@proveanything/smartlinks 2.0.67 → 2.0.68

package/dist/index.d.ts

@@ -41,4 +41,4 @@ AdminMobileHostContext, AdminMobileComponentManifest, AdminMobileBundleManifest,
 MobileAdminBundleManifest, } from './mobile-admin/types.js';
 export { HostCapabilityUnavailableError, HostPermissionDeniedError, HostTimeoutError, HostCancelledError, } from './mobile-admin/errors.js';
 export type { NativeCapability, NativeFacade, ShareFacade, ClipboardFacade, HapticImpactStyle, HapticNotificationStyle, HapticsFacade, NetworkStatus, NetworkFacade, DeviceInfo, DeviceFacade, StorageFacade, QrScanOptions, QrFacade, AuthFacade, NfcReadResult, NfcFacade, RfidScanOptions, RfidFacade, EventsFacade, WebSourceMode, WebSourceConfig, WebSourceFacade, } from './native/types.js';
-export type { AuthKitUser, UserProfile, ProfileUpdateData, UpdateProfileResponse, SuccessResponse, AuthLoginResponse, AppleLoginOptions, AuthKitErrorCode, RefreshResponse, LogoutResponse, RefreshErrorCode, MagicLinkSendResponse, MagicLinkVerifyResponse, PhoneSendCodeResponse, PhoneVerifyResponse, PasswordResetRequestResponse, VerifyResetTokenResponse, PasswordResetCompleteResponse, EmailVerificationActionResponse, EmailVerifyTokenResponse, VerifyStatus, WhatsAppReplyCta, WhatsAppReplyOptions, WhatsAppContactData, SendWhatsAppRequest, SendWhatsAppResponse, ExchangeWhatsAppSessionResponse, VerifyWhatsAppResponse, WhatsAppStatusResponse, SendSmsVerifyRequest, SendSmsVerifyResponse, VerifySmsResponse, UpsertContactRequest, UpsertContactResponse, AuthKitBrandingConfig, AuthKitConfig, AuthKitConfigInput, AuthKitSecurityConfig, AuthKitPasswordPolicy, AuthKitSessionPolicy, AuthKitLockoutPolicy, PasswordPolicyErrorCode, LoginSecurityErrorCode, } from './types/authKit.js';
+export type { AuthKitUser, UserProfile, ProfileUpdateData, UpdateProfileResponse, SuccessResponse, AuthLoginResponse, AppleLoginOptions, AuthKitErrorCode, RefreshResponse, LogoutResponse, RefreshErrorCode, MagicLinkSendResponse, MagicLinkVerifyResponse, PhoneSendCodeResponse, PhoneVerifyResponse, PasswordResetRequestResponse, VerifyResetTokenResponse, PasswordResetCompleteResponse, EmailVerificationActionResponse, EmailVerifyTokenResponse, VerifyStatus, WhatsAppReplyCta, WhatsAppReplyOptions, WhatsAppContactData, SendWhatsAppRequest, SendWhatsAppResponse, ExchangeWhatsAppSessionResponse, VerifyWhatsAppResponse, WhatsAppStatusResponse, SendSmsVerifyRequest, SendSmsVerifyResponse, VerifySmsResponse, UpsertContactRequest, UpsertContactResponse, AuthKitBrandingConfig, AuthKitConfig, AuthKitConfigInput, AuthKitSecurityConfig, AuthKitIdentity, AuthKitSetIdentityResponse, AuthKitPasswordPolicy, AuthKitSessionPolicy, AuthKitLockoutPolicy, PasswordPolicyErrorCode, LoginSecurityErrorCode, } from './types/authKit.js';

