@proveanything/smartlinks 2.0.5 → 2.0.9

package/dist/index.d.ts

@@ -1,29 +1,32 @@
-export { initializeApi, isInitialized, hasAuthCredentials, configureSdkCache, invalidateCache, getHttpCacheDiagnostics, resetHttpCacheDiagnostics, request, post, put, patch, del, sendCustomProxyMessage, getApiHeaders, isProxyEnabled, setBearerToken, getBearerToken, setGrantToken, getGrantToken } from "./http";
-export * from "./api";
-export * from "./types";
-export { iframe } from "./iframe";
-export * as cache from './cache';
-export { IframeResponder, isAdminFromRoles, buildIframeSrc, } from './iframeResponder';
-export * as utils from './utils';
-export type { PortalPathParams, Gs1DigitalLinkParams, ConditionParams, ConditionDebugOptions, ConditionDebugLogger, ConditionSet, Condition, UserInfo, ProductInfo, ProofInfo, CollectionInfo, } from './utils';
-export type { LoginResponse, VerifyTokenResponse, AccountInfoResponse, AuthLocation, } from "./api/auth";
-export type { UserAccountRegistrationRequest, } from "./types/auth";
-export type { CommunicationEvent, CommsQueryByUser, CommsRecipientIdsQuery, CommsRecipientsWithoutActionQuery, CommsRecipientsWithActionQuery, RecipientId, RecipientWithOutcome, LogCommunicationEventBody, LogBulkCommunicationEventsBody, AppendResult, AppendBulkResult, CommsSettings, TopicConfig, CommsSettingsGetResponse, CommsSettingsPatchBody, CommsPublicTopicsResponse, UnsubscribeQuery, UnsubscribeResponse, CommsConsentUpsertRequest, CommsPreferencesUpsertRequest, CommsSubscribeRequest, CommsSubscribeResponse, CommsSubscriptionCheckQuery, CommsSubscriptionCheckResponse, CommsListMethodsQuery, CommsListMethodsResponse, RegisterEmailMethodRequest, RegisterSmsMethodRequest, RegisterMethodResponse, SubscriptionsResolveRequest, SubscriptionsResolveResponse, } from "./types/comms";
-export type { BatchResponse, BatchCreateRequest, BatchUpdateRequest, } from "./types/batch";
-export type { Lot, LotStatus, LotSelector, LotPayload, LotCreateInput, LotUpdateInput, ListLotsParams, ListLotsResponse, LotMemberDiff, ResolveLotResponse, LotProductSummary, ListLotProductsResponse, LotResolutionResult, } from "./types/lots";
-export type { VariantResponse, VariantCreateRequest, VariantUpdateRequest, } from "./types/variant";
-export type { BroadcastSendRequest } from "./types/broadcasts";
-export type { AppConfigOptions } from "./api/appConfiguration";
-export type { AdditionalGtin, ISODateString, JsonPrimitive, JsonValue, ProductCreateRequest, ProductClaimCreateInput, ProductClaimCreateRequestBody, ProductClaimLookupInput, ProductFacetMap, ProductFacetValue, ProductImageUrlInput, ProductKey, ProductQueryRequest, ProductQueryResponse, ProductUpdateRequest, Product, ProductWriteInput, PublicProduct, } from "./types/product";
-export type { TranslationLookupMode, TranslationContentType, TranslationQuality, TranslationItemStatus, TranslationContextValue, TranslationContext, TranslationLookupRequestBase, TranslationLookupSingleRequest, TranslationLookupBatchRequest, TranslationLookupRequest, TranslationLookupItem, TranslationLookupResponse, ResolvedTranslationItem, ResolvedTranslationResponse, TranslationHashOptions, TranslationResolveOptions, TranslationRecord, TranslationListParams, TranslationListResponse, TranslationUpdateRequest, } from "./types/translations";
-export type { FacetBucket, FacetDefinition, FacetDefinitionWriteInput, FacetGetParams, FacetListParams, FacetListResponse, FacetNamespaceListResponse, FacetQueryRequest, FacetQueryResponse, FacetValue, FacetValueDefinition, FacetValueGetParams, FacetValueListParams, FacetValueListResponse, FacetValueResponse, FacetValueWriteInput, PublicFacetListParams, } from "./types/facets";
-export type { Collection, CollectionResponse, CollectionCreateRequest, CollectionUpdateRequest, DomainTarget, HubAvailabilityResponse, } from "./types/collection";
-export type { Proof, ProofResponse, ProofWrite, ProofCreateRequest, ProofUpdateRequest, ProofClaimRequest, ProofGrant, GrantScope, GrantAudience, CreateGrantOptions, RedeemGrantOptions, RedeemGrantResult, ProofTransfer, ProofTransferType, ProofTransferState, TransferProofOptions, TransferProofResult, } from "./types/proof";
