@proveanything/smartlinks 2.0.66 → 2.0.68

package/dist/docs/connectors.md

@@ -66,7 +66,7 @@ deterministically. A connector's `shape` and `serialize` must be deterministic t
   "aiGuide": "connector-ai-guide.md"
 },
 "functions": {
-  "files": { "js": { "umd": "dist/functions.umd.js" } },
+  "files": { "js": { "umd": "functions.umd.js" } },
   "definitions": [
     { "name": "testConnection", "trigger": { "type": "http", "method": "POST" },
       "visibility": "admin", "authority": "collection",

package/dist/docs/server-functions.md

@@ -33,7 +33,7 @@ in a bundle alongside your widgets/containers:
 ```jsonc
 {
   "functions": {
-    "files": { "js": { "umd": "dist/functions.umd.js" } },
+    "files": { "js": { "umd": "functions.umd.js" } },
     "definitions": [
       {
         "name": "submitCompetitionEntry",
@@ -98,9 +98,12 @@ export default defineConfig({
 }
 ```
 
-That emits `dist/functions.umd.js` (matching `functions.files.js.umd`), whose named exports the
-platform pairs with your manifest `definitions`. Then **deploy** it — for dev,
-`smartlinks-publish` uploads `dist/` and registers in one step (see
+That emits `dist/functions.umd.js`, whose named exports the platform pairs with your manifest
+`definitions`. In the manifest, `functions.files.js.umd` is **`functions.umd.js`** — relative to the
+published build (the contents of `dist/`), like the widget and container files; not
+`dist/functions.umd.js`. Publishing refuses a release whose functions bundle isn't there.
+
+Then **deploy** it — for dev, `smartlinks-publish` uploads `dist/` and registers in one step (see
 [Deploying & registering](deploying-apps.md)).
 
 ---
@@ -169,6 +172,7 @@ Declare the minimum you need.
 | `network:<host>` | `ctx.fetch` to that host only (repeat for several). Prefer this over blanket `network`. |
 | `network:*.<domain>` | `ctx.fetch` to any subdomain of `<domain>` (not `<domain>` itself), for a customer's own endpoint at a provider, e.g. `network:*.servicebus.windows.net`. `<domain>` needs at least two labels (`*.com` is not honoured). |
 | `secrets:<name>` | `ctx.secrets.get('<name>')` for that one secret (see [Secrets](#secrets--api-keys-per-collection)). |
+| `tools:<name>` / `tools:<family>.*` | `ctx.sl.tools.run('<name>', args)` for a platform tool, e.g. `tools:pdf.create`, or `tools:pdf.*` for every PDF tool (see [Platform tools](#platform-tools--pdfs-labels-barcodes)). |
 
 If you don't declare `network`, `ctx.fetch` is absent. Reading a secret you didn't declare with
 `secrets:<name>` throws.
@@ -606,6 +610,58 @@ await ctx.sl.interactions.record({
 
