@brandfine/client 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # @brandfine/client
 
+## 0.6.0
+
+### Minor Changes
+
+- 3a9e4ea: Add `bf.appointments` namespace for the Brandfine Appointments
+  plugin. Lets a customer's server-side code (Next route handler,
+  Astro endpoint, Remix loader/action, generic Node server) read
+  booking availability, submit visitor requests, and handle visitor
+  self-cancellations against a workspace where the Appointments
+  plugin is activated.
+
+  ```ts
+  import { createBrandfineClient } from "@brandfine/client";
+
+  const bf = createBrandfineClient({
+    baseUrl: "https://api.brandfine.co",
+    apiKey: process.env.BRANDFINE_API_KEY,
+  });
+
+  // Available slots in the workspace's configured booking window.
+  const { slots, timezone } = await bf.appointments.getAvailability();
+
+  // Submit a visitor request once they pick a slot.
+  const created = await bf.appointments.createRequest({
+    visitorName: "Visitor Name",
+    visitorEmail: "visitor@example.com",
+    requestedAt: slots[0].start, // UTC ISO 8601
+  });
+
+  // Visitor self-cancellation via the token from the confirmation email.
+  await bf.appointments.cancelByToken(created.cancellationToken);
+  ```
+
+  Server-side-only by design — the workspace API key is broad-scope,
+  so the namespace shouldn't be embedded in browser code. A future
+  scoped "publishable" key type will unlock the dormant
+  `@brandfine/widget-appointments` for a drop-in `<script>` flow on
+  the customer's site.
+
+  New types exported from the root entry:
+  `AppointmentSlot`, `AppointmentAvailability`,
+  `CreateAppointmentRequestInput`, `CreatedAppointmentRequest`,
+  `AppointmentRequestSummary`.
+
+  Wraps these endpoints (all already on the API):
+  - `GET  /external/appointments/availability`
+  - `POST /external/appointments/requests`
+  - `GET  /external/appointments/requests/:token`
+  - `POST /external/appointments/requests/:token/cancel`
+
 ## 0.5.0
 
 ### Minor Changes

package/dist/index.cjs

@@ -1,8 +1,8 @@
 'use strict';
 
 var chunkXJFKL2HU_cjs = require('./chunk-XJFKL2HU.cjs');
-var chunkKHHMR2NX_cjs = require('./chunk-KHHMR2NX.cjs');
 var chunkFCK7QJBC_cjs = require('./chunk-FCK7QJBC.cjs');
+var chunkKHHMR2NX_cjs = require('./chunk-KHHMR2NX.cjs');
 
 // src/client.ts
 var BrandfineApiError = class extends Error {
@@ -159,6 +159,59 @@ function createBrandfineClient(config) {
       return await res.json();
     }
   };
+  async function post(path, body, opts = {}) {
+    const url = `${baseUrl}${path}`;
+    const res = await fetchImpl(url, {
+      method: "POST",
+      headers: {
+        "X-Api-Key": apiKey,
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "User-Agent": userAgent
+      },
+      body: JSON.stringify(body),
+      signal: opts.signal
+    });
+    if (!res.ok) {
+      const errBody = await res.text().catch(() => "");
+      throw new BrandfineApiError({
+        status: res.status,
+        statusText: res.statusText,
+        body: errBody,
+        url
+      });
+    }
+    if (res.status === 204) return void 0;
+    return await res.json();
+  }
+  const appointments = {
+    getAvailability(opts = {}) {
+      const qs = [];
+      if (opts.from) qs.push(`from=${encodeURIComponent(toIso(opts.from))}`);
+      if (opts.to) qs.push(`to=${encodeURIComponent(toIso(opts.to))}`);
+      const suffix = qs.length ? `?${qs.join("&")}` : "";
+      return get(
+        `/external/appointments/availability${suffix}`
+      );
+    },
+    createRequest(input) {
+      return post(
+        "/external/appointments/requests",
+        input
+      );
+    },
+    getByCancellationToken(token) {
+      return get(
+        `/external/appointments/requests/${encodeURIComponent(token)}`
+      );
+    },
+    cancelByToken(token) {
+      return post(
+        `/external/appointments/requests/${encodeURIComponent(token)}/cancel`,
+        {}
+      );
+    }
+  };
   return {
     get,
     posts,
@@ -166,9 +219,13 @@ function createBrandfineClient(config) {
     workspace,
     navigations,
     analytics,
-    submissions
+    submissions,
+    appointments
   };
 }
+function toIso(d) {
+  return typeof d === "string" ? d : d.toISOString();
+}
 
 // src/index.ts
 var SDK_VERSION = "0.0.0";
@@ -181,18 +238,6 @@ Object.defineProperty(exports, "createKeyedCache", {
   enumerable: true,
   get: function () { return chunkXJFKL2HU_cjs.createKeyedCache; }
 });
-Object.defineProperty(exports, "createBrandfineWebhookHandler", {
-  enumerable: true,
-  get: function () { return chunkKHHMR2NX_cjs.createBrandfineWebhookHandler; }
-});
-Object.defineProperty(exports, "parseWebhookPayload", {
-  enumerable: true,
-  get: function () { return chunkKHHMR2NX_cjs.parseWebhookPayload; }
-});
-Object.defineProperty(exports, "verifyWebhookSecret", {
-  enumerable: true,
-  get: function () { return chunkKHHMR2NX_cjs.verifyWebhookSecret; }
-});
 Object.defineProperty(exports, "isLocale", {
   enumerable: true,
   get: function () { return chunkFCK7QJBC_cjs.isLocale; }
@@ -213,6 +258,18 @@ Object.defineProperty(exports, "stripLocalePrefix", {
   enumerable: true,
   get: function () { return chunkFCK7QJBC_cjs.stripLocalePrefix; }
 });
+Object.defineProperty(exports, "createBrandfineWebhookHandler", {
+  enumerable: true,
+  get: function () { return chunkKHHMR2NX_cjs.createBrandfineWebhookHandler; }
+});
+Object.defineProperty(exports, "parseWebhookPayload", {
+  enumerable: true,
+  get: function () { return chunkKHHMR2NX_cjs.parseWebhookPayload; }
+});
+Object.defineProperty(exports, "verifyWebhookSecret", {
+  enumerable: true,
+  get: function () { return chunkKHHMR2NX_cjs.verifyWebhookSecret; }
+});
 exports.BrandfineApiError = BrandfineApiError;
 exports.SDK_VERSION = SDK_VERSION;
 exports.createBrandfineClient = createBrandfineClient;

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.ts","../src/index.ts"],"names":[],"mappings":";;;;;;;AA8CO,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAA,EACzB,IAAA,GAAO,mBAAA;AAAA,EAChB,MAAA;AAAA,EACA,UAAA;AAAA,EACA,IAAA;AAAA,EACA,GAAA;AAAA,EAET,YAAY,IAAA,EAKT;AACD,IAAA,KAAA;AAAA,MACE,CAAA,YAAA,EAAe,IAAA,CAAK,MAAM,CAAA,CAAA,EAAI,KAAK,UAAU,CAAA,IAAA,EAAO,IAAA,CAAK,GAAG,WAAM,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,KAC3F;AACA,IAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACnB,IAAA,IAAA,CAAK,aAAa,IAAA,CAAK,UAAA;AACvB,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA;AAAA,EAClB;AACF;AAgKA,IAAM,gBAAA,GAAmB,0BAAA;AAEzB,IAAM,kBAAA,GAAqB,mBAAA;AAEpB,SAAS,sBACd,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA;AACV,IAAA,MAAM,IAAI,MAAM,8CAA8C,CAAA;AAChE,EAAA,IAAI,CAAC,MAAA,CAAO,MAAA;AACV,IAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAE/D,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAChD,EAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AAGtB,EAAA,MAAM,SAAA,GAA0B,MAAA,CAAO,KAAA,IAAS,UAAA,CAAW,KAAA;AAC3D,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,kBAAA;AAEtC,EAAA,eAAe,GAAA,CAAO,IAAA,EAAc,IAAA,GAAuB,EAAC,EAAe;AACzE,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,GAAA,EAAK;AAAA,MAC/B,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,WAAA,EAAa,MAAA;AAAA,QACb,MAAA,EAAQ,kBAAA;AAAA,QACR,YAAA,EAAc;AAAA,OAChB;AAAA,MACA,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