-export type { QrShortCodeLookupResponse, } from "./types/qr";
-export type { ReverseTagLookupParams, ReverseTagLookupResponse, } from "./types/tags";
+export { initializeApi, isInitialized, hasAuthCredentials, configureSdkCache, invalidateCache, getHttpCacheDiagnostics, resetHttpCacheDiagnostics, request, post, put, patch, del, sendCustomProxyMessage, getApiHeaders, getBaseURL, isProxyEnabled, setBearerToken, getBearerToken, setGrantToken, getGrantToken } from "./http.js";
+export * from "./api/index.js";
+export * from "./types/index.js";
+export { iframe } from "./iframe.js";
+export type { InvalidateCacheOptions } from "./http.js";
+export * as cache from './cache.js';
+export { IframeResponder, isAdminFromRoles, buildIframeSrc, } from './iframeResponder.js';
+export * as utils from './utils/index.js';
+export { SHARED_DEPENDENCY_CONTRACT_VERSION, SHARED_DEPENDENCIES, SHARED_DEPENDENCY_SPECIFIERS, importMapPathFor, getHostSharedDependencies, } from './shared-dependencies.js';
+export type { SharedDependency, HostSharedDependencies } from './shared-dependencies.js';
+export type { PortalPathParams, Gs1DigitalLinkParams, ConditionParams, ConditionDebugOptions, ConditionDebugLogger, ConditionSet, Condition, UserInfo, ProductInfo, ProofInfo, CollectionInfo, } from './utils/index.js';
+export type { LoginResponse, VerifyTokenResponse, AccountInfoResponse, AuthLocation, } from "./api/auth.js";
+export type { UserAccountRegistrationRequest, } from "./types/auth.js";
+export type { CommunicationEvent, CommsQueryByUser, CommsRecipientIdsQuery, CommsRecipientsWithoutActionQuery, CommsRecipientsWithActionQuery, RecipientId, RecipientWithOutcome, LogCommunicationEventBody, LogBulkCommunicationEventsBody, AppendResult, AppendBulkResult, CommsSettings, TopicConfig, CommsSettingsGetResponse, CommsSettingsPatchBody, CommsPublicTopicsResponse, UnsubscribeQuery, UnsubscribeResponse, CommsConsentUpsertRequest, CommsPreferencesUpsertRequest, CommsSubscribeRequest, CommsSubscribeResponse, CommsSubscriptionCheckQuery, CommsSubscriptionCheckResponse, CommsListMethodsQuery, CommsListMethodsResponse, RegisterEmailMethodRequest, RegisterSmsMethodRequest, RegisterMethodResponse, SubscriptionsResolveRequest, SubscriptionsResolveResponse, } from "./types/comms.js";
+export type { BatchResponse, BatchCreateRequest, BatchUpdateRequest, } from "./types/batch.js";
+export type { Lot, LotStatus, LotSelector, LotPayload, LotCreateInput, LotUpdateInput, ListLotsParams, ListLotsResponse, LotMemberDiff, ResolveLotResponse, LotProductSummary, ListLotProductsResponse, LotResolutionResult, } from "./types/lots.js";
+export type { VariantResponse, VariantCreateRequest, VariantUpdateRequest, } from "./types/variant.js";
+export type { BroadcastSendRequest } from "./types/broadcasts.js";
+export type { AppConfigOptions } from "./api/appConfiguration.js";
+export type { AdditionalGtin, ISODateString, JsonPrimitive, JsonValue, ProductCreateRequest, ProductClaimCreateInput, ProductClaimCreateRequestBody, ProductClaimLookupInput, ProductFacetMap, ProductFacetValue, ProductImageUrlInput, ProductKey, ProductQueryRequest, ProductQueryResponse, ProductUpdateRequest, Product, ProductWriteInput, PublicProduct, } from "./types/product.js";
+export type { TranslationLookupMode, TranslationContentType, TranslationQuality, TranslationItemStatus, TranslationContextValue, TranslationContext, TranslationLookupRequestBase, TranslationLookupSingleRequest, TranslationLookupBatchRequest, TranslationLookupRequest, TranslationLookupItem, TranslationLookupResponse, ResolvedTranslationItem, ResolvedTranslationResponse, TranslationHashOptions, TranslationResolveOptions, TranslationRecord, TranslationListParams, TranslationListResponse, TranslationUpdateRequest, } from "./types/translations.js";
+export type { FacetBucket, FacetDefinition, FacetDefinitionWriteInput, FacetGetParams, FacetListParams, FacetListResponse, FacetNamespaceListResponse, FacetQueryRequest, FacetQueryResponse, FacetValue, FacetValueDefinition, FacetValueGetParams, FacetValueListParams, FacetValueListResponse, FacetValueResponse, FacetValueWriteInput, PublicFacetListParams, } from "./types/facets.js";