 ---
 
+## Platform tools — PDFs, labels, barcodes
+
+`ctx.sl.tools.run(name, args)` runs one of the platform's deterministic tools from your function: no
+model, no agent loop. Declare each tool as a capability: `tools:pdf.create`, or `tools:pdf.*` for the
+whole family. Open to functions: `pdf.create`, `pdf.merge`, `pdf.fill`, `pdf.inspect`, `pdf.render`,
+`pdf.decodeBarcodes`, `pdf.inspectGraphics`, `pdf.preflight`, `pdf.printReady`, `pdf.edit`,
+`image.transform` (arguments as in [ai.md](ai.md)).
+
+- **Identity:** the call runs as the function's collection, whatever the caller. An anonymous caller
+  holding only your own key gets the same result; the work is attributed and billed to the collection.
+- **Rate:** per collection (10 calls a second by default); bursts wait rather than fail.
+- **Failure:** throws an `Error` with `code` (`bad_args`, `too_large`, `too_many_pages`,
+  `resource_timeout`, `timeout`, `busy`, `TOOL_NOT_AVAILABLE`, or a capability denial).
+
+**Labels with `pdf.create`.** Exact page sizes, many pages in one render, and bytes straight back:
+
+```ts
+// capabilities: ["tools:pdf.create", "tools:pdf.decodeBarcodes"]
+export async function printLabel(ctx, event) {
+  const { gtin, lot, expiry, qty = 1 } = event.body
+  const barcode = bwipjs.toSVG({ bcid: 'gs1-128', text: `(01)${gtin}(10)${lot}(17)${expiry}` }) // inline SVG
+  const pdf = await ctx.sl.tools.run('pdf.create', {
+    width: 100, height: 50, unit: 'mm',                      // exact; output is 1:1
+    head: '<style>.l{position:absolute;font:3mm Arial}</style>',
+    pages: Array.from({ length: qty }, () => `<div class="l" style="left:4mm;top:3mm">Lot ${lot}</div>
+      <div style="position:absolute;left:4mm;top:10mm;width:92mm">${barcode}</div>`),
+    return: 'base64',                                        // or 'signedUrl' + expiresIn
+  })
+  return { pdf: pdf.base64, pages: pdf.pageCount }
+}
+```
+
+- **Page size:** `width` + `height` (+ `unit`: mm, cm, in, pt, px) is exact to the point. Otherwise
+  `format` ("A4", "Letter"), or the document's own CSS `@page { size }` when neither is given.
+- **Pages:** `pages: [html, …]` lays one fragment per page; with an exact size and no margin each page
+  box is that size (overflow hidden), so a long value can't push onto the next label. Up to 2000 pages
+  and 10 MB of HTML per render.
+- **Output:** 1:1 at scale 1 with backgrounds; text stays text and SVG stays vector (render barcodes as
+  inline SVG, e.g. bwip-js `toSVG`, never as a canvas bitmap). Colour is RGB; for CMYK pass the result
+  through `pdf.printReady`.
+- **What loads:** JavaScript does not run. Images, fonts and stylesheets load only from SmartLinks hosts
+  (our CDN), Google Fonts or inline `data:` URIs; anything else is skipped and listed in `warnings`.
+  Embed brand fonts as `data:` URIs in `@font-face`, or host them on the SmartLinks CDN.
+- **Delivery:** `return: 'base64'` (nothing stored), `'signedUrl'` (private link that expires after
+  `expiresIn` seconds, default 900, max 7 days — use this for anything with lot, expiry or serial
+  data), or `'url'` (public and permanent — artwork and documents meant to be shared).
+- **Cache:** the same inputs return the earlier render without rendering again (`cached: true`).
+- **Verify:** `pdf.decodeBarcodes` on a `signedUrl` reads the codes back deterministically, so you can
+  confirm the digits before answering.
+
+---
+
 ## Worked example — a public competition entry
 
 ```ts

package/dist/index.d.ts

@@ -41,4 +41,4 @@ AdminMobileHostContext, AdminMobileComponentManifest, AdminMobileBundleManifest,
 MobileAdminBundleManifest, } from './mobile-admin/types.js';
 export { HostCapabilityUnavailableError, HostPermissionDeniedError, HostTimeoutError, HostCancelledError, } from './mobile-admin/errors.js';
 export type { NativeCapability, NativeFacade, ShareFacade, ClipboardFacade, HapticImpactStyle, HapticNotificationStyle, HapticsFacade, NetworkStatus, NetworkFacade, DeviceInfo, DeviceFacade, StorageFacade, QrScanOptions, QrFacade, AuthFacade, NfcReadResult, NfcFacade, RfidScanOptions, RfidFacade, EventsFacade, WebSourceMode, WebSourceConfig, WebSourceFacade, } from './native/types.js';
-export type { AuthKitUser, UserProfile, ProfileUpdateData, UpdateProfileResponse, SuccessResponse, AuthLoginResponse, AppleLoginOptions, AuthKitErrorCode, RefreshResponse, LogoutResponse, RefreshErrorCode, MagicLinkSendResponse, MagicLinkVerifyResponse, PhoneSendCodeResponse, PhoneVerifyResponse, PasswordResetRequestResponse, VerifyResetTokenResponse, PasswordResetCompleteResponse, EmailVerificationActionResponse, EmailVerifyTokenResponse, VerifyStatus, WhatsAppReplyCta, WhatsAppReplyOptions, WhatsAppContactData, SendWhatsAppRequest, SendWhatsAppResponse, ExchangeWhatsAppSessionResponse, VerifyWhatsAppResponse, WhatsAppStatusResponse, SendSmsVerifyRequest, SendSmsVerifyResponse, VerifySmsResponse, UpsertContactRequest, UpsertContactResponse, AuthKitBrandingConfig, AuthKitConfig, AuthKitConfigInput, AuthKitSecurityConfig, AuthKitPasswordPolicy, AuthKitSessionPolicy, AuthKitLockoutPolicy, PasswordPolicyErrorCode, LoginSecurityErrorCode, } from './types/authKit.js';