AACD,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,IAAA,CAAK,WAAA,EAAa;AAI1C,MAAA,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC/B,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,MAAA,MAAM,IAAI,iBAAA,CAAkB;AAAA,QAC1B,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,YAAY,GAAA,CAAI,UAAA;AAAA,QAChB,IAAA;AAAA,QACA;AAAA,OACD,CAAA;AAAA,IACH;AACA,IAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,EACzB;AAEA,EAAA,MAAM,KAAA,GAAkB;AAAA,IACtB,MAAM,IAAA,CAAwB,IAAA,GAAyB,EAAC,EAAG;AACzD,MAAA,MAAM,MAAgC,EAAC;AACvC,MAAA,IAAI,IAAA,GAAO,CAAA;AACX,MAAA,MAAM,SAAA,GAAY,KAAK,IAAA,GAAO,CAAA,MAAA,EAAS,mBAAmB,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAAK,EAAA;AACzE,MAAA,MAAM,WAAA,GAAc,KAAK,MAAA,GACrB,CAAA,QAAA,EAAW,mBAAmB,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA,GAC1C,EAAA;AAIJ,MAAA,MAAM,YAAY,IAAA,CAAK,UAAA,GACnB,CAAA,aAAA,EAAgB,IAAA,CAAK,UAAU,CAAA,CAAA,GAC/B,WAAA;AAIJ,MAAA,MAAM,SAAA,GAAY,GAAA;AAClB,MAAA,OAAO,QAAQ,SAAA,EAAW;AACxB,QAAA,MAAM,OAAO,MAAM,GAAA;AAAA,UACjB,kCAAkC,SAAS,CAAA,MAAA,EAAS,IAAI,CAAA,EAAG,SAAS,GAAG,WAAW,CAAA;AAAA,SACpF;AACA,QAAA,GAAA,CAAI,IAAA,CAAK,GAAG,IAAA,CAAK,KAAK,CAAA;AACtB,QAAA,IAAI,CAAC,IAAA,CAAK,QAAA,CAAS,OAAA,EAAS;AAC5B,QAAA,IAAA,IAAQ,CAAA;AAAA,MACV;AACA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAM,UAA6B,IAAA,EAAc;AAC/C,MAAA,OAAO,GAAA;AAAA,QACL,CAAA,gBAAA,EAAmB,kBAAA,CAAmB,IAAI,CAAC,CAAA,CAAA;AAAA,QAC3C,EAAE,aAAa,IAAA;AAAK,OACtB;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAM,UAAA,GAA4B;AAAA,IAChC,MAAM,IAAA,CAAK,IAAA,GAA8B,EAAC,EAAG;AAC3C,MAAA,MAAM,EAAA,GAAK,KAAK,MAAA,GAAS,CAAA,QAAA,EAAW,mBAAmB,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA,GAAK,EAAA;AACxE,MAAA,MAAM,OAAO,MAAM,GAAA;AAAA,QACjB,uBAAuB,EAAE,CAAA;AAAA,OAC3B;AACA,MAAA,OAAO,IAAA,CAAK,KAAA;AAAA,IACd;AAAA,GACF;AAEA,EAAA,MAAM,SAAA,GAA0B;AAAA,IAC9B,GAAA,GAGI;AACF,MAAA,OAAO,GAAA;AAAA,QACL;AAAA,OACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAM,WAAA,GAA8B;AAAA,IAClC,IAAuB,GAAA,EAAa;AAClC,MAAA,OAAO,GAAA;AAAA,QACL,CAAA,sBAAA,EAAyB,kBAAA,CAAmB,GAAG,CAAC,CAAA,CAAA;AAAA,QAChD,EAAE,aAAa,IAAA;AAAK,OACtB;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAM,SAAA,GAA0B;AAAA,IAC9B,SAAA,GAAY;AACV,MAAA,OAAO,IAAqB,4BAA4B,CAAA;AAAA,IAC1D,CAAA;AAAA,IACA,MAAM,OAAA,CAAQ,IAAA,GAAuB,EAAC,EAAG;AAIvC,MAAA,IAAI,OAAO,aAAa,WAAA,EAAa;AACnC,QAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAe;AAAA,MACpD;AAIA,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,MAAA,IAAW,MAAM,UAAU,SAAA,EAAU;AACtD,MAAA,IAAI,CAAC,IAAI,OAAA,EAAS;AAChB,QAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAoB;AAAA,MACzD;AAOA,MAAA,MAAM,WAAW,QAAA,CAAS,aAAA;AAAA,QACxB,CAAA,OAAA,EAAU,gBAAgB,CAAA,EAAA,EAAK,GAAA,CAAI,SAAS,CAAA,EAAA;AAAA,OAC9C;AACA,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAA6B;AAAA,MAClE;AAEA,MAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,MAAA,MAAA,CAAO,KAAA,GAAQ,IAAA;AACf,MAAA,MAAA,CAAO,MAAM,GAAA,CAAI,SAAA;AACjB,MAAA,MAAA,CAAO,YAAA,CAAa,iBAAA,EAAmB,GAAA,CAAI,SAAS,CAAA;AAIpD,MAAA,MAAA,CAAO,YAAA,CAAa,gBAAA,EAAkB,GAAA,CAAI,SAAS,CAAA;AACnD,MAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAChC,MAAA,OAAO,EAAE,SAAA,EAAW,IAAA,EAAM,SAAA,EAAW,IAAI,SAAA,EAAU;AAAA,IACrD;AAAA,GACF;AAEA,EAAA,MAAM,WAAA,GAA8B;AAAA,IAClC,MAAM,OAAO,KAAA,EAA8B;AACzC,MAAA,MAAM,GAAA,GAAM,GAAG,OAAO,CAAA,qBAAA,CAAA;AACtB,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,GAAA,EAAK;AAAA,QAC/B,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,WAAA,EAAa,MAAA;AAAA,UACb,cAAA,EAAgB,kBAAA;AAAA,UAChB,MAAA,EAAQ,kBAAA;AAAA,UACR,YAAA,EAAc;AAAA,SAChB;AAAA,QACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAK;AAAA,OAC3B,CAAA;AACD,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,QAAA,MAAM,IAAI,iBAAA,CAAkB;AAAA,UAC1B,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,YAAY,GAAA,CAAI,UAAA;AAAA,UAChB,IAAA;AAAA,UACA;AAAA,SACD,CAAA;AAAA,MACH;AACA,MAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB;AAAA,GACF;AAEA,EAAA,OAAO;AAAA,IACL,GAAA;AAAA,IACA,KAAA;AAAA,IACA,UAAA;AAAA,IACA,SAAA;AAAA,IACA,WAAA;AAAA,IACA,SAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACxZO,IAAM,WAAA,GAAc","file":"index.cjs","sourcesContent":["/**\n * `createBrandfineClient` — the SDK's entry point.\n *\n * Returns a stateless, multi-instance-safe handle scoped to a\n * single `(baseUrl, apiKey)` pair. Pattern follows the Stripe /\n * Algolia / OpenAI SDKs — explicit construction with config,\n * namespaced methods (`bf.posts.list(...)`, `bf.workspace.get()`),\n * no module-level singletons.\n *\n * Why factory not module-level state: multi-tenant consumers\n * sometimes need two clients in the same process (e.g. main site\n * + admin preview). Module-level env reading makes that impossible\n * without monkey-patching.\n */\n\nimport type {\n  BrandfineCategory,\n  BrandfineNavigation,\n  BrandfinePost,\n  BrandfinePostListResponse,\n  BrandfineWorkspace,\n  ListCategoriesOptions,\n  ListPostsOptions,\n} from './types'\n\nexport type BrandfineClientConfig = {\n  /** Base URL of the Brandfine API. No trailing slash — the client\n   *  trims one if you pass it anyway. e.g. `https://api.brandfine.co` */\n  baseUrl: string\n  /** Workspace-scoped API key. Generated from the cms's Workspace\n   *  settings; identifies which workspace the client talks to. */\n  apiKey: string\n  /** Optional fetch override. Useful for tests (inject a stub),\n   *  for runtimes that need a custom implementation (edge workers\n   *  with non-standard fetch), or to add cross-cutting concerns\n   *  like tracing / retries. Defaults to `globalThis.fetch`. */\n  fetch?: typeof globalThis.fetch\n  /** Optional User-Agent header. Falls back to a generic SDK tag. */\n  userAgent?: string\n}\n\n/**\n * Structured error thrown by every request helper on non-2xx\n * responses. Carries the raw body so consumers can log it for\n * debugging without re-fetching.\n */\nexport class BrandfineApiError extends Error {\n  override readonly name = 'BrandfineApiError'\n  readonly status: number\n  readonly statusText: string\n  readonly body: string\n  readonly url: string\n\n  constructor(args: {\n    status: number\n    statusText: string\n    body: string\n    url: string\n  }) {\n    super(\n      `[brandfine] ${args.status} ${args.statusText} on ${args.url} — ${args.body.slice(0, 200)}`,\n    )\n    this.status = args.status\n    this.statusText = args.statusText\n    this.body = args.body\n    this.url = args.url\n  }\n}\n\ntype RequestOptions = {\n  /** When true and the response is 404, return `null` instead of\n   *  throwing. Used by endpoints where 404 is a meaningful empty\n   *  state (navigation by key, single post by slug). */\n  nullable404?: boolean\n  signal?: AbortSignal\n}\n\nexport type BrandfineClient = {\n  /** Low-level GET. Reserved for endpoints we don't have a typed\n   *  helper for yet. Adds the X-Api-Key header automatically. */\n  get: <T>(path: string, opts?: RequestOptions) => Promise<T>\n  posts: PostsApi\n  categories: CategoriesApi\n  workspace: WorkspaceApi\n  navigations: NavigationsApi\n  analytics: AnalyticsApi\n  submissions: SubmissionsApi\n}\n\ntype PostsApi = {\n  /** Paginated list of published posts. Handles the cms's\n   *  pagination transparently — caller gets a flat array. */\n  list: <TConfig = unknown>(\n    opts?: ListPostsOptions,\n  ) => Promise<BrandfinePost<TConfig>[]>\n  /** Single post by per-locale URL slug, scoped to the active\n   *  locale on the workspace's content. Returns `null` for 404 so\n   *  callers can render their own \"not found\" page without try/catch. */\n  getBySlug: <TConfig = unknown>(\n    slug: string,\n  ) => Promise<BrandfinePost<TConfig> | null>\n}\n\ntype CategoriesApi = {\n  list: (opts?: ListCategoriesOptions) => Promise<BrandfineCategory[]>\n}\n\ntype WorkspaceApi = {\n  get: <\n    TCustomConfig = Record<string, unknown>,\n    TSchemaOrg = Record<string, unknown>,\n  >() => Promise<BrandfineWorkspace<TCustomConfig, TSchemaOrg>>\n}\n\ntype NavigationsApi = {\n  /** Navigation by its workspace-scoped `key` (e.g. `'header'`).