+export type { Collection, CollectionResponse, CollectionCreateRequest, CollectionUpdateRequest, DomainTarget, HubAvailabilityResponse, } from "./types/collection.js";
+export type { Proof, ProofResponse, ProofWrite, ProofCreateRequest, ProofUpdateRequest, ProofClaimRequest, ProofGrant, GrantScope, GrantAudience, CreateGrantOptions, RedeemGrantOptions, RedeemGrantResult, ProofTransfer, ProofTransferType, ProofTransferState, TransferProofOptions, TransferProofResult, } from "./types/proof.js";
+export type { QrShortCodeLookupResponse, } from "./types/qr.js";
+export type { ReverseTagLookupParams, ReverseTagLookupResponse, } from "./types/tags.js";
 export type { AdminMobileCapability, ActionableCapability, AdminMobileHostId, AdminMobileEvent, AdminMobileEventCallback, AdminMobileEventSubscriber, ScannerEventSubscriber, // @deprecated — use AdminMobileEventCallback
 AdminMobileHostContext, AdminMobileComponentManifest, AdminMobileBundleManifest, MobileAdminComponentManifest, // @deprecated — use AdminMobileComponentManifest
-MobileAdminBundleManifest, } from './mobile-admin/types';
-export { HostCapabilityUnavailableError, HostPermissionDeniedError, HostTimeoutError, } from './mobile-admin/errors';
-export type { NativeCapability, NativeFacade, ShareFacade, ClipboardFacade, HapticImpactStyle, HapticNotificationStyle, HapticsFacade, NetworkStatus, NetworkFacade, DeviceInfo, DeviceFacade, StorageFacade, QrScanOptions, QrFacade, AuthFacade, NfcReadResult, NfcFacade, RfidScanOptions, RfidFacade, EventsFacade, WebSourceMode, WebSourceConfig, WebSourceFacade, } from './native/types';
-export type { AuthKitUser, UserProfile, ProfileUpdateData, UpdateProfileResponse, SuccessResponse, AuthLoginResponse, AppleLoginOptions, AuthKitErrorCode, RefreshResponse, LogoutResponse, RefreshErrorCode, MagicLinkSendResponse, MagicLinkVerifyResponse, PhoneSendCodeResponse, PhoneVerifyResponse, PasswordResetRequestResponse, VerifyResetTokenResponse, PasswordResetCompleteResponse, EmailVerificationActionResponse, EmailVerifyTokenResponse, VerifyStatus, WhatsAppReplyCta, WhatsAppReplyOptions, WhatsAppContactData, SendWhatsAppRequest, SendWhatsAppResponse, ExchangeWhatsAppSessionResponse, VerifyWhatsAppResponse, WhatsAppStatusResponse, SendSmsVerifyRequest, SendSmsVerifyResponse, VerifySmsResponse, UpsertContactRequest, UpsertContactResponse, AuthKitBrandingConfig, AuthKitConfig, AuthKitConfigInput, AuthKitSecurityConfig, AuthKitPasswordPolicy, AuthKitSessionPolicy, AuthKitLockoutPolicy, PasswordPolicyErrorCode, LoginSecurityErrorCode, } from './types/authKit';
+MobileAdminBundleManifest, } from './mobile-admin/types.js';
+export { HostCapabilityUnavailableError, HostPermissionDeniedError, HostTimeoutError, } from './mobile-admin/errors.js';
+export type { NativeCapability, NativeFacade, ShareFacade, ClipboardFacade, HapticImpactStyle, HapticNotificationStyle, HapticsFacade, NetworkStatus, NetworkFacade, DeviceInfo, DeviceFacade, StorageFacade, QrScanOptions, QrFacade, AuthFacade, NfcReadResult, NfcFacade, RfidScanOptions, RfidFacade, EventsFacade, WebSourceMode, WebSourceConfig, WebSourceFacade, } from './native/types.js';
+export type { AuthKitUser, UserProfile, ProfileUpdateData, UpdateProfileResponse, SuccessResponse, AuthLoginResponse, AppleLoginOptions, AuthKitErrorCode, RefreshResponse, LogoutResponse, RefreshErrorCode, MagicLinkSendResponse, MagicLinkVerifyResponse, PhoneSendCodeResponse, PhoneVerifyResponse, PasswordResetRequestResponse, VerifyResetTokenResponse, PasswordResetCompleteResponse, EmailVerificationActionResponse, EmailVerifyTokenResponse, VerifyStatus, WhatsAppReplyCta, WhatsAppReplyOptions, WhatsAppContactData, SendWhatsAppRequest, SendWhatsAppResponse, ExchangeWhatsAppSessionResponse, VerifyWhatsAppResponse, WhatsAppStatusResponse, SendSmsVerifyRequest, SendSmsVerifyResponse, VerifySmsResponse, UpsertContactRequest, UpsertContactResponse, AuthKitBrandingConfig, AuthKitConfig, AuthKitConfigInput, AuthKitSecurityConfig, AuthKitPasswordPolicy, AuthKitSessionPolicy, AuthKitLockoutPolicy, PasswordPolicyErrorCode, LoginSecurityErrorCode, } from './types/authKit.js';