package/dist/openapi.yaml

@@ -2077,6 +2077,45 @@ paths:
           description: Unauthorized
         404:
           description: Not found
+  /admin/collection/{collectionId}/authKit/{authKitId}/identity:
+    post:
+      tags:
+        - authKit
+      summary: "Give this AuthKit its **own logins** (admin): its members become accounts of this site only — the same email can be a separate account, with its own password, on another site — rather than SmartLinks accounts shared across sites."
+      operationId: authKit_setIdentity
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: collectionId
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: authKitId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AuthKitSetIdentityResponse"
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: true
   /admin/collection/{collectionId}/batch:
     get:
       tags:
@@ -3715,7 +3754,7 @@ paths:
     get:
       tags:
         - collection
-      summary: "Get the managed-certificate status for a collection's custom domain (admin only)."
+      summary: "Get the certificate status of the collection's own domain (admin only)."
       operationId: collection_getDomainStatus
       security:
         - bearerAuth: []
@@ -3740,7 +3779,7 @@ paths:
     post:
       tags:
         - collection
-      summary: Register a custom domain for a collection and provision its managed certificate (admin only).
+      summary: "Connect one of the collection's own domains and start its certificate (admin only)."
       operationId: collection_registerDomain
       security:
         - bearerAuth: []
@@ -9207,7 +9246,7 @@ paths:
     post:
       tags:
         - authKit
-      summary: authKit.linkedInLogin
+      summary: Sign in with LinkedIn (OpenID Connect) via a server-side authorization code (public).
       operationId: authKit_linkedInLogin
       security: []
       parameters:
@@ -23327,8 +23366,38 @@ components:
           type: string
         security:
           $ref: "#/components/schemas/AuthKitSecurityConfig"
+        collectionIds:
+          type: array
+          items:
+            type: string
+        identity:
+          $ref: "#/components/schemas/AuthKitIdentity"
       required:
         - id
+    AuthKitIdentity:
+      type: object
+      properties:
+        mode:
+          type: string
+          enum:
+            - shared
+            - own
+        tenantId:
+          type: string
+        createdAt:
+          type: string
+      required:
+        - mode
+    AuthKitSetIdentityResponse:
+      type: object
+      properties:
+        identity:
+          $ref: "#/components/schemas/AuthKitIdentity"
+        message:
+          type: string
+      required:
+        - identity
+        - message
     AuthKitSecurityConfig:
       type: object
       properties:

package/dist/types/authKit.d.ts

@@ -407,6 +407,26 @@ export interface AuthKitConfig {
      * server-side. See {@link AuthKitSecurityConfig}.
      */
     security?: AuthKitSecurityConfig;
+    /** The collections this AuthKit serves. */
+    collectionIds?: string[];
+    /**
+     * Which user pool this site's members sign in to. Absent or `shared` = the SmartLinks account (the
+     * same account on every site that uses it). `own` = the site's own members (a separate account per
+     * site, its own passwords). Switch with {@link authKit.setIdentity}; never via create/update.
+     */
+    identity?: AuthKitIdentity;
+}
+/** An AuthKit's member pool. */
+export interface AuthKitIdentity {
+    mode: 'shared' | 'own';
+    /** The site's own pool (set by the platform). */
+    tenantId?: string;
+    createdAt?: string;
+}
+/** Result of {@link authKit.setIdentity}. */
+export interface AuthKitSetIdentityResponse {
+    identity: AuthKitIdentity;
+    message: string;
 }
 /**
  * Writable shape for `authKit.create` / `authKit.update` (admin). Known fields are
@@ -424,7 +444,7 @@ export interface AuthKitConfig {
  * })
  * ```
  */
-export type AuthKitConfigInput = Partial<Omit<AuthKitConfig, 'id' | 'updatedAt'>> & Record<string, any>;
+export type AuthKitConfigInput = Partial<Omit<AuthKitConfig, 'id' | 'updatedAt' | 'identity'>> & Record<string, any>;
 /**
  * Per-collection account-security policy. The API **enforces** all of this; the
  * client uses `passwordPolicy` (live checklist) and `session` (idle sign-out) for UX.

package/dist/types/collection.d.ts

@@ -93,11 +93,13 @@ export type CollectionResponse = Collection;
 export type CollectionCreateRequest = Omit<Collection, 'id' | 'shortId'>;
 export type CollectionUpdateRequest = Partial<Omit<Collection, 'id' | 'shortId'>>;
 /**
- * Which load balancer / certificate map a custom domain registration targets.
- * - `"smartlinks"` (default): the id.smartlinks.app load balancer (legacy behaviour)
- * - `"hub"`: the SmartLinks Hub load balancer
+ * What a collection's own domain is for:
+ * - `"links"` (default): a links domain (e.g. `id.brand.com`) — GS1 Digital Links, short links and QR
+ *   codes, the portal, and the API and sign-in on the brand's domain. Stored as `redirectUrl`.
+ * - `"site"`: a site domain — the collection's Hub (`hubCustomDomain`), or an app website when an
+ *   `appId` is given. Served through the site runtime (CNAME to `cname.smartlinks.host`).
  */
-export type DomainTarget = "smartlinks" | "hub";
+export type DomainTarget = "links" | "site";
 /**
  * Response from checking whether a Hub subdomain name is available.
  */

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.0.67  |  Generated: 2026-10-15T17:52:10.614Z
+Version: 2.0.68  |  Generated: 2026-10-17T10:04:22.637Z
 
 This is a concise summary of all available API functions and types.
 
@@ -4864,6 +4864,25 @@ interface AuthKitConfig {
   redirectUrl?: string
   updatedAt?: string
   security?: AuthKitSecurityConfig
+  collectionIds?: string[]
+  identity?: AuthKitIdentity
+}
+```
+
+**AuthKitIdentity** (interface)
+```typescript
+interface AuthKitIdentity {
+  mode: 'shared' | 'own'
+  tenantId?: string
+  createdAt?: string
+}
+```
+
+**AuthKitSetIdentityResponse** (interface)
+```typescript
+interface AuthKitSetIdentityResponse {
+  identity: AuthKitIdentity
+  message: string
 }
 ```
 