\n   *  Returns `null` for 404 so consumers can fall back to a\n   *  hardcoded default without try/catch. `TConfig` narrows each\n   *  item's `customConfig` (default `unknown`). */\n  get: <TConfig = unknown>(\n    key: string,\n  ) => Promise<BrandfineNavigation<TConfig> | null>\n}\n\nexport type CreateSubmissionInput = {\n  /** Required. Display name of the submitter. */\n  name: string\n  /** Required. Validated server-side. */\n  email: string\n  /** Optional. Free-text up to 40 chars. */\n  phone?: string\n  /** Optional. Free-text up to 200 chars. */\n  subject?: string\n  /** Required. The message body — up to 10,000 chars. */\n  message: string\n  /** Optional. Where the submission came from — e.g. a route path\n   *  like `/contact`, or a marketing campaign label. Up to 500 chars. */\n  source?: string\n  /** Optional. Free-form JSON metadata the consumer attaches; the\n   *  cms surfaces it verbatim in the submissions admin view. */\n  metadata?: Record<string, unknown>\n}\n\nexport type Submission = {\n  id: string\n  createdAt: string\n}\n\ntype SubmissionsApi = {\n  /**\n   * Posts a contact-form submission to `POST /external/submissions`\n   * for this workspace. The cms surfaces the submission in the\n   * Submissions inbox.\n   *\n   * Throws `BrandfineApiError` on validation failures (400) or\n   * any other non-2xx — caller decides whether to surface that as\n   * a user-visible error or a silent retry.\n   */\n  create: (input: CreateSubmissionInput) => Promise<Submission>\n}\n\nexport type AnalyticsConfig =\n  | { enabled: false }\n  | { enabled: true; websiteId: string; scriptUrl: string }\n\nexport type AnalyticsInstallResult =\n  | { installed: false; reason: 'disabled' | 'ssr' | 'already-installed' }\n  | { installed: true; websiteId: string }\n\nexport type InstallOptions = {\n  /**\n   * Pre-known config. When provided, `install()` skips the round-\n   * trip to `/external/analytics-config` and injects the script\n   * immediately. Use this when you've baked the values into your\n   * build (env vars, CMS-side config dump, etc.) — typical for\n   * static sites where the analytics state is decided at deploy\n   * time, not per page load.\n   *\n   * Trade-off vs the default fetch path: if you disable analytics\n   * in Brandfine, the tracker keeps loading until your next\n   * deploy. That's usually the right trade for static sites\n   * (which redeploy on every content change anyway) and the wrong\n   * trade for dynamic sites where the api round-trip is cheap\n   * relative to the rest of the page.\n   *\n   * Pass `{ enabled: false }` to force a no-op without touching\n   * the api (e.g. to disable analytics for one environment without\n   * changing Brandfine's state).\n   */\n  config?: AnalyticsConfig\n}\n\ntype AnalyticsApi = {\n  /**\n   * Injects the Brandfine analytics tracker into `document.head`\n   * once. Safe to call on every page load — idempotent via a\n   * marker attribute on the injected script tag.\n   *\n   * Two paths:\n   *  - `install()` — fetches the config from Brandfine, then\n   *    injects. Reflects enable/disable state on next page load.\n   *  - `install({ config })` — uses caller-provided config, skips\n   *    the fetch. Faster, no round-trip; ignores Brandfine state\n   *    changes until the consumer's next deploy.\n   *\n   * Returns details about what happened:\n   *  - `{ installed: true, websiteId }` — script was just injected.\n   *  - `{ installed: false, reason: 'disabled' }` — config says\n   *    analytics is off; no-op.\n   *  - `{ installed: false, reason: 'ssr' }` — no `document` in\n   *    scope (server-side). Call again on the client.\n   *  - `{ installed: false, reason: 'already-installed' }` — a\n   *    prior call (or another tab in the same SPA) already injected.\n   *\n   * Throws `BrandfineApiError` on non-2xx responses other than the\n   * disabled case (which is a valid `{ enabled: false }` body).\n   */\n  install: (opts?: InstallOptions) => Promise<AnalyticsInstallResult>\n\n  /** Lower-level helper — fetches the raw config without touching\n   *  the DOM. Useful when you want to inject the script yourself\n   *  (e.g. via a framework's <Script> component for nonce/csp). */\n  getConfig: () => Promise<AnalyticsConfig>\n}\n\n/** Attribute we stamp on the injected <script> so `install()` is\n *  idempotent across re-renders and SPA route changes. */\nconst INSTALLED_MARKER = 'data-brandfine-analytics'\n\nconst DEFAULT_USER_AGENT = '@brandfine/client'\n\nexport function createBrandfineClient(\n  config: BrandfineClientConfig,\n): BrandfineClient {\n  if (!config.baseUrl)\n    throw new Error('createBrandfineClient: `baseUrl` is required')\n  if (!config.apiKey)\n    throw new Error('createBrandfineClient: `apiKey` is required')\n\n  const baseUrl = config.baseUrl.replace(/\\/$/, '')\n  const apiKey = config.apiKey\n  // Resolve fetch lazily so consumers in environments without a\n  // global fetch can polyfill before constructing the client.\n  const fetchImpl: typeof fetch = config.fetch ?? globalThis.fetch\n  const userAgent = config.userAgent ?? DEFAULT_USER_AGENT\n\n  async function get<T>(path: string, opts: RequestOptions = {}): Promise<T> {\n    const url = `${baseUrl}${path}`\n    const res = await fetchImpl(url, {\n      method: 'GET',\n      headers: {\n        'X-Api-Key': apiKey,\n        Accept: 'application/json',\n        'User-Agent': userAgent,\n      },\n      signal: opts.signal,\n    })\n    if (res.status === 404 && opts.nullable404) {\n      // Drain the body so the underlying socket can be reused —\n      // fetch implementations that don't auto-drain (older Node)\n      // can leak otherwise.\n      await res.text().catch(() => '')\n      return null as T\n    }\n    if (!res.ok) {\n      const body = await res.text().catch(() => '')\n      throw new BrandfineApiError({\n        status: res.status,\n        statusText: res.statusText,\n        body,\n        url,\n      })\n    }\n    return (await res.json()) as T\n  }\n\n  const posts: PostsApi = {\n    async list<TConfig = unknown>(opts: ListPostsOptions = {}) {\n      const out: BrandfinePost<TConfig>[] = []\n      let page = 1\n      const typeQuery = opts.type ? `&type=${encodeURIComponent(opts.type)}` : ''\n      const localeQuery = opts.locale\n        ? `&locale=${encodeURIComponent(opts.locale)}`\n        : ''\n      // Default pagination at the cms's 50-per-page cap. `forceLimit`\n      // opts past it for content types that would otherwise need\n      // many round-trips.