package/dist/index.js

@@ -1,14 +1,16 @@
 // src/index.ts
 // Top-level entrypoint of the npm package. Re-export initializeApi + all namespaces.
-export { initializeApi, isInitialized, hasAuthCredentials, configureSdkCache, invalidateCache, getHttpCacheDiagnostics, resetHttpCacheDiagnostics, request, post, put, patch, del, sendCustomProxyMessage, getApiHeaders, isProxyEnabled, setBearerToken, getBearerToken, setGrantToken, getGrantToken } from "./http";
-export * from "./api";
-export * from "./types";
+export { initializeApi, isInitialized, hasAuthCredentials, configureSdkCache, invalidateCache, getHttpCacheDiagnostics, resetHttpCacheDiagnostics, request, post, put, patch, del, sendCustomProxyMessage, getApiHeaders, getBaseURL, isProxyEnabled, setBearerToken, getBearerToken, setGrantToken, getGrantToken } from "./http.js";
+export * from "./api/index.js";
+export * from "./types/index.js";
 // Iframe namespace
-export { iframe } from "./iframe";
-import * as cache_1 from './cache';
+export { iframe } from "./iframe.js";
+import * as cache_1 from './cache.js';
 export { cache_1 as cache };
 // IframeResponder (also exported via iframe namespace)
-export { IframeResponder, isAdminFromRoles, buildIframeSrc, } from './iframeResponder';
-import * as utils_1 from './utils';
+export { IframeResponder, isAdminFromRoles, buildIframeSrc, } from './iframeResponder.js';
+import * as utils_1 from './utils/index.js';
 export { utils_1 as utils };
-export { HostCapabilityUnavailableError, HostPermissionDeniedError, HostTimeoutError, } from './mobile-admin/errors';
+// Shared dependency contract (host↔app) — one source of truth for externalized deps
+export { SHARED_DEPENDENCY_CONTRACT_VERSION, SHARED_DEPENDENCIES, SHARED_DEPENDENCY_SPECIFIERS, importMapPathFor, getHostSharedDependencies, } from './shared-dependencies.js';
+export { HostCapabilityUnavailableError, HostPermissionDeniedError, HostTimeoutError, } from './mobile-admin/errors.js';

package/dist/mobile-admin/errors.d.ts

@@ -5,7 +5,7 @@
  * All three classes call `Object.setPrototypeOf(this, new.target.prototype)` so
  * `instanceof` works correctly when transpiled to ES5.
  */
-import type { ActionableCapability, AdminMobileHostId } from './types';
+import type { ActionableCapability, AdminMobileHostId } from './types.js';
 /**
  * Thrown when a container requests a hardware action that the current host
  * does not support (e.g. calling `requestNfcTap` on a `'pwa'` host).

package/dist/mobile-admin/types.d.ts

@@ -1,4 +1,4 @@
-import type { NativeFacade } from '../native/types';
+import type { NativeFacade } from '../native/types.js';
 /**
  * Hardware/software capability tokens a mobile admin host may advertise.
  * Passed to `AdminMobileHostContext.capabilities` and to
@@ -79,7 +79,7 @@ export interface AdminMobileHostContext {
      * calls — never `import * as SL from '@proveanything/smartlinks'` inside a
      * container, as that would create a second SDK instance.
      */
-    SL: typeof import('../index');
+    SL: typeof import('../index.js');
     /** Capabilities advertised by this host instance. */
     capabilities: AdminMobileCapability[];
     /**

package/dist/openapi.yaml

@@ -17471,6 +17471,18 @@ components:
           type: string
         appId:
           type: string
+        moduleFormat:
+          type: string
+          enum:
+            - umd
+            - esm
+            - dual
+        sharedDependencies:
+          type: string
+        globals:
+          type: object
+          additionalProperties:
+            type: string
         seo:
           type: object
           additionalProperties: true

package/dist/shared-dependencies.d.ts

@@ -0,0 +1,37 @@
+/** Current contract revision. Bumped when the entry list or host versions change. */
+export declare const SHARED_DEPENDENCY_CONTRACT_VERSION: "v5";
+export interface SharedDependency {
+    /** Bare import specifier the app writes, e.g. `react-dom/client`. */
+    specifier: string;
+    /** Window global the host exposes for the UMD (legacy) resolution path. */
+    globalName: string;
+    /** Minimum version whose API the host guarantees — build against `>=` this, `<=` host. */
+    minVersion: string;
+    /** Portal-served ESM shim path this specifier maps to in the import map. */
+    importMapPath: string;
+}
+/**
+ * Canonical import-map path for a specifier: drop the leading `@` scope marker and
+ * turn every `/` into `-`.
+ *   'react-dom/client'      -> '/sl-shared/v5/react-dom-client.js'
+ *   '@radix-ui/react-slot'  -> '/sl-shared/v5/radix-ui-react-slot.js'
+ * Hosts MUST serve shims at these paths so the map the SDK advertises resolves.
+ */
+export declare function importMapPathFor(specifier: string, version?: string): string;
+/** The full shared-dependency contract for {@link SHARED_DEPENDENCY_CONTRACT_VERSION}. */
+export declare const SHARED_DEPENDENCIES: readonly SharedDependency[];
+/** Just the bare specifiers — handy for a bundler `external` list. */
+export declare const SHARED_DEPENDENCY_SPECIFIERS: readonly string[];
+/** What a host advertises at runtime so apps can detect the live contract. */
+export interface HostSharedDependencies {
+    version: string;
+    specifiers: string[];
+}
+/**
+ * Read the shared-dependency contract the current host advertises at runtime
+ * (via `window.__SMARTLINKS_SHARED__`). Returns `null` when there is no host
+ * marker — e.g. an older portal, or the bundle running outside a portal — so an
+ * app can degrade gracefully or fail with an actionable message instead of a
+ * bare-specifier resolution crash.
+ */
+export declare function getHostSharedDependencies(): HostSharedDependencies | null;