@@ -5362,7 +5381,7 @@ interface InviteUserInput {
 
 **CollectionUpdateRequest** = `Partial<Omit<Collection, 'id' | 'shortId'>>`
 
-**DomainTarget** = `"smartlinks" | "hub"`
+**DomainTarget** = `"links" | "site"`
 
 **CollectionAccessLevel** = `'Owner' | 'Admin' | 'Assigner' | 'Reporter' | 'User' | 'None'`
 
@@ -11323,8 +11342,11 @@ Create an AuthKit client config (admin). Accepts the account `security` policy
 **update**(collectionId: string, authKitId: string, data: AuthKitConfigInput) → `Promise<AuthKitConfig>`
 Update an AuthKit client config (admin). This is how the account **security policy** is written — pass a `security` block ({@link AuthKitSecurityConfig}). The server validates it and enforces it; the login UI reads the public subset back via {@link load}.
 
+**setIdentity**(collectionId: string, authKitId: string, body: { mode: 'own' }) → `Promise<AuthKitSetIdentityResponse>`
+Give this AuthKit its **own logins** (admin): its members become accounts of this site only — the same email can be a separate account, with its own password, on another site — rather than SmartLinks accounts shared across sites. One way: a site with its own members can't go back to the shared pool. Members who signed up before keep their SmartLinks account until moved across. Errors: `MEMBER_POOL_CONFLICT` (409) when another AuthKit already gives one of its collections its own logins (one per collection); `PERMISSION_DENIED` (403) unless you administer every collection it serves.
+
 **remove**(collectionId: string, authKitId: string) → `Promise<void>`
-Update an AuthKit client config (admin). This is how the account **security policy** is written — pass a `security` block ({@link AuthKitSecurityConfig}). The server validates it and enforces it; the login UI reads the public subset back via {@link load}.
+Give this AuthKit its **own logins** (admin): its members become accounts of this site only — the same email can be a separate account, with its own password, on another site — rather than SmartLinks accounts shared across sites. One way: a site with its own members can't go back to the shared pool. Members who signed up before keep their SmartLinks account until moved across. Errors: `MEMBER_POOL_CONFLICT` (409) when another AuthKit already gives one of its collections its own logins (one per collection); `PERMISSION_DENIED` (403) unless you administer every collection it serves.
 