\n      const sizeQuery = opts.forceLimit\n        ? `&force_limit=${opts.forceLimit}`\n        : '&limit=50'\n      // Pathological safety brake — 200 pages × 50 = 10k posts. If\n      // a workspace ever needs more, callers should hit the API\n      // directly with their own pagination logic.\n      const MAX_PAGES = 200\n      while (page <= MAX_PAGES) {\n        const data = await get<BrandfinePostListResponse<TConfig>>(\n          `/external/posts?include=content${sizeQuery}&page=${page}${typeQuery}${localeQuery}`,\n        )\n        out.push(...data.items)\n        if (!data.pageInfo.hasNext) break\n        page += 1\n      }\n      return out\n    },\n    async getBySlug<TConfig = unknown>(slug: string) {\n      return get<BrandfinePost<TConfig> | null>(\n        `/external/posts/${encodeURIComponent(slug)}`,\n        { nullable404: true },\n      )\n    },\n  }\n\n  const categories: CategoriesApi = {\n    async list(opts: ListCategoriesOptions = {}) {\n      const qs = opts.locale ? `?locale=${encodeURIComponent(opts.locale)}` : ''\n      const data = await get<{ items: BrandfineCategory[] }>(\n        `/external/categories${qs}`,\n      )\n      return data.items\n    },\n  }\n\n  const workspace: WorkspaceApi = {\n    get<\n      TCustomConfig = Record<string, unknown>,\n      TSchemaOrg = Record<string, unknown>,\n    >() {\n      return get<BrandfineWorkspace<TCustomConfig, TSchemaOrg>>(\n        '/external/workspace',\n      )\n    },\n  }\n\n  const navigations: NavigationsApi = {\n    get<TConfig = unknown>(key: string) {\n      return get<BrandfineNavigation<TConfig> | null>(\n        `/external/navigations/${encodeURIComponent(key)}`,\n        { nullable404: true },\n      )\n    },\n  }\n\n  const analytics: AnalyticsApi = {\n    getConfig() {\n      return get<AnalyticsConfig>('/external/analytics-config')\n    },\n    async install(opts: InstallOptions = {}) {\n      // SSR safety: nothing to inject without a DOM. Consumers\n      // call this from useEffect / onMount, but defensive anyway\n      // (some frameworks still execute the file body on the server).\n      if (typeof document === 'undefined') {\n        return { installed: false, reason: 'ssr' as const }\n      }\n\n      // Use caller-provided config if present (build-time path),\n      // otherwise fetch (runtime path).\n      const cfg = opts.config ?? (await analytics.getConfig())\n      if (!cfg.enabled) {\n        return { installed: false, reason: 'disabled' as const }\n      }\n\n      // Idempotency: a prior call (StrictMode double-invoke, SPA\n      // re-mount, second instance with the same workspace) may\n      // have already injected. The marker attribute is the source\n      // of truth — checking by script src would also miss the case\n      // where two workspaces share the same scriptUrl.\n      const existing = document.querySelector<HTMLScriptElement>(\n        `script[${INSTALLED_MARKER}=\"${cfg.websiteId}\"]`,\n      )\n      if (existing) {\n        return { installed: false, reason: 'already-installed' as const }\n      }\n\n      const script = document.createElement('script')\n      script.defer = true\n      script.src = cfg.scriptUrl\n      script.setAttribute('data-website-id', cfg.websiteId)\n      // The marker doubles as a sentinel + a debug aid (you can\n      // grep the DOM for `data-brandfine-analytics` to confirm\n      // an install).\n      script.setAttribute(INSTALLED_MARKER, cfg.websiteId)\n      document.head.appendChild(script)\n      return { installed: true, websiteId: cfg.websiteId }\n    },\n  }\n\n  const submissions: SubmissionsApi = {\n    async create(input: CreateSubmissionInput) {\n      const url = `${baseUrl}/external/submissions`\n      const res = await fetchImpl(url, {\n        method: 'POST',\n        headers: {\n          'X-Api-Key': apiKey,\n          'Content-Type': 'application/json',\n          Accept: 'application/json',\n          'User-Agent': userAgent,\n        },\n        body: JSON.stringify(input),\n      })\n      if (!res.ok) {\n        const body = await res.text().catch(() => '')\n        throw new BrandfineApiError({\n          status: res.status,\n          statusText: res.statusText,\n          body,\n          url,\n        })\n      }\n      return (await res.json()) as Submission\n    },\n  }\n\n  return {\n    get,\n    posts,\n    categories,\n    workspace,\n    navigations,\n    analytics,\n    submissions,\n  }\n}\n","/**\n * @brandfine/client — root entry.\n *\n * The full SDK surface is exposed here for \"import everything from\n * one place\" usage. Tree-shaking + `sideEffects: false` mean\n * consumers don't pay a bundle cost for what they don't import.\n *\n * Heavier or framework-coupled pieces still live under subpath\n * exports (`@brandfine/client/cache`, `/resolvers`, `/webhook`) so\n * consumers with poor tree-shaking — or who only need one slice —\n * can scope their imports.\n */\n\nexport const SDK_VERSION = '0.0.0' as const\n\nexport {\n  BrandfineApiError,\n  createBrandfineClient,\n  type AnalyticsConfig,\n  type AnalyticsInstallResult,\n  type BrandfineClient,\n  type BrandfineClientConfig,\n  type CreateSubmissionInput,\n  type InstallOptions,\n  type Submission,\n} from './client'\n\nexport {\n  createCache,\n  createKeyedCache,\n  type Cache,\n  type CacheOptions,\n  type KeyedCache,\n  type KeyedCacheOptions,\n} from './cache/index'\n\nexport {\n  isLocale,\n  localizePath,\n  pickLocale,\n  resolveNavigation,\n  stripLocalePrefix,\n  type HydratedNav,\n  type HydratedNavItem,\n  type LocaleOptions,\n  type ResolveNavigationOptions,\n} from './resolvers/index'\n\nexport {\n  createBrandfineWebhookHandler,\n  parseWebhookPayload,\n  verifyWebhookSecret,\n  type BrandfineWebhookEvent,\n  type BrandfineWebhookHandlerOptions,\n  type BrandfineWebhookPayload,\n} from './webhook/index'\n\nexport type {\n  BrandfineCategory,\n  BrandfineNavItem,\n  BrandfineNavItemType,\n  BrandfineNavPost,\n  BrandfineNavigation,\n  BrandfinePost,\n  BrandfinePostListResponse,\n  BrandfinePostTranslation,\n  BrandfineWorkspace,\n  ListCategoriesOptions,\n  ListPostsOptions,\n} from './types'\n"]}
+{"version":3,"sources":["../src/client.ts","../src/index.ts"],"names":[],"mappings":";;;;;;;AA8CO,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAA,EACzB,IAAA,GAAO,mBAAA;AAAA,EAChB,MAAA;AAAA,EACA,UAAA;AAAA,EACA,IAAA;AAAA,EACA,GAAA;AAAA,EAET,YAAY,IAAA,EAKT;AACD,IAAA,KAAA;AAAA,MACE,CAAA,YAAA,EAAe,IAAA,CAAK,MAAM,CAAA,CAAA,EAAI,KAAK,UAAU,CAAA,IAAA,EAAO,IAAA,CAAK,GAAG,WAAM,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,KAC3F;AACA,IAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACnB,IAAA,IAAA,CAAK,aAAa,IAAA,CAAK,UAAA;AACvB,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA;AAAA,EAClB;AACF;AAyQA,IAAM,gBAAA,GAAmB,0BAAA;AAEzB,IAAM,kBAAA,GAAqB,mBAAA;AAEpB,SAAS,sBACd,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA;AACV,IAAA,MAAM,IAAI,MAAM,8CAA8C,CAAA;AAChE,EAAA,IAAI,CAAC,MAAA,CAAO,MAAA;AACV,IAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAE/D,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAChD,EAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AAGtB,EAAA,MAAM,SAAA,GAA0B,MAAA,CAAO,KAAA,IAAS,UAAA,CAAW,KAAA;AAC3D,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,kBAAA;AAEtC,EAAA,eAAe,GAAA,CAAO,IAAA,EAAc,IAAA,GAAuB,EAAC,EAAe;AACzE,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,GAAA,EAAK;AAAA,MAC/B,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,WAAA,EAAa,MAAA;AAAA,QACb,MAAA,EAAQ,kBAAA;AAAA,QACR,YAAA,EAAc;AAAA,OAChB;AAAA,MACA,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AACD,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,IAAA,CAAK,WAAA,EAAa;AAI1C,MAAA,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC/B,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,MAAA,MAAM,IAAI,iBAAA,CAAkB;AAAA,QAC1B,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,YAAY,GAAA,CAAI,UAAA;AAAA,QAChB,IAAA;AAAA,QACA;AAAA,OACD,CAAA;AAAA,IACH;AACA,IAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,EACzB;AAEA,EAAA,MAAM,KAAA,GAAkB;AAAA,IACtB,MAAM,IAAA,CAAwB,IAAA,GAAyB,EAAC,EAAG;AACzD,MAAA,MAAM,MAAgC,EAAC;AACvC,MAAA,IAAI,IAAA,GAAO,CAAA;AACX,MAAA,MAAM,SAAA,GAAY,KAAK,IAAA,GAAO,CAAA,MAAA,EAAS,mBAAmB,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAAK,EAAA;AACzE,MAAA,MAAM,WAAA,GAAc,KAAK,MAAA,GACrB,CAAA,QAAA,EAAW,mBAAmB,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA,GAC1C,EAAA;AAIJ,MAAA,MAAM,YAAY,IAAA,CAAK,UAAA,GACnB,CAAA,aAAA,EAAgB,IAAA,CAAK,UAAU,CAAA,CAAA,GAC/B,WAAA;AAIJ,MAAA,MAAM,SAAA,GAAY,GAAA;AAClB,MAAA,OAAO,QAAQ,SAAA,EAAW;AACxB,QAAA,MAAM,OAAO,MAAM,GAAA;AAAA,UACjB,kCAAkC,SAAS,CAAA,MAAA,EAAS,IAAI,CAAA,EAAG,SAAS,GAAG,WAAW,CAAA;AAAA,SACpF;AACA,QAAA,GAAA,CAAI,IAAA,CAAK,GAAG,IAAA,CAAK,KAAK,CAAA;AACtB,QAAA,IAAI,CAAC,IAAA,CAAK,QAAA,CAAS,OAAA,EAAS;AAC5B,QAAA,IAAA,IAAQ,CAAA;AAAA,MACV;AACA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAM,UAA6B,IAAA,EAAc;AAC/C,MAAA,OAAO,GAAA;AAAA,QACL,CAAA,gBAAA,EAAmB,kBAAA,CAAmB,IAAI,CAAC,CAAA,CAAA;AAAA,QAC3C,EAAE,aAAa,IAAA;AAAK,OACtB;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAM,UAAA,GAA4B;AAAA,IAChC,MAAM,IAAA,CAAK,IAAA,GAA8B,EAAC,EAAG;AAC3C,MAAA,MAAM,EAAA,GAAK,KAAK,MAAA,GAAS,CAAA,QAAA,EAAW,mBAAmB,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA,GAAK,EAAA;AACxE,MAAA,MAAM,OAAO,MAAM,GAAA;AAAA,QACjB,uBAAuB,EAAE,CAAA;AAAA,OAC3B;AACA,MAAA,OAAO,IAAA,CAAK,KAAA;AAAA,IACd;AAAA,GACF;AAEA,EAAA,MAAM,SAAA,GAA0B;AAAA,IAC9B,GAAA,GAGI;AACF,MAAA,OAAO,GAAA;AAAA,QACL;AAAA,OACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAM,WAAA,GAA8B;AAAA,IAClC,IAAuB,GAAA,EAAa;AAClC,MAAA,OAAO,GAAA;AAAA,QACL,CAAA,sBAAA,EAAyB,kBAAA,CAAmB,GAAG,CAAC,CAAA,CAAA;AAAA,QAChD,EAAE,aAAa,IAAA;AAAK,OACtB;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAM,SAAA,GAA0B;AAAA,IAC9B,SAAA,GAAY;AACV,MAAA,OAAO,IAAqB,4BAA4B,CAAA;AAAA,IAC1D,CAAA;AAAA,IACA,MAAM,OAAA,CAAQ,IAAA,GAAuB,EAAC,EAAG;AAIvC,MAAA,IAAI,OAAO,aAAa,WAAA,EAAa;AACnC,QAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAe;AAAA,MACpD;AAIA,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,MAAA,IAAW,MAAM,UAAU,SAAA,EAAU;AACtD,MAAA,IAAI,CAAC,IAAI,OAAA,EAAS;AAChB,QAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAoB;AAAA,MACzD;AAOA,MAAA,MAAM,WAAW,QAAA,CAAS,aAAA;AAAA,QACxB,CAAA,OAAA,EAAU,gBAAgB,CAAA,EAAA,EAAK,GAAA,CAAI,SAAS,CAAA,EAAA;AAAA,OAC9C;AACA,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAA6B;AAAA,MAClE;AAEA,MAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,MAAA,MAAA,CAAO,KAAA,GAAQ,IAAA;AACf,MAAA,MAAA,CAAO,MAAM,GAAA,CAAI,SAAA;AACjB,MAAA,MAAA,CAAO,YAAA,CAAa,iBAAA,EAAmB,GAAA,CAAI,SAAS,CAAA;AAIpD,MAAA,MAAA,CAAO,YAAA,CAAa,gBAAA,EAAkB,GAAA,CAAI,SAAS,CAAA;AACnD,MAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAChC,MAAA,OAAO,EAAE,SAAA,EAAW,IAAA,EAAM,SAAA,EAAW,IAAI,SAAA,EAAU;AAAA,IACrD;AAAA,GACF;AAEA,EAAA,MAAM,WAAA,GAA8B;AAAA,IAClC,MAAM,OAAO,KAAA,EAA8B;AACzC,MAAA,MAAM,GAAA,GAAM,GAAG,OAAO,CAAA,qBAAA,CAAA;AACtB,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,GAAA,EAAK;AAAA,QAC/B,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,WAAA,EAAa,MAAA;AAAA,UACb,cAAA,EAAgB,kBAAA;AAAA,UAChB,MAAA,EAAQ,kBAAA;AAAA,UACR,YAAA,EAAc;AAAA,SAChB;AAAA,QACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAK;AAAA,OAC3B,CAAA;AACD,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,QAAA,MAAM,IAAI,iBAAA,CAAkB;AAAA,UAC1B,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,YAAY,GAAA,CAAI,UAAA;AAAA,UAChB,IAAA;AAAA,UACA;AAAA,SACD,CAAA;AAAA,MACH;AACA,MAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB;AAAA,GACF;AASA,EAAA,eAAe,IAAA,CACb,IAAA,EACA,IAAA,EACA,IAAA,GAAuB,EAAC,EACZ;AACZ,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,GAAA,EAAK;AAAA,MAC/B,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,WAAA,EAAa,MAAA;AAAA,QACb,cAAA,EAAgB,kBAAA;AAAA,QAChB,MAAA,EAAQ,kBAAA;AAAA,QACR,YAAA,EAAc;AAAA,OAChB;AAAA,MACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAAA,MACzB,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,UAAU,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC/C,MAAA,MAAM,IAAI,iBAAA,CAAkB;AAAA,QAC1B,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,YAAY,GAAA,CAAI,UAAA;AAAA,QAChB,IAAA,EAAM,OAAA;AAAA,QACN;AAAA,OACD,CAAA;AAAA,IACH;AACA,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK,OAAO,MAAA;AAC/B,IAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,EACzB;AAEA,EAAA,MAAM,YAAA,GAAgC;AAAA,IACpC,eAAA,CAAgB,IAAA,GAAO,EAAC,EAAG;AACzB,MAAA,MAAM,KAAe,EAAC;AACtB,MAAA,IAAI,IAAA,CAAK,IAAA,EAAM,EAAA,CAAG,IAAA,CAAK,CAAA,KAAA,EAAQ,kBAAA,CAAmB,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAC,CAAA,CAAE,CAAA;AACrE,MAAA,IAAI,IAAA,CAAK,EAAA,EAAI,EAAA,CAAG,IAAA,CAAK,CAAA,GAAA,EAAM,kBAAA,CAAmB,KAAA,CAAM,IAAA,CAAK,EAAE,CAAC,CAAC,CAAA,CAAE,CAAA;AAC/D,MAAA,MAAM,MAAA,GAAS,GAAG,MAAA,GAAS,CAAA,CAAA,EAAI,GAAG,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,GAAK,EAAA;AAChD,MAAA,OAAO,GAAA;AAAA,QACL,sCAAsC,MAAM,CAAA;AAAA,OAC9C;AAAA,IACF,CAAA;AAAA,IACA,cAAc,KAAA,EAAO;AACnB,MAAA,OAAO,IAAA;AAAA,QACL,iCAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,CAAA;AAAA,IACA,uBAAuB,KAAA,EAAO;AAC5B,MAAA,OAAO,GAAA;AAAA,QACL,CAAA,gCAAA,EAAmC,kBAAA,CAAmB,KAAK,CAAC,CAAA;AAAA,OAC9D;AAAA,IACF,CAAA;AAAA,IACA,cAAc,KAAA,EAAO;AACnB,MAAA,OAAO,IAAA;AAAA,QACL,CAAA,gCAAA,EAAmC,kBAAA,CAAmB,KAAK,CAAC,CAAA,OAAA,CAAA;AAAA,QAC5D;AAAC,OACH;AAAA,IACF;AAAA,GACF;AAEA,EAAA,OAAO;AAAA,IACL,GAAA;AAAA,IACA,KAAA;AAAA,IACA,UAAA;AAAA,IACA,SAAA;AAAA,IACA,WAAA;AAAA,IACA,SAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AACF;AAIA,SAAS,MAAM,CAAA,EAA0B;AACvC,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,EAAE,WAAA,EAAY;AACnD;;;AC1kBO,IAAM,WAAA,GAAc","file":"index.cjs","sourcesContent":["/**\n * `createBrandfineClient` — the SDK's entry point.\n *\n * Returns a stateless, multi-instance-safe handle scoped to a\n * single `(baseUrl, apiKey)` pair. Pattern follows the Stripe /\n * Algolia / OpenAI SDKs — explicit construction with config,\n * namespaced methods (`bf.posts.list(...)`, `bf.workspace.get()`),\n * no module-level singletons.\n *\n * Why factory not module-level state: multi-tenant consumers\n * sometimes need two clients in the same process (e.g. main site\n * + admin preview). Module-level env reading makes that impossible\n * without monkey-patching.