package/dist/shared-dependencies.js

@@ -0,0 +1,79 @@
+// src/shared-dependencies.ts
+// -----------------------------------------------------------------------------
+// The host↔app SHARED DEPENDENCY CONTRACT — the single source of truth for which
+// libraries the R5 portal (host) provides as singletons, so apps externalize them
+// instead of bundling their own copy.
+//
+// The host publishes these to modern (ESM) apps via a versioned import map, and to
+// legacy (UMD) apps via window globals. Both hosts and app authors should read THIS
+// list rather than hard-coding their own — a mismatch is what causes duplicate-React
+// crashes and silent blank containers.
+//
+// See docs/host-dependency-contract.md.
+/** Current contract revision. Bumped when the entry list or host versions change. */
+export const SHARED_DEPENDENCY_CONTRACT_VERSION = 'v5';
+/**
+ * Canonical import-map path for a specifier: drop the leading `@` scope marker and
+ * turn every `/` into `-`.
+ *   'react-dom/client'      -> '/sl-shared/v5/react-dom-client.js'
+ *   '@radix-ui/react-slot'  -> '/sl-shared/v5/radix-ui-react-slot.js'
+ * Hosts MUST serve shims at these paths so the map the SDK advertises resolves.
+ */
+export function importMapPathFor(specifier, version = SHARED_DEPENDENCY_CONTRACT_VERSION) {
+    const slug = specifier.replace(/^@/, '').replace(/\//g, '-');
+    return `/sl-shared/${version}/${slug}.js`;
+}
+// The 25-entry v5 contract: the historical 23 plus `react-dom/client` and
+// `react/jsx-dev-runtime`. minVersion follows the R5 host baseline (React 19,
+// Router 7.18.4 security floor, LiquidJS 10.27+, current Radix majors).
+const CONTRACT = [
+    { specifier: 'react', globalName: 'React', minVersion: '19.0.0' },
+    { specifier: 'react-dom', globalName: 'ReactDOM', minVersion: '19.0.0' },
+    { specifier: 'react-dom/client', globalName: 'ReactDOMClient', minVersion: '19.0.0' },
+    { specifier: 'react/jsx-runtime', globalName: 'jsxRuntime', minVersion: '19.0.0' },
+    { specifier: 'react/jsx-dev-runtime', globalName: 'jsxDevRuntime', minVersion: '19.0.0' },
+    { specifier: '@proveanything/smartlinks', globalName: 'SL', minVersion: '2.0.0' },
+    { specifier: '@proveanything/smartlinks-auth-ui', globalName: 'SmartlinksAuthUI', minVersion: '2.0.0' },
+    { specifier: 'react-router-dom', globalName: 'ReactRouterDOM', minVersion: '7.18.4' },
+    { specifier: '@tanstack/react-query', globalName: 'ReactQuery', minVersion: '5.0.0' },
+    { specifier: 'lucide-react', globalName: 'LucideReact', minVersion: '1.0.0' },
+    { specifier: 'date-fns', globalName: 'dateFns', minVersion: '4.0.0' },
+    { specifier: 'liquidjs', globalName: 'LiquidJS', minVersion: '10.27.0' },
+    { specifier: 'class-variance-authority', globalName: 'CVA', minVersion: '0.7.0' },
+    { specifier: '@radix-ui/react-slot', globalName: 'RadixSlot', minVersion: '1.2.0' },
+    { specifier: '@radix-ui/react-dialog', globalName: 'RadixDialog', minVersion: '1.1.0' },
+    { specifier: '@radix-ui/react-popover', globalName: 'RadixPopover', minVersion: '1.1.0' },
+    { specifier: '@radix-ui/react-tooltip', globalName: 'RadixTooltip', minVersion: '1.2.0' },
+    { specifier: '@radix-ui/react-tabs', globalName: 'RadixTabs', minVersion: '1.1.0' },
+    { specifier: '@radix-ui/react-accordion', globalName: 'RadixAccordion', minVersion: '1.2.0' },
+    { specifier: '@radix-ui/react-select', globalName: 'RadixSelect', minVersion: '2.3.0' },
+    { specifier: '@radix-ui/react-scroll-area', globalName: 'RadixScrollArea', minVersion: '1.2.0' },
+    { specifier: '@radix-ui/react-label', globalName: 'RadixLabel', minVersion: '2.1.0' },
+    { specifier: '@radix-ui/react-toast', globalName: 'RadixToast', minVersion: '1.2.0' },
+    { specifier: '@radix-ui/react-progress', globalName: 'RadixProgress', minVersion: '1.1.0' },
+    { specifier: '@radix-ui/react-avatar', globalName: 'RadixAvatar', minVersion: '1.1.0' },
+];
+/** The full shared-dependency contract for {@link SHARED_DEPENDENCY_CONTRACT_VERSION}. */
+export const SHARED_DEPENDENCIES = CONTRACT.map((d) => (Object.assign(Object.assign({}, d), { importMapPath: importMapPathFor(d.specifier) })));
+/** Just the bare specifiers — handy for a bundler `external` list. */
+export const SHARED_DEPENDENCY_SPECIFIERS = SHARED_DEPENDENCIES.map((d) => d.specifier);
+/**
+ * Read the shared-dependency contract the current host advertises at runtime
+ * (via `window.__SMARTLINKS_SHARED__`). Returns `null` when there is no host
+ * marker — e.g. an older portal, or the bundle running outside a portal — so an
+ * app can degrade gracefully or fail with an actionable message instead of a
+ * bare-specifier resolution crash.
+ */
+export function getHostSharedDependencies() {
+    const g = globalThis;
+    const marker = g.__SMARTLINKS_SHARED__;
+    if (!marker || typeof marker !== 'object')
+        return null;
+    const version = typeof marker.version === 'string' ? marker.version : null;
+    const specifiers = Array.isArray(marker.specifiers)
+        ? marker.specifiers.filter((s) => typeof s === 'string')
+        : null;
+    if (!version || !specifiers)
+        return null;
+    return { version, specifiers };
+}

