs` + `durationMs` come straight back in the JSON.
+- **Admin-surface response** — timing comes back in the `X-SL-Function-Duration-Ms` header (logs are in Errors & Activity, not the body).
 - **Deployed test mode** — see below; real run, isolated logging.
 - **Owner console** — the collection's **Advanced → Errors & Activity → events** tab,
   filtered to **source = execution**: each run shows as `function <name> ok` (or an error),

package/openapi.yaml

@@ -18255,6 +18255,11 @@ components:
           type: array
           items:
             type: string
+        dataScope:
+          type: string
+          enum:
+            - collection
+            - global
         apiVersion:
           type: string
         handler:
@@ -18274,6 +18279,41 @@ components:
       required:
         - files
         - definitions
+    AppDataOpts:
+      type: object
+      properties:
+        scope:
+          type: string
+          enum:
+            - collection
+            - global
+        productId:
+          type: string
+        variantId:
+          type: string
+        batchId:
+          type: string
+        dataId:
+          type: string
+        queries:
+          type: object
+          additionalProperties: true
+    AppDataHandle:
+      type: object
+      properties: {}
+    ServerFunctionSl:
+      type: object
+      properties:
+        appRecords: {}
+        products: {}
+        attestations: {}
+        appData:
+          $ref: "#/components/schemas/AppDataHandle"
+      required:
+        - appRecords
+        - products
+        - attestations
+        - appData
     ServerFunctionCaller:
       type: object
       properties:
@@ -18298,7 +18338,8 @@ components:
           type: string
         appId:
           type: string
-        sl: {}
+        sl:
+          $ref: "#/components/schemas/ServerFunctionSl"
         secrets:
           type: object
           additionalProperties: true
@@ -18314,6 +18355,30 @@ components:
         - secrets
         - caller
         - fetch
+    ServerFunctionHttpEvent:
+      type: object
+      properties:
+        method:
+          type: string
+        body:
+          type: object
+          additionalProperties: true
+        query:
+          type: object
+          additionalProperties: true
+        headers:
+          type: object
+          additionalProperties: true
+        rawBody:
+          type: object
+          additionalProperties: true
+        contentType:
+          type: string
+      required:
+        - method
+        - body
+        - query
+        - headers
     AppAdminConfig:
       type: object
       properties:
@@ -18397,6 +18462,35 @@ components:
         - scope
         - name
         - type
+    PublicViewParams:
+      type: object
+      properties:
+        required:
+          type: array
+          items:
+            type: string
+        optional:
+          type: array
+          items:
+            type: string
+    PublicView:
+      type: object
+      properties:
+        id:
+          type: string
+        title:
+          type: string
+        route:
+          type: string
+        set:
+          type: object
+          additionalProperties:
+            type: string
+        params:
+          $ref: "#/components/schemas/PublicViewParams"
+      required:
+        - id
+        - title
     AppManifest:
       type: object
       properties:
@@ -18472,6 +18566,10 @@ components:
           type: array
           items:
             $ref: "#/components/schemas/DeepLinkEntry"
+        publicViews:
+          type: array
+          items:
+            $ref: "#/components/schemas/PublicView"
         executor:
           $ref: "#/components/schemas/AppManifestExecutor"
         functions:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proveanything/smartlinks",
-  "version": "2.0.22",
+  "version": "2.0.25",
   "description": "Official JavaScript/TypeScript SDK for the Smartlinks API",
   "type": "module",
   "main": "dist/index.js",
@@ -65,8 +65,7 @@
   "author": "Glenn Shoosmith",
   "license": "MIT",
   "publishConfig": {
-    "access": "public",
-    "tag": "next"
+    "access": "public"
   },
   "dependencies": {
     "cross-fetch": "^3.1.5",