\n */\n\nimport type {\n  BrandfineCategory,\n  BrandfineNavigation,\n  BrandfinePost,\n  BrandfinePostListResponse,\n  BrandfineWorkspace,\n  ListCategoriesOptions,\n  ListPostsOptions,\n} from './types'\n\nexport type BrandfineClientConfig = {\n  /** Base URL of the Brandfine API. No trailing slash — the client\n   *  trims one if you pass it anyway. e.g. `https://api.brandfine.co` */\n  baseUrl: string\n  /** Workspace-scoped API key. Generated from the cms's Workspace\n   *  settings; identifies which workspace the client talks to. */\n  apiKey: string\n  /** Optional fetch override. Useful for tests (inject a stub),\n   *  for runtimes that need a custom implementation (edge workers\n   *  with non-standard fetch), or to add cross-cutting concerns\n   *  like tracing / retries. Defaults to `globalThis.fetch`. */\n  fetch?: typeof globalThis.fetch\n  /** Optional User-Agent header. Falls back to a generic SDK tag. */\n  userAgent?: string\n}\n\n/**\n * Structured error thrown by every request helper on non-2xx\n * responses. Carries the raw body so consumers can log it for\n * debugging without re-fetching.\n */\nexport class BrandfineApiError extends Error {\n  override readonly name = 'BrandfineApiError'\n  readonly status: number\n  readonly statusText: string\n  readonly body: string\n  readonly url: string\n\n  constructor(args: {\n    status: number\n    statusText: string\n    body: string\n    url: string\n  }) {\n    super(\n      `[brandfine] ${args.status} ${args.statusText} on ${args.url} — ${args.body.slice(0, 200)}`,\n    )\n    this.status = args.status\n    this.statusText = args.statusText\n    this.body = args.body\n    this.url = args.url\n  }\n}\n\ntype RequestOptions = {\n  /** When true and the response is 404, return `null` instead of\n   *  throwing. Used by endpoints where 404 is a meaningful empty\n   *  state (navigation by key, single post by slug). */\n  nullable404?: boolean\n  signal?: AbortSignal\n}\n\nexport type BrandfineClient = {\n  /** Low-level GET. Reserved for endpoints we don't have a typed\n   *  helper for yet. Adds the X-Api-Key header automatically. */\n  get: <T>(path: string, opts?: RequestOptions) => Promise<T>\n  posts: PostsApi\n  categories: CategoriesApi\n  workspace: WorkspaceApi\n  navigations: NavigationsApi\n  analytics: AnalyticsApi\n  submissions: SubmissionsApi\n  appointments: AppointmentsApi\n}\n\ntype PostsApi = {\n  /** Paginated list of published posts. Handles the cms's\n   *  pagination transparently — caller gets a flat array. */\n  list: <TConfig = unknown>(\n    opts?: ListPostsOptions,\n  ) => Promise<BrandfinePost<TConfig>[]>\n  /** Single post by per-locale URL slug, scoped to the active\n   *  locale on the workspace's content. Returns `null` for 404 so\n   *  callers can render their own \"not found\" page without try/catch. */\n  getBySlug: <TConfig = unknown>(\n    slug: string,\n  ) => Promise<BrandfinePost<TConfig> | null>\n}\n\ntype CategoriesApi = {\n  list: (opts?: ListCategoriesOptions) => Promise<BrandfineCategory[]>\n}\n\ntype WorkspaceApi = {\n  get: <\n    TCustomConfig = Record<string, unknown>,\n    TSchemaOrg = Record<string, unknown>,\n  >() => Promise<BrandfineWorkspace<TCustomConfig, TSchemaOrg>>\n}\n\ntype NavigationsApi = {\n  /** Navigation by its workspace-scoped `key` (e.g. `'header'`).\n   *  Returns `null` for 404 so consumers can fall back to a\n   *  hardcoded default without try/catch. `TConfig` narrows each\n   *  item's `customConfig` (default `unknown`). */\n  get: <TConfig = unknown>(\n    key: string,\n  ) => Promise<BrandfineNavigation<TConfig> | null>\n}\n\nexport type CreateSubmissionInput = {\n  /** Required. Display name of the submitter. */\n  name: string\n  /** Required. Validated server-side. */\n  email: string\n  /** Optional. Free-text up to 40 chars. */\n  phone?: string\n  /** Optional. Free-text up to 200 chars. */\n  subject?: string\n  /** Required. The message body — up to 10,000 chars. */\n  message: string\n  /** Optional. Where the submission came from — e.g. a route path\n   *  like `/contact`, or a marketing campaign label. Up to 500 chars. */\n  source?: string\n  /** Optional. Free-form JSON metadata the consumer attaches; the\n   *  cms surfaces it verbatim in the submissions admin view. */\n  metadata?: Record<string, unknown>\n}\n\nexport type Submission = {\n  id: string\n  createdAt: string\n}\n\ntype SubmissionsApi = {\n  /**\n   * Posts a contact-form submission to `POST /external/submissions`\n   * for this workspace. The cms surfaces the submission in the\n   * Submissions inbox.\n   *\n   * Throws `BrandfineApiError` on validation failures (400) or\n   * any other non-2xx — caller decides whether to surface that as\n   * a user-visible error or a silent retry.\n   */\n  create: (input: CreateSubmissionInput) => Promise<Submission>\n}\n\n// ----------------------------------------------------------------\n// Appointments plugin SDK — pairs with the Appointments embed\n// widget. Consumers who want full control over the booking UI use\n// these methods directly; consumers who want the drop-in widget\n// use the `<script>` embed (which itself uses these methods under\n// the hood). The same `BrandfineClient` instance powers both.\n// ----------------------------------------------------------------\n\nexport type AppointmentSlot = {\n  /** UTC ISO 8601 timestamp of the slot start. */\n  start: string\n  /** UTC ISO 8601 timestamp of the slot end. */\n  end: string\n}\n\nexport type AppointmentAvailability = {\n  /** False = plugin not activated, or activation row's `enabled`\n   *  flag is off. Widgets should render a \"not accepting bookings\"\n   *  state, not throw. */\n  enabled: boolean\n  /** Source-of-truth IANA timezone for the workspace's business\n   *  hours. Visitors see slots in their local TZ — use this for\n   *  the \"(workspace local: HH:MM)\" subtext. */\n  timezone: string\n  slotDurationMinutes: number\n  leadTimeHours: number\n  bookingWindowDays: number\n  policyText: string | null\n  slots: AppointmentSlot[]\n  /** UTC ISO 8601. Useful for the widget's date range label. */\n  windowStart: string\n  windowEnd: string\n}\n\nexport type CreateAppointmentRequestInput = {\n  visitorName: string\n  visitorEmail: string\n  visitorPhone?: string\n  visitorMessage?: string\n  /** UTC ISO 8601 of the requested slot start. Server re-validates\n   *  against business hours + busy ranges before accepting. */\n  requestedAt: string\n  /** Optional cookie-derived session id from the consumer site. */\n  visitorSessionId?: string\n}\n\nexport type CreatedAppointmentRequest = {\n  id: string\n  createdAt: string\n  requestedAt: string\n  durationMinutes: number\n  status: 'PENDING'\n  /** Visitor's self-cancel token. Embed it in confirmation\n   *  emails / on-page UI so the visitor can cancel without an\n   *  account. One-time use; revoked once any party acts. */\n  cancellationToken: string | null\n}\n\nexport type AppointmentRequestSummary = {\n  id: string\n  visitorName: string\n  visitorEmail: string\n  requestedAt: string\n  durationMinutes: number\n  status: 'PENDING' | 'CONFIRMED' | 'REJECTED' | 'CANCELLED'\n  workspace: { name: string; slug: string }\n}\n\ntype AppointmentsApi = {\n  /**\n   * Available slots for the workspace's booking window.\n   * `from` / `to` are optional clamps inside the workspace's\n   * configured window — the server ignores ranges outside.\n   */\n  getAvailability: (opts?: {\n    from?: Date | string\n    to?: Date | string\n  }) => Promise<AppointmentAvailability>\n  /**\n   * Submit a visitor's appointment request. Returns the created\n   * row + a one-time cancellation token. Server-side validates\n   * the slot is still bookable; if it isn't, throws\n   * `BrandfineApiError` with status 404 / 409.