+export type { AuthKitUser, UserProfile, ProfileUpdateData, UpdateProfileResponse, SuccessResponse, AuthLoginResponse, AppleLoginOptions, AuthKitErrorCode, RefreshResponse, LogoutResponse, RefreshErrorCode, MagicLinkSendResponse, MagicLinkVerifyResponse, PhoneSendCodeResponse, PhoneVerifyResponse, PasswordResetRequestResponse, VerifyResetTokenResponse, PasswordResetCompleteResponse, EmailVerificationActionResponse, EmailVerifyTokenResponse, VerifyStatus, WhatsAppReplyCta, WhatsAppReplyOptions, WhatsAppContactData, SendWhatsAppRequest, SendWhatsAppResponse, ExchangeWhatsAppSessionResponse, VerifyWhatsAppResponse, WhatsAppStatusResponse, SendSmsVerifyRequest, SendSmsVerifyResponse, VerifySmsResponse, UpsertContactRequest, UpsertContactResponse, AuthKitBrandingConfig, AuthKitConfig, AuthKitConfigInput, AuthKitSecurityConfig, AuthKitIdentity, AuthKitSetIdentityResponse, AuthKitPasswordPolicy, AuthKitSessionPolicy, AuthKitLockoutPolicy, PasswordPolicyErrorCode, LoginSecurityErrorCode, } from './types/authKit.js';

package/dist/openapi.yaml

@@ -2077,6 +2077,45 @@ paths:
           description: Unauthorized
         404:
           description: Not found
+  /admin/collection/{collectionId}/authKit/{authKitId}/identity:
+    post:
+      tags:
+        - authKit
+      summary: "Give this AuthKit its **own logins** (admin): its members become accounts of this site only — the same email can be a separate account, with its own password, on another site — rather than SmartLinks accounts shared across sites."
+      operationId: authKit_setIdentity
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: collectionId
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: authKitId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AuthKitSetIdentityResponse"
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: true
   /admin/collection/{collectionId}/batch:
     get:
       tags:
@@ -3715,7 +3754,7 @@ paths:
     get:
       tags:
         - collection
-      summary: "Get the managed-certificate status for a collection's custom domain (admin only)."
+      summary: "Get the certificate status of the collection's own domain (admin only)."
       operationId: collection_getDomainStatus
       security:
         - bearerAuth: []
@@ -3740,7 +3779,7 @@ paths:
     post:
       tags:
         - collection
-      summary: Register a custom domain for a collection and provision its managed certificate (admin only).
+      summary: "Connect one of the collection's own domains and start its certificate (admin only)."
       operationId: collection_registerDomain
       security:
         - bearerAuth: []
@@ -8339,7 +8378,7 @@ paths:
     get:
       tags:
         - tags
-      summary: Reverse lookup — find all tags linked to a given object (admin).
+      summary: Reverse lookup — find all tags linked to a given object (admin).
       operationId: tags_byRef
       security:
         - bearerAuth: []
@@ -9207,7 +9246,7 @@ paths:
     post:
       tags:
         - authKit
-      summary: authKit.linkedInLogin
+      summary: Sign in with LinkedIn (OpenID Connect) via a server-side authorization code (public).
       operationId: authKit_linkedInLogin
       security: []
       parameters:
@@ -14108,7 +14147,7 @@ paths:
     get:
       tags:
         - tags
-      summary: "Global tag resolve — returns `{ tagId, collectionId }` only."
+      summary: "Global tag resolve — returns `{ tagId, collectionId }` only."
       operationId: tags_resolveTag
       security: []
       parameters:
@@ -17499,14 +17538,74 @@ components:
       properties:
         html:
           type: string
+        pages:
+          type: array
+          items:
+            type: string
+        head:
+          type: string
+        width:
+          type: number
+        height:
+          type: number
+        unit:
+          type: string
+          enum:
+            - mm
+            - cm
+            - in
+            - pt
+            - px
         format:
           type: string
         landscape:
           type: boolean
         margin:
           type: string
+        return:
+          type: string
+          enum:
+            - url
+            - signedUrl
+            - base64
+        expiresIn:
+          type: number
+        filename:
+          type: string
+        cache:
+          type: boolean
+    PdfCreateResult:
+      type: object
+      properties:
+        url:
+          type: string
+        hostedUrl:
+          type: string
+        base64:
+          type: string
+        expiresAt:
+          type: string
+        contentType:
+          type: string
+          enum:
+            - application/pdf
+        size:
+          type: number
+        pageCount:
+          type: number
+        cached:
+          type: boolean
+        renderer:
+          type: string
+        warnings:
+          type: array
+          items:
+            type: string
       required:
-        - html
+        - contentType
+        - size
+        - pageCount
+        - cached
     PdfFillArgs:
       type: object
       properties:
@@ -19657,6 +19756,9 @@ components:
         interactions:
           type: object
           additionalProperties: true
+        tools:
+          type: object
+          additionalProperties: true
         products: {}
         attestations: {}
         appData:
@@ -19667,6 +19769,7 @@ components:
         - tags
         - contacts
         - interactions
+        - tools
         - products
         - attestations
         - appData
@@ -23263,8 +23366,38 @@ components:
           type: string
         security:
           $ref: "#/components/schemas/AuthKitSecurityConfig"
+        collectionIds:
+          type: array
+          items:
+            type: string
+        identity:
+          $ref: "#/components/schemas/AuthKitIdentity"
       required:
         - id