package/dist/testing/index.d.ts

@@ -1,4 +1,4 @@
-import type { AppFunctionDef, ServerFunctionContext } from '../types/appManifest';
+import type { AppFunctionDef, ServerFunctionContext } from '../types/appManifest.js';
 export declare class CapabilityError extends Error {
     capability: string;
     code: string;

package/dist/translationCache.d.ts

@@ -1,4 +1,4 @@
-import type { ResolvedTranslationItem, TranslationContext, TranslationHashOptions } from './types/translations';
+import type { ResolvedTranslationItem, TranslationContext, TranslationHashOptions } from './types/translations.js';
 interface LocalTranslationCacheEntry {
     collectionId: string;
     sourceLanguage: string;

package/dist/types/appManifest.d.ts

@@ -405,6 +405,29 @@ export interface AppManifest {
         version: string;
         platformRevision?: string;
         appId: string;
+        /**
+         * How this app's bundles are packaged, so the host knows how to load them:
+         * - `"umd"` (default when absent) — host loads the UMD bundle (`files.js.umd`)
+         *   via the CommonJS `require` shim, resolving shared deps from window globals.
+         *   Every existing app keeps working with no change.
+         * - `"dual"` — host prefers the ESM bundle (`files.js.esm`) when it has an import
+         *   map for the declared `sharedDependencies` contract; falls back to UMD otherwise.
+         * - `"esm"` — host loads ESM natively; if it has no matching import map it fails
+         *   with an actionable error rather than a bare-specifier resolution crash.
+         */
+        moduleFormat?: 'umd' | 'esm' | 'dual';
+        /**
+         * Shared-dependency contract version this bundle was built against, e.g. `"v5"`
+         * (see `SHARED_DEPENDENCY_CONTRACT_VERSION`). The host uses it to select a
+         * compatible import map for the ESM load path.
+         */
+        sharedDependencies?: string;
+        /**
+         * Per-app namespaced UMD globals (R4.7+), e.g. `{ widgets: "MyAppWidgets" }`.
+         * UMD-only: ESM bundles expose their exports through the module namespace and
+         * don't need this. Absent → legacy bundle (colliding `window.SmartLinks{Surface}`).
+         */
+        globals?: Record<string, string>;
         /**
          * SEO configuration for this app.
          * `priority` controls which app's singular fields (title, description, ogImage) win

package/dist/types/broadcasts.d.ts

@@ -44,7 +44,7 @@ export interface BroadcastList {
     offset: number;
 }
 export interface BroadcastRecipientsResponse {
-    items: import('./comms').Recipient[];
+    items: import('./comms.js').Recipient[];
     total: number;
     limit: number;
     offset: number;

package/dist/types/collection.d.ts

@@ -1,5 +1,5 @@
-import { AssetRef } from "./asset";
-import type { AppConfigSettings } from "./appConfiguration";
+import { AssetRef } from "./asset.js";
+import type { AppConfigSettings } from "./appConfiguration.js";
 /**
  * Represents a Collection object.
  */