\n   */\n  createRequest: (\n    input: CreateAppointmentRequestInput,\n  ) => Promise<CreatedAppointmentRequest>\n  /**\n   * Look up an appointment by its cancellation token. Used by\n   * the widget's `?bf-cancel=<token>` URL flow to render a\n   * confirmation page before the visitor cancels.\n   */\n  getByCancellationToken: (\n    token: string,\n  ) => Promise<AppointmentRequestSummary>\n  /**\n   * Visitor self-cancellation. The token is revoked after the\n   * call succeeds; subsequent calls return 400.\n   */\n  cancelByToken: (\n    token: string,\n  ) => Promise<{ id: string; status: 'CANCELLED' }>\n}\n\nexport type AnalyticsConfig =\n  | { enabled: false }\n  | { enabled: true; websiteId: string; scriptUrl: string }\n\nexport type AnalyticsInstallResult =\n  | { installed: false; reason: 'disabled' | 'ssr' | 'already-installed' }\n  | { installed: true; websiteId: string }\n\nexport type InstallOptions = {\n  /**\n   * Pre-known config. When provided, `install()` skips the round-\n   * trip to `/external/analytics-config` and injects the script\n   * immediately. Use this when you've baked the values into your\n   * build (env vars, CMS-side config dump, etc.) — typical for\n   * static sites where the analytics state is decided at deploy\n   * time, not per page load.\n   *\n   * Trade-off vs the default fetch path: if you disable analytics\n   * in Brandfine, the tracker keeps loading until your next\n   * deploy. That's usually the right trade for static sites\n   * (which redeploy on every content change anyway) and the wrong\n   * trade for dynamic sites where the api round-trip is cheap\n   * relative to the rest of the page.\n   *\n   * Pass `{ enabled: false }` to force a no-op without touching\n   * the api (e.g. to disable analytics for one environment without\n   * changing Brandfine's state).\n   */\n  config?: AnalyticsConfig\n}\n\ntype AnalyticsApi = {\n  /**\n   * Injects the Brandfine analytics tracker into `document.head`\n   * once. Safe to call on every page load — idempotent via a\n   * marker attribute on the injected script tag.\n   *\n   * Two paths:\n   *  - `install()` — fetches the config from Brandfine, then\n   *    injects. Reflects enable/disable state on next page load.\n   *  - `install({ config })` — uses caller-provided config, skips\n   *    the fetch. Faster, no round-trip; ignores Brandfine state\n   *    changes until the consumer's next deploy.\n   *\n   * Returns details about what happened:\n   *  - `{ installed: true, websiteId }` — script was just injected.\n   *  - `{ installed: false, reason: 'disabled' }` — config says\n   *    analytics is off; no-op.\n   *  - `{ installed: false, reason: 'ssr' }` — no `document` in\n   *    scope (server-side). Call again on the client.\n   *  - `{ installed: false, reason: 'already-installed' }` — a\n   *    prior call (or another tab in the same SPA) already injected.\n   *\n   * Throws `BrandfineApiError` on non-2xx responses other than the\n   * disabled case (which is a valid `{ enabled: false }` body).\n   */\n  install: (opts?: InstallOptions) => Promise<AnalyticsInstallResult>\n\n  /** Lower-level helper — fetches the raw config without touching\n   *  the DOM. Useful when you want to inject the script yourself\n   *  (e.g. via a framework's <Script> component for nonce/csp). */\n  getConfig: () => Promise<AnalyticsConfig>\n}\n\n/** Attribute we stamp on the injected <script> so `install()` is\n *  idempotent across re-renders and SPA route changes. */\nconst INSTALLED_MARKER = 'data-brandfine-analytics'\n\nconst DEFAULT_USER_AGENT = '@brandfine/client'\n\nexport function createBrandfineClient(\n  config: BrandfineClientConfig,\n): BrandfineClient {\n  if (!config.baseUrl)\n    throw new Error('createBrandfineClient: `baseUrl` is required')\n  if (!config.apiKey)\n    throw new Error('createBrandfineClient: `apiKey` is required')\n\n  const baseUrl = config.baseUrl.replace(/\\/$/, '')\n  const apiKey = config.apiKey\n  // Resolve fetch lazily so consumers in environments without a\n  // global fetch can polyfill before constructing the client.\n  const fetchImpl: typeof fetch = config.fetch ?? globalThis.fetch\n  const userAgent = config.userAgent ?? DEFAULT_USER_AGENT\n\n  async function get<T>(path: string, opts: RequestOptions = {}): Promise<T> {\n    const url = `${baseUrl}${path}`\n    const res = await fetchImpl(url, {\n      method: 'GET',\n      headers: {\n        'X-Api-Key': apiKey,\n        Accept: 'application/json',\n        'User-Agent': userAgent,\n      },\n      signal: opts.signal,\n    })\n    if (res.status === 404 && opts.nullable404) {\n      // Drain the body so the underlying socket can be reused —\n      // fetch implementations that don't auto-drain (older Node)\n      // can leak otherwise.\n      await res.text().catch(() => '')\n      return null as T\n    }\n    if (!res.ok) {\n      const body = await res.text().catch(() => '')\n      throw new BrandfineApiError({\n        status: res.status,\n        statusText: res.statusText,\n        body,\n        url,\n      })\n    }\n    return (await res.json()) as T\n  }\n\n  const posts: PostsApi = {\n    async list<TConfig = unknown>(opts: ListPostsOptions = {}) {\n      const out: BrandfinePost<TConfig>[] = []\n      let page = 1\n      const typeQuery = opts.type ? `&type=${encodeURIComponent(opts.type)}` : ''\n      const localeQuery = opts.locale\n        ? `&locale=${encodeURIComponent(opts.locale)}`\n        : ''\n      // Default pagination at the cms's 50-per-page cap. `forceLimit`\n      // opts past it for content types that would otherwise need\n      // many round-trips.\n      const sizeQuery = opts.forceLimit\n        ? `&force_limit=${opts.forceLimit}`\n        : '&limit=50'\n      // Pathological safety brake — 200 pages × 50 = 10k posts. If\n      // a workspace ever needs more, callers should hit the API\n      // directly with their own pagination logic.\n      const MAX_PAGES = 200\n      while (page <= MAX_PAGES) {\n        const data = await get<BrandfinePostListResponse<TConfig>>(\n          `/external/posts?include=content${sizeQuery}&page=${page}${typeQuery}${localeQuery}`,\n        )\n        out.push(...data.items)\n        if (!data.pageInfo.hasNext) break\n        page += 1\n      }\n      return out\n    },\n    async getBySlug<TConfig = unknown>(slug: string) {\n      return get<BrandfinePost<TConfig> | null>(\n        `/external/posts/${encodeURIComponent(slug)}`,\n        { nullable404: true },\n      )\n    },\n  }\n\n  const categories: CategoriesApi = {\n    async list(opts: ListCategoriesOptions = {}) {\n      const qs = opts.locale ? `?locale=${encodeURIComponent(opts.locale)}` : ''\n      const data = await get<{ items: BrandfineCategory[] }>(\n        `/external/categories${qs}`,\n      )\n      return data.items\n    },\n  }\n\n  const workspace: WorkspaceApi = {\n    get<\n      TCustomConfig = Record<string, unknown>,\n      TSchemaOrg = Record<string, unknown>,\n    >() {\n      return get<BrandfineWorkspace<TCustomConfig, TSchemaOrg>>(\n        '/external/workspace',\n      )\n    },\n  }\n\n  const navigations: NavigationsApi = {\n    get<TConfig = unknown>(key: string) {\n      return get<BrandfineNavigation<TConfig> | null>(\n        `/external/navigations/${encodeURIComponent(key)}`,\n        { nullable404: true },\n      )\n    },\n  }\n\n  const analytics: AnalyticsApi = {\n    getConfig() {\n      return get<AnalyticsConfig>('/external/analytics-config')\n    },\n    async install(opts: InstallOptions = {}) {\n      // SSR safety: nothing to inject without a DOM. Consumers\n      // call this from useEffect / onMount, but defensive anyway\n      // (some frameworks still execute the file body on the server).