+    AuthKitIdentity:
+      type: object
+      properties:
+        mode:
+          type: string
+          enum:
+            - shared
+            - own
+        tenantId:
+          type: string
+        createdAt:
+          type: string
+      required:
+        - mode
+    AuthKitSetIdentityResponse:
+      type: object
+      properties:
+        identity:
+          $ref: "#/components/schemas/AuthKitIdentity"
+        message:
+          type: string
+      required:
+        - identity
+        - message
     AuthKitSecurityConfig:
       type: object
       properties:

package/dist/types/ai.d.ts

@@ -945,11 +945,49 @@ export interface PdfClip {
     y1: number;
 }
 export interface PdfCreateArgs {
-    html: string;
+    /** One HTML document (inline CSS). Give `html` or `pages`. */
+    html?: string;
+    /** One HTML fragment per page, laid out one per page (sharing `head`). With width/height and no margin each page box is exactly that size, overflow hidden. 500 labels = one call. */
+    pages?: string[];
+    /** With `pages`: shared <head> content (<style>, @font-face). */
+    head?: string;
+    /** Exact page size (labels, rolls, sheets) — exact to the point. Give both. */
+    width?: number;
+    height?: number;
+    /** Unit for width/height (default 'mm'). */
+    unit?: 'mm' | 'cm' | 'in' | 'pt' | 'px';
+    /** Named page size ("A4", "Letter") when not giving width/height. With neither, the document's CSS @page size is used (else A4). */
     format?: string;
     landscape?: boolean;
-    /** Page margin for all sides, e.g. "0" or "12mm" (default 18mm/14mm). Use "0" when the HTML sets its own margins. */
+    /** Page margin for all sides, e.g. "0" or "12mm". Default 0 with width/height or pages; 18mm/14mm for named formats. */
     margin?: string;
+    /** 'url' (public, permanent; default), 'signedUrl' (private link that expires), 'base64' (bytes in the response, nothing stored). */
+    return?: 'url' | 'signedUrl' | 'base64';
+    /** signedUrl lifetime in seconds: 30 to 604800 (7 days); default 900. */
+    expiresIn?: number;
+    /** File name for signedUrl downloads (default document.pdf). */
+    filename?: string;
+    /** Reuse an identical earlier render (default true). */
+    cache?: boolean;
+}
+export interface PdfCreateResult {
+    /** return 'url' or 'signedUrl'. */
+    url?: string;
+    /** return 'url': same as url. */
+    hostedUrl?: string;
+    /** return 'base64'. */
+    base64?: string;
+    /** return 'signedUrl': when the link stops working. */
+    expiresAt?: string;
+    contentType: 'application/pdf';
+    size: number;
+    pageCount: number;
+    /** An identical earlier render was reused (no new render). */
+    cached: boolean;
+    /** The renderer, e.g. "Chrome/141.0…". */
+    renderer?: string;
+    /** Resources that were not loaded (only images, fonts and stylesheets from SmartLinks hosts, Google Fonts or data: URIs load). */
+    warnings?: string[];
 }
 export interface PdfFillArgs {
     url: string;

package/dist/types/appManifest.d.ts

@@ -457,6 +457,16 @@ export interface ServerFunctionSl {
             eventId: string;
         }>;
     };
+    /**
+     * Platform tools (`tools:<name>` or `tools:<family>.*`, e.g. `tools:pdf.create`, `tools:pdf.*`):
+     * pdf.create, pdf.merge, pdf.fill, pdf.inspect, pdf.render, pdf.decodeBarcodes, pdf.inspectGraphics,
+     * pdf.preflight, pdf.printReady, pdf.edit, image.transform. Runs as THIS collection whatever the caller
+     * (authorised by the declaration, billed to the collection), rate-limited per collection. Returns the
+     * tool's result; a failure throws an Error with `code` (e.g. bad_args, busy, too_many_pages).
+     */
+    tools: {
+        run<T = any>(name: string, args?: Record<string, any>): Promise<T>;
+    };
     /** Products, scoped by caller authority + declared capability. */
     products: any;
     /** Attestations, scoped by caller authority + declared capability. */

package/dist/types/authKit.d.ts

@@ -407,6 +407,26 @@ export interface AuthKitConfig {
      * server-side. See {@link AuthKitSecurityConfig}.
      */
     security?: AuthKitSecurityConfig;
+    /** The collections this AuthKit serves. */
+    collectionIds?: string[];
+    /**
+     * Which user pool this site's members sign in to. Absent or `shared` = the SmartLinks account (the
+     * same account on every site that uses it). `own` = the site's own members (a separate account per
+     * site, its own passwords). Switch with {@link authKit.setIdentity}; never via create/update.
+     */
+    identity?: AuthKitIdentity;
+}
+/** An AuthKit's member pool. */
+export interface AuthKitIdentity {
+    mode: 'shared' | 'own';
+    /** The site's own pool (set by the platform). */
+    tenantId?: string;
+    createdAt?: string;
+}
+/** Result of {@link authKit.setIdentity}. */
+export interface AuthKitSetIdentityResponse {
+    identity: AuthKitIdentity;
+    message: string;
 }
 /**
  * Writable shape for `authKit.create` / `authKit.update` (admin). Known fields are
@@ -424,7 +444,7 @@ export interface AuthKitConfig {
  * })
  * ```
  */
-export type AuthKitConfigInput = Partial<Omit<AuthKitConfig, 'id' | 'updatedAt'>> & Record<string, any>;
+export type AuthKitConfigInput = Partial<Omit<AuthKitConfig, 'id' | 'updatedAt' | 'identity'>> & Record<string, any>;
 /**
  * Per-collection account-security policy. The API **enforces** all of this; the
  * client uses `passwordPolicy` (live checklist) and `session` (idle sign-out) for UX.