package/dist/types/comms.d.ts

@@ -1,5 +1,5 @@
-import type { IdField } from './common';
-import type { BroadcastChannel } from './broadcasts';
+import type { IdField } from './common.js';
+import type { BroadcastChannel } from './broadcasts.js';
 /**
  * Target subject for notifications (product, collection, etc.)
  */
@@ -93,7 +93,7 @@ export interface AppendBulkResult {
     success: true;
     count: number;
 }
-export type Recipient = import('./contact').Contact;
+export type Recipient = import('./contact.js').Contact;
 export interface RecipientsPage {
     items: Recipient[];
     total: number;
@@ -181,7 +181,7 @@ export interface UnsubscribeResponse {
     };
 }
 export type ConsentChannels = Partial<Record<BroadcastChannel, boolean>>;
-type SubjectType = import('./contact').SubjectType;
+type SubjectType = import('./contact.js').SubjectType;
 export interface CommsConsentUpsertRequest {
     contactId: string;
     channels?: ConsentChannels;
@@ -229,7 +229,7 @@ export interface CommsListMethodsQuery {
 }
 export interface CommsListMethodsResponse {
     ok: true;
-    methods: import('./contact').CommMethod[];
+    methods: import('./contact.js').CommMethod[];
 }
 export interface RegisterEmailMethodRequest {
     contactId?: string;

package/dist/types/contact.d.ts

@@ -103,7 +103,7 @@ export interface PublicUpdateMyContactResponse {
     ok: boolean;
     contact: ContactPublic;
 }
-export type ChannelName = import('./broadcasts').BroadcastChannel;
+export type ChannelName = import('./broadcasts.js').BroadcastChannel;
 export type SubjectType = 'product' | 'proof' | 'batch';
 /** Registered delivery method for a contact */
 export interface CommMethodMeta {

package/dist/types/facets.d.ts

@@ -1,4 +1,4 @@
-import type { JsonValue, ProductQueryRequest } from "./product";
+import type { JsonValue, ProductQueryRequest } from "./product.js";
 export interface FacetDefinition {
     id?: string;
     orgId?: string;

package/dist/types/iframeResponder.d.ts

@@ -1,6 +1,6 @@
-export type { AuthKitUser } from './authKit';
-export type { AppConfig as CollectionApp } from './collection';
-import type { AppConfig } from './collection';
+export type { AuthKitUser } from './authKit.js';
+export type { AppConfig as CollectionApp } from './collection.js';
+import type { AppConfig } from './collection.js';
 export interface CachedData {
     collection?: Record<string, any>;
     product?: Record<string, any>;

package/dist/types/index.d.ts

@@ -1,44 +1,44 @@
-export * from "./collection";
-export * from "./facets";
-export * from "./product";
-export * from "./proof";
-export * from "./appConfiguration";
-export * from "./error";
-export * from "./asset";
-export * from "./batch";
-export * from "./variant";
-export * from "./claimSet";
-export * from "./auth";
-export * from "./comms";
-export * from "./nfc";
-export * from "./itemContext";
-export * from "./contact";
-export * from "./broadcasts";
-export * from "./segments";
-export * from "./common";
-export * from "./journeys";
-export * from "./journeysAnalytics";
-export * from "./qr";
-export * from "./template";
-export * from "./interaction";
-export * from "./analytics";
-export * from "./location";
-export * from "./jobs";
-export * from "./realtime";
-export * from "./tags";
-export * from "./navigation";
-export * from "./order";
-export * from "./crate";
-export * from "./attestations";
-export * from "./containers";
-export * from "./authKit";
-export * from "./iframeResponder";
-export * from "./ai";
-export * from "./appManifest";
-export * from "./appObjects";
-export * from "./loyalty";
-export * from "./translations";
-export * from "./integrations";
-export * from "./research";
-export * from "./config";
-export * from "./widgets";
+export * from "./collection.js";
+export * from "./facets.js";
+export * from "./product.js";
+export * from "./proof.js";
+export * from "./appConfiguration.js";
+export * from "./error.js";
+export * from "./asset.js";
+export * from "./batch.js";
+export * from "./variant.js";
+export * from "./claimSet.js";
+export * from "./auth.js";
+export * from "./comms.js";
+export * from "./nfc.js";
+export * from "./itemContext.js";
+export * from "./contact.js";
+export * from "./broadcasts.js";
+export * from "./segments.js";
+export * from "./common.js";
+export * from "./journeys.js";
+export * from "./journeysAnalytics.js";
+export * from "./qr.js";
+export * from "./template.js";
+export * from "./interaction.js";
+export * from "./analytics.js";
+export * from "./location.js";
+export * from "./jobs.js";
+export * from "./realtime.js";
+export * from "./tags.js";
+export * from "./navigation.js";
+export * from "./order.js";
+export * from "./crate.js";
+export * from "./attestations.js";
+export * from "./containers.js";
+export * from "./authKit.js";
+export * from "./iframeResponder.js";
+export * from "./ai.js";
+export * from "./appManifest.js";
+export * from "./appObjects.js";
+export * from "./loyalty.js";
+export * from "./translations.js";
+export * from "./integrations.js";
+export * from "./research.js";
+export * from "./config.js";
+export * from "./widgets.js";