\n      if (typeof document === 'undefined') {\n        return { installed: false, reason: 'ssr' as const }\n      }\n\n      // Use caller-provided config if present (build-time path),\n      // otherwise fetch (runtime path).\n      const cfg = opts.config ?? (await analytics.getConfig())\n      if (!cfg.enabled) {\n        return { installed: false, reason: 'disabled' as const }\n      }\n\n      // Idempotency: a prior call (StrictMode double-invoke, SPA\n      // re-mount, second instance with the same workspace) may\n      // have already injected. The marker attribute is the source\n      // of truth — checking by script src would also miss the case\n      // where two workspaces share the same scriptUrl.\n      const existing = document.querySelector<HTMLScriptElement>(\n        `script[${INSTALLED_MARKER}=\"${cfg.websiteId}\"]`,\n      )\n      if (existing) {\n        return { installed: false, reason: 'already-installed' as const }\n      }\n\n      const script = document.createElement('script')\n      script.defer = true\n      script.src = cfg.scriptUrl\n      script.setAttribute('data-website-id', cfg.websiteId)\n      // The marker doubles as a sentinel + a debug aid (you can\n      // grep the DOM for `data-brandfine-analytics` to confirm\n      // an install).\n      script.setAttribute(INSTALLED_MARKER, cfg.websiteId)\n      document.head.appendChild(script)\n      return { installed: true, websiteId: cfg.websiteId }\n    },\n  }\n\n  const submissions: SubmissionsApi = {\n    async create(input: CreateSubmissionInput) {\n      const url = `${baseUrl}/external/submissions`\n      const res = await fetchImpl(url, {\n        method: 'POST',\n        headers: {\n          'X-Api-Key': apiKey,\n          'Content-Type': 'application/json',\n          Accept: 'application/json',\n          'User-Agent': userAgent,\n        },\n        body: JSON.stringify(input),\n      })\n      if (!res.ok) {\n        const body = await res.text().catch(() => '')\n        throw new BrandfineApiError({\n          status: res.status,\n          statusText: res.statusText,\n          body,\n          url,\n        })\n      }\n      return (await res.json()) as Submission\n    },\n  }\n\n  /**\n   * Shared POST helper for the appointments namespace. The main\n   * `get()` helper handles GETs; submissions has its own inline\n   * POST because it predates this refactor. New plugin namespaces\n   * (appointments first, others to follow) share this one so the\n   * error-handling shape stays consistent.\n   */\n  async function post<T>(\n    path: string,\n    body: unknown,\n    opts: RequestOptions = {},\n  ): Promise<T> {\n    const url = `${baseUrl}${path}`\n    const res = await fetchImpl(url, {\n      method: 'POST',\n      headers: {\n        'X-Api-Key': apiKey,\n        'Content-Type': 'application/json',\n        Accept: 'application/json',\n        'User-Agent': userAgent,\n      },\n      body: JSON.stringify(body),\n      signal: opts.signal,\n    })\n    if (!res.ok) {\n      const errBody = await res.text().catch(() => '')\n      throw new BrandfineApiError({\n        status: res.status,\n        statusText: res.statusText,\n        body: errBody,\n        url,\n      })\n    }\n    if (res.status === 204) return undefined as T\n    return (await res.json()) as T\n  }\n\n  const appointments: AppointmentsApi = {\n    getAvailability(opts = {}) {\n      const qs: string[] = []\n      if (opts.from) qs.push(`from=${encodeURIComponent(toIso(opts.from))}`)\n      if (opts.to) qs.push(`to=${encodeURIComponent(toIso(opts.to))}`)\n      const suffix = qs.length ? `?${qs.join('&')}` : ''\n      return get<AppointmentAvailability>(\n        `/external/appointments/availability${suffix}`,\n      )\n    },\n    createRequest(input) {\n      return post<CreatedAppointmentRequest>(\n        '/external/appointments/requests',\n        input,\n      )\n    },\n    getByCancellationToken(token) {\n      return get<AppointmentRequestSummary>(\n        `/external/appointments/requests/${encodeURIComponent(token)}`,\n      )\n    },\n    cancelByToken(token) {\n      return post<{ id: string; status: 'CANCELLED' }>(\n        `/external/appointments/requests/${encodeURIComponent(token)}/cancel`,\n        {},\n      )\n    },\n  }\n\n  return {\n    get,\n    posts,\n    categories,\n    workspace,\n    navigations,\n    analytics,\n    submissions,\n    appointments,\n  }\n}\n\n/** Accepts a Date or an already-ISO string and returns ISO. Saves\n *  every caller from `.toISOString()`-ing manually. */\nfunction toIso(d: Date | string): string {\n  return typeof d === 'string' ? d : d.toISOString()\n}\n","/**\n * @brandfine/client — root entry.\n *\n * The full SDK surface is exposed here for \"import everything from\n * one place\" usage. Tree-shaking + `sideEffects: false` mean\n * consumers don't pay a bundle cost for what they don't import.\n *\n * Heavier or framework-coupled pieces still live under subpath\n * exports (`@brandfine/client/cache`, `/resolvers`, `/webhook`) so\n * consumers with poor tree-shaking — or who only need one slice —\n * can scope their imports.\n */\n\nexport const SDK_VERSION = '0.0.0' as const\n\nexport {\n  BrandfineApiError,\n  createBrandfineClient,\n  type AnalyticsConfig,\n  type AnalyticsInstallResult,\n  type BrandfineClient,\n  type BrandfineClientConfig,\n  type CreateSubmissionInput,\n  type InstallOptions,\n  type Submission,\n} from './client'\n\nexport {\n  createCache,\n  createKeyedCache,\n  type Cache,\n  type CacheOptions,\n  type KeyedCache,\n  type KeyedCacheOptions,\n} from './cache/index'\n\nexport {\n  isLocale,\n  localizePath,\n  pickLocale,\n  resolveNavigation,\n  stripLocalePrefix,\n  type HydratedNav,\n  type HydratedNavItem,\n  type LocaleOptions,\n  type ResolveNavigationOptions,\n} from './resolvers/index'\n\nexport {\n  createBrandfineWebhookHandler,\n  parseWebhookPayload,\n  verifyWebhookSecret,\n  type BrandfineWebhookEvent,\n  type BrandfineWebhookHandlerOptions,\n  type BrandfineWebhookPayload,\n} from './webhook/index'\n\nexport type {\n  BrandfineCategory,\n  BrandfineNavItem,\n  BrandfineNavItemType,\n  BrandfineNavPost,\n  BrandfineNavigation,\n  BrandfinePost,\n  BrandfinePostListResponse,\n  BrandfinePostTranslation,\n  BrandfineWorkspace,\n  ListCategoriesOptions,\n  ListPostsOptions,\n} from './types'\n"]}

package/dist/index.d.cts

@@ -68,6 +68,7 @@ type BrandfineClient = {
     navigations: NavigationsApi;
     analytics: AnalyticsApi;
     submissions: SubmissionsApi;
+    appointments: AppointmentsApi;
 };
 type PostsApi = {
     /** Paginated list of published posts. Handles the cms's
@@ -125,6 +126,96 