package/dist/types/collection.d.ts

@@ -93,11 +93,13 @@ export type CollectionResponse = Collection;
 export type CollectionCreateRequest = Omit<Collection, 'id' | 'shortId'>;
 export type CollectionUpdateRequest = Partial<Omit<Collection, 'id' | 'shortId'>>;
 /**
- * Which load balancer / certificate map a custom domain registration targets.
- * - `"smartlinks"` (default): the id.smartlinks.app load balancer (legacy behaviour)
- * - `"hub"`: the SmartLinks Hub load balancer
+ * What a collection's own domain is for:
+ * - `"links"` (default): a links domain (e.g. `id.brand.com`) — GS1 Digital Links, short links and QR
+ *   codes, the portal, and the API and sign-in on the brand's domain. Stored as `redirectUrl`.
+ * - `"site"`: a site domain — the collection's Hub (`hubCustomDomain`), or an app website when an
+ *   `appId` is given. Served through the site runtime (CNAME to `cname.smartlinks.host`).
  */
-export type DomainTarget = "smartlinks" | "hub";
+export type DomainTarget = "links" | "site";
 /**
  * Response from checking whether a Hub subdomain name is available.
  */

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.0.66  |  Generated: 2026-10-14T17:03:31.949Z
+Version: 2.0.68  |  Generated: 2026-10-17T10:04:22.637Z
 
 This is a concise summary of all available API functions and types.
 
@@ -1600,10 +1600,35 @@ interface PdfClip {
 **PdfCreateArgs** (interface)
 ```typescript
 interface PdfCreateArgs {
-  html: string
+  html?: string
+  pages?: string[]
+  head?: string
+  width?: number
+  height?: number
+  unit?: 'mm' | 'cm' | 'in' | 'pt' | 'px'
   format?: string
   landscape?: boolean
   margin?: string
+  return?: 'url' | 'signedUrl' | 'base64'
+  expiresIn?: number
+  filename?: string
+  cache?: boolean
+}
+```
+
+**PdfCreateResult** (interface)
+```typescript
+interface PdfCreateResult {
+  url?: string
+  hostedUrl?: string
+  base64?: string
+  expiresAt?: string
+  contentType: 'application/pdf'
+  size: number
+  pageCount: number
+  cached: boolean
+  renderer?: string
+  warnings?: string[]
 }
 ```
 