 ### batch
 
@@ -11514,11 +11536,14 @@ Check whether a Hub subdomain name is available to claim (admin only).
 **claimHub**(collectionId: string, hubName: string) → `Promise<CollectionResponse>`
 Claim or rename the Hub subdomain for a collection (admin only). Maps `{hubName}.smartlinks.host` to the collection. If the collection already had a different hub name, the previous subdomain is released automatically.
 
-**registerDomain**(collectionId: string, domain: string, target: DomainTarget = "smartlinks") → `Promise<any>`
-Register a custom domain for a collection and provision its managed certificate (admin only). `"smartlinks"` (the id.smartlinks.app load balancer). Pass `"hub"` to register a bring-your-own Hub domain.
+**registerDomain**(collectionId: string, domain: string, target: DomainTarget = "links") → `Promise<any>`
+Connect one of the collection's own domains and start its certificate (admin only). or `"site"` for the collection's Hub domain.
+
+**getDomainStatus**(collectionId: string, target: DomainTarget = "links") → `Promise<any>`
+Get the certificate status of the collection's own domain (admin only). or `"site"` (its Hub domain, `hubCustomDomain`)
 
-**getDomainStatus**(collectionId: string, target: DomainTarget = "smartlinks") → `Promise<any>`
-Get the managed-certificate status for a collection's custom domain (admin only). or `"hub"` (uses `hubCustomDomain`)
+**releaseDomain**(collectionId: string, domain: string) → `Promise<`
+Remove the collection's links domain (admin only). It stops working straight away: QR codes, GS1 Digital Links and short links printed with it no longer open. Its certificate goes and `redirectUrl` is cleared. (Site domains are removed from the site's settings.)
 
 **getSettings**(collectionId: string, settingGroup: string, admin?: boolean) → `Promise<any>`
 Retrieve a specific settings group for a collection. Public reads return the public view of the settings group. If the stored payload contains a top-level `admin` object, that block is omitted from public responses and included when `admin === true`.
@@ -11538,29 +11563,29 @@ Update a collection (admin only).
 **remove**(collectionId: string) → `Promise<void>`
 Delete a collection (admin only).
 
-**getSN**(collectionId: string,
-    startIndex: number = 0,
+**getSN**(collectionId: string,
+    startIndex: number = 0,
     count: number = 10) → `Promise<any>`
 Get serial numbers for a collection (admin only).
 
-**lookupSN**(collectionId: string,
+**lookupSN**(collectionId: string,
     codeId: string) → `Promise<any>`
 Look up a serial number by code for a collection (admin only).
 
-**assignSN**(collectionId: string,
-    codeId: string,
+**assignSN**(collectionId: string,
+    codeId: string,
     value: any) → `Promise<any>`
 Assign a value to a serial number for a collection (admin only).
 
 **getUsers**(collectionId: string) → `Promise<CollectionUser[]>`
 List the users with access to a collection, each with their access level (admin only). Access is stored in the collection's `roles` map (userId → level); this resolves each to name/email. GET /admin/collection/:collectionId/getUsers
 
-**setUserAccess**(collectionId: string,
-    userId: string,
+**setUserAccess**(collectionId: string,
+    userId: string,
     access: CollectionAccessLevel | null) → `Promise<void>`
 Grant, change, or remove a user's access level on a collection (admin only). Pass `null` or `'None'` to remove access. The server enforces privilege-escalation rules — you cannot grant an access level above your own, nor change a user whose level is above yours. POST /admin/collection/:collectionId/updateUserAccess
 
-**inviteUser**(collectionId: string,
+**inviteUser**(collectionId: string,
     input: InviteUserInput) → `Promise<`
 Invite a user to a collection by email (admin only). Creates or links their account in the login / auth-kit collection (`loginCollectionId`, default `'global'`) and emails them an invite (new account) or an added-to-collection notice (existing account); returns their `uid`. This does NOT grant access on its own — follow with {@link setUserAccess} to set their level (this mirrors the console flow). POST /user/inviteUser