package/dist/types/index.js

@@ -1,46 +1,46 @@
 // src/types/index.ts
 // Re-export all type modules so consumers can import types directly
-export * from "./collection";
-export * from "./facets";
-export * from "./product";
-export * from "./proof";
-export * from "./appConfiguration";
-export * from "./error";
-export * from "./asset";
-export * from "./batch";
-export * from "./variant";
-export * from "./claimSet";
-export * from "./auth";
-export * from "./comms";
-export * from "./nfc";
-export * from "./itemContext";
-export * from "./contact";
-export * from "./broadcasts";
-export * from "./segments";
-export * from "./common";
-export * from "./journeys";
-export * from "./journeysAnalytics";
-export * from "./qr";
-export * from "./template";
-export * from "./interaction";
-export * from "./analytics";
-export * from "./location";
-export * from "./jobs";
-export * from "./realtime";
-export * from "./tags";
-export * from "./navigation";
-export * from "./order";
-export * from "./crate";
-export * from "./attestations";
-export * from "./containers";
-export * from "./authKit";
-export * from "./iframeResponder";
-export * from "./ai";
-export * from "./appManifest";
-export * from "./appObjects";
-export * from "./loyalty";
-export * from "./translations";
-export * from "./integrations";
-export * from "./research";
-export * from "./config";
-export * from "./widgets";
+export * from "./collection.js";
+export * from "./facets.js";
+export * from "./product.js";
+export * from "./proof.js";
+export * from "./appConfiguration.js";
+export * from "./error.js";
+export * from "./asset.js";
+export * from "./batch.js";
+export * from "./variant.js";
+export * from "./claimSet.js";
+export * from "./auth.js";
+export * from "./comms.js";
+export * from "./nfc.js";
+export * from "./itemContext.js";
+export * from "./contact.js";
+export * from "./broadcasts.js";
+export * from "./segments.js";
+export * from "./common.js";
+export * from "./journeys.js";
+export * from "./journeysAnalytics.js";
+export * from "./qr.js";
+export * from "./template.js";
+export * from "./interaction.js";
+export * from "./analytics.js";
+export * from "./location.js";
+export * from "./jobs.js";
+export * from "./realtime.js";
+export * from "./tags.js";
+export * from "./navigation.js";
+export * from "./order.js";
+export * from "./crate.js";
+export * from "./attestations.js";
+export * from "./containers.js";
+export * from "./authKit.js";
+export * from "./iframeResponder.js";
+export * from "./ai.js";
+export * from "./appManifest.js";
+export * from "./appObjects.js";
+export * from "./loyalty.js";
+export * from "./translations.js";
+export * from "./integrations.js";
+export * from "./research.js";
+export * from "./config.js";
+export * from "./widgets.js";

package/dist/types/interaction.d.ts

@@ -1,4 +1,4 @@
-import type { IdField } from './common';
+import type { IdField } from './common.js';
 export interface AdminInteractionsQueryRequest {
     userId?: string;
     contactId?: string;

package/dist/types/itemContext.d.ts

@@ -1,4 +1,4 @@
-import type { TagContext } from './nfc';
+import type { TagContext } from './nfc.js';
 /**
  * Authenticity status for a specific item — a proof, resolved via an NFC
  * tap or a serial proof URL. Collection- and product-only URLs have no

package/dist/types/journeysAnalytics.d.ts

@@ -1,4 +1,4 @@
-import type { IdField } from './common';
+import type { IdField } from './common.js';
 export interface JourneyStatsRequest {
     idField?: IdField;
     from?: string;

package/dist/types/navigation.d.ts

@@ -1,4 +1,4 @@
-import type { CollectionAnalyticsEvent } from './analytics';
+import type { CollectionAnalyticsEvent } from './analytics.js';
 /** Where the link opens once resolved. */
 export type LinkOpenTarget = '_self' | '_blank';
 /**

package/dist/types/product.d.ts

@@ -1,4 +1,4 @@
-import { AssetRef } from "./asset";
+import { AssetRef } from "./asset.js";
 export type JsonPrimitive = string | number | boolean | null;
 export type JsonValue = JsonPrimitive | JsonValue[] | {
     [key: string]: JsonValue;

package/dist/types/proof.d.ts

@@ -1,4 +1,4 @@
-import { JsonValue, ScopedFieldDef } from './product';
+import { JsonValue, ScopedFieldDef } from './product.js';
 /**
  * `proof.values` — the owner + business-writable bag.
  * Public keys sit at the root (business + current owner can write, everyone