@@ -2786,6 +2811,7 @@ interface ServerFunctionSl {
   forCaller(): Promise<{ contactId: string } | null>;
   };
   interactions: { record(event: ServerFunctionInteractionEvent): Promise<{ eventId: string }> };
+  tools: { run<T = any>(name: string, args?: Record<string, any>): Promise<T> };
   products: any;
   attestations: any;
   appData: AppDataHandle & { global: AppDataHandle; collection: AppDataHandle };
@@ -4838,6 +4864,25 @@ interface AuthKitConfig {
   redirectUrl?: string
   updatedAt?: string
   security?: AuthKitSecurityConfig
+  collectionIds?: string[]
+  identity?: AuthKitIdentity
+}
+```
+
+**AuthKitIdentity** (interface)
+```typescript
+interface AuthKitIdentity {
+  mode: 'shared' | 'own'
+  tenantId?: string
+  createdAt?: string
+}
+```
+
+**AuthKitSetIdentityResponse** (interface)
+```typescript
+interface AuthKitSetIdentityResponse {
+  identity: AuthKitIdentity
+  message: string
 }
 ```
 
@@ -5336,7 +5381,7 @@ interface InviteUserInput {
 
 **CollectionUpdateRequest** = `Partial<Omit<Collection, 'id' | 'shortId'>>`
 
-**DomainTarget** = `"smartlinks" | "hub"`
+**DomainTarget** = `"links" | "site"`
 
 **CollectionAccessLevel** = `'Owner' | 'Admin' | 'Assigner' | 'Reporter' | 'User' | 'None'`
 
@@ -11297,8 +11342,11 @@ Create an AuthKit client config (admin). Accepts the account `security` policy
 **update**(collectionId: string, authKitId: string, data: AuthKitConfigInput) → `Promise<AuthKitConfig>`
 Update an AuthKit client config (admin). This is how the account **security policy** is written — pass a `security` block ({@link AuthKitSecurityConfig}). The server validates it and enforces it; the login UI reads the public subset back via {@link load}.
 
+**setIdentity**(collectionId: string, authKitId: string, body: { mode: 'own' }) → `Promise<AuthKitSetIdentityResponse>`
+Give this AuthKit its **own logins** (admin): its members become accounts of this site only — the same email can be a separate account, with its own password, on another site — rather than SmartLinks accounts shared across sites. One way: a site with its own members can't go back to the shared pool. Members who signed up before keep their SmartLinks account until moved across. Errors: `MEMBER_POOL_CONFLICT` (409) when another AuthKit already gives one of its collections its own logins (one per collection); `PERMISSION_DENIED` (403) unless you administer every collection it serves.
+
 **remove**(collectionId: string, authKitId: string) → `Promise<void>`
-Update an AuthKit client config (admin). This is how the account **security policy** is written — pass a `security` block ({@link AuthKitSecurityConfig}). The server validates it and enforces it; the login UI reads the public subset back via {@link load}.
+Give this AuthKit its **own logins** (admin): its members become accounts of this site only — the same email can be a separate account, with its own password, on another site — rather than SmartLinks accounts shared across sites. One way: a site with its own members can't go back to the shared pool. Members who signed up before keep their SmartLinks account until moved across. Errors: `MEMBER_POOL_CONFLICT` (409) when another AuthKit already gives one of its collections its own logins (one per collection); `PERMISSION_DENIED` (403) unless you administer every collection it serves.
 
 ### batch
 
@@ -11488,11 +11536,14 @@ Check whether a Hub subdomain name is available to claim (admin only).
 **claimHub**(collectionId: string, hubName: string) → `Promise<CollectionResponse>`
 Claim or rename the Hub subdomain for a collection (admin only). Maps `{hubName}.smartlinks.host` to the collection. If the collection already had a different hub name, the previous subdomain is released automatically.
 
-**registerDomain**(collectionId: string, domain: string, target: DomainTarget = "smartlinks") → `Promise<any>`
-Register a custom domain for a collection and provision its managed certificate (admin only). `"smartlinks"` (the id.smartlinks.app load balancer). Pass `"hub"` to register a bring-your-own Hub domain.
+**registerDomain**(collectionId: string, domain: string, target: DomainTarget = "links") → `Promise<any>`
+Connect one of the collection's own domains and start its certificate (admin only). or `"site"` for the collection's Hub domain.
 
-**getDomainStatus**(collectionId: string, target: DomainTarget = "smartlinks") → `Promise<any>`
-Get the managed-certificate status for a collection's custom domain (admin only). or `"hub"` (uses `hubCustomDomain`)
+**getDomainStatus**(collectionId: string, target: DomainTarget = "links") → `Promise<any>`
+Get the certificate status of the collection's own domain (admin only). or `"site"` (its Hub domain, `hubCustomDomain`)
+
+**releaseDomain**(collectionId: string, domain: string) → `Promise<`
+Remove the collection's links domain (admin only). It stops working straight away: QR codes, GS1 Digital Links and short links printed with it no longer open. Its certificate goes and `redirectUrl` is cleared. (Site domains are removed from the site's settings.)
 
 **getSettings**(collectionId: string, settingGroup: string, admin?: boolean) → `Promise<any>`
 Retrieve a specific settings group for a collection. Public reads return the public view of the settings group. If the stored payload contains a top-level `admin` object, that block is omitted from public responses and included when `admin === true`.
@@ -11512,29 +11563,29 @@ Update a collection (admin only).
 **remove**(collectionId: string) → `Promise<void>`
 Delete a collection (admin only).
 
-**getSN**(collectionId: string,
-    startIndex: number = 0,
+**getSN**(collectionId: string,
+    startIndex: number = 0,
     count: number = 10) → `Promise<any>`
 Get serial numbers for a collection (admin only).
 
-**lookupSN**(collectionId: string,
+**lookupSN**(collectionId: string,
     codeId: string) → `Promise<any>`
 Look up a serial number by code for a collection (admin only).
 
-**assignSN**(collectionId: string,
-    codeId: string,
+**assignSN**(collectionId: string,
+    codeId: string,
     value: any) → `Promise<any>`
 Assign a value to a serial number for a collection (admin only).
 
 **getUsers**(collectionId: string) → `Promise<CollectionUser[]>`
 List the users with access to a collection, each with their access level (admin only). Access is stored in the collection's `roles` map (userId → level); this resolves each to name/email. GET /admin/collection/:collectionId/getUsers
 
-**setUserAccess**(collectionId: string,
-    userId: string,
+**setUserAccess**(collectionId: string,
+    userId: string,
     access: CollectionAccessLevel | null) → `Promise<void>`
 Grant, change, or remove a user's access level on a collection (admin only). Pass `null` or `'None'` to remove access. The server enforces privilege-escalation rules — you cannot grant an access level above your own, nor change a user whose level is above yours. POST /admin/collection/:collectionId/updateUserAccess
 
-**inviteUser**(collectionId: string,
+**inviteUser**(collectionId: string,
     input: InviteUserInput) → `Promise<`
 Invite a user to a collection by email (admin only). Creates or links their account in the login / auth-kit collection (`loginCollectionId`, default `'global'`) and emails them an invite (new account) or an added-to-collection notice (existing account); returns their `uid`. This does NOT grant access on its own — follow with {@link setUserAccess} to set their level (this mirrors the console flow). POST /user/inviteUser
 
@@ -12815,7 +12866,7 @@ Create a single tag mapping (admin). If `productId` is set without `proofId`, a
 
 **createBatch**(collectionId: string,
     data: BatchCreateTagRequest) → `Promise<BatchCreateResult>`
-Batch-create tags (admin). Tags with `productId` but no `proofId` automatically get serial numbers. Serial number generation is grouped by `(productId, variantId, batchId)` for efficiency.  Partial success is possible — check `results` for individual outcomes. ```typescript const result = await tags.createBatch('coll_123', { tags: [ { tagId: 'NFC-001', productId: 'prod_456', batchId: 'batch_2026_01' }, { tagId: 'NFC-002', productId: 'prod_456', batchId: 'batch_2026_01' }, ], }) console.log(`Created: ${result.summary.created}, Conflicts: ${result.summary.conflicts}`) ```
+Batch-create tags (admin). Tags with `productId` but no `proofId` automatically get serial numbers. Serial number generation is grouped by `(productId, variantId, batchId)` for efficiency.  Partial success is possible — check `results` for individual outcomes. ```typescript const result = await tags.createBatch('coll_123', { tags: [ { tagId: 'NFC-001', productId: 'prod_456', batchId: 'batch_2026_01' }, { tagId: 'NFC-002', productId: 'prod_456', batchId: 'batch_2026_01' }, ], }) console.log(`Created: ${result.summary.created}, Conflicts: ${result.summary.conflicts}`) ```
 
 **get**(collectionId: string,
     tagId: string) → `Promise<GetTagResponse>`
@@ -12824,7 +12875,7 @@ Get a single tag by `tagId` (admin).
 **update**(collectionId: string,
     tagId: string,
     data: UpdateTagRequest) → `Promise<UpdateTagResponse>`
-Update a tag (admin). Partial update — only provided fields are changed.  `metadata` is deep-merged with the existing value.  Pass `refType: null, refId: null` to clear the polymorphic ref. ```typescript const updated = await tags.update('coll_123', 'NFC-001', { variantId: 'var_premium', metadata:  { notes: 'Updated to premium variant' }, }) // Clear polymorphic ref await tags.update('coll_123', 'NFC-001', { refType: null, refId: null }) ```
+Update a tag (admin). Partial update — only provided fields are changed.  `metadata` is deep-merged with the existing value.  Pass `refType: null, refId: null` to clear the polymorphic ref. ```typescript const updated = await tags.update('coll_123', 'NFC-001', { variantId: 'var_premium', metadata:  { notes: 'Updated to premium variant' }, }) // Clear polymorphic ref await tags.update('coll_123', 'NFC-001', { refType: null, refId: null }) ```
 
 **remove**(collectionId: string,
     tagId: string) → `Promise<DeleteTagResponse>`
@@ -12836,15 +12887,15 @@ List tags with optional filters and pagination (admin). ```typescript // All tag
 
 **byRef**(collectionId: string,
     params: ReverseTagLookupParams) → `Promise<ReverseTagLookupResponse>`
-Reverse lookup — find all tags linked to a given object (admin). Uses a compound index on `(orgId, refType, refId)` on the per-org shard. No embed support on the admin side. ```typescript const { tags: linked } = await tags.byRef('coll_123', { refType: 'container', refId:   'container-uuid', }) ```
+Reverse lookup — find all tags linked to a given object (admin). Uses a compound index on `(orgId, refType, refId)` on the per-org shard. No embed support on the admin side. ```typescript const { tags: linked } = await tags.byRef('coll_123', { refType: 'container', refId:   'container-uuid', }) ```
 
 **resolveTag**(tagId: string) → `Promise<TagIndexEntry>`
-Global tag resolve — returns `{ tagId, collectionId }` only. Use this **only** when you have a raw `tagId` and do not yet know which collection it belongs to.  Queries the shared `tag_index` shard. Once `collectionId` is resolved, call `publicGetByCollection` for full data. > The global `/public/tags/by-ref` endpoint has been removed. > Use the collection-scoped `publicByRef` instead. ```typescript // Step 1: resolve collection const { collectionId } = await tags.resolveTag('NFC-001') // Step 2: full lookup with embedded data const { tag, embedded } = await tags.publicGetByCollection( collectionId, 'NFC-001', 'product,proof' ) ```
+Global tag resolve — returns `{ tagId, collectionId }` only. Use this **only** when you have a raw `tagId` and do not yet know which collection it belongs to.  Queries the shared `tag_index` shard. Once `collectionId` is resolved, call `publicGetByCollection` for full data. > The global `/public/tags/by-ref` endpoint has been removed. > Use the collection-scoped `publicByRef` instead. ```typescript // Step 1: resolve collection const { collectionId } = await tags.resolveTag('NFC-001') // Step 2: full lookup with embedded data const { tag, embedded } = await tags.publicGetByCollection( collectionId, 'NFC-001', 'product,proof' ) ```
 
 **publicGetByCollection**(collectionId: string,
     tagId: string,
     embed?: string) → `Promise<PublicGetTagResponse>`
-Single tag lookup with optional embedded data (public). `GET /public/collection/:collectionId/tags/:tagId?embed=product,proof,container,ref` Supported `embed` values: `'product'`, `'proof'`, `'container'`, `'ref'` (`'collection'` is not supported — the collection is already known from the URL). ```typescript const { tag, embedded } = await tags.publicGetByCollection( 'coll_123', 'NFC-001', 'product,proof' ) const product = embedded.products?.[tag.productId!] const proof   = embedded.proofs?.[tag.proofId!] ```
+Single tag lookup with optional embedded data (public). `GET /public/collection/:collectionId/tags/:tagId?embed=product,proof,container,ref` Supported `embed` values: `'product'`, `'proof'`, `'container'`, `'ref'` (`'collection'` is not supported — the collection is already known from the URL). ```typescript const { tag, embedded } = await tags.publicGetByCollection( 'coll_123', 'NFC-001', 'product,proof' ) const product = embedded.products?.[tag.productId!] const proof   = embedded.proofs?.[tag.proofId!] ```
 
 **lookupTags**(collectionId: string,
     data: LookupTagsRequest) → `Promise<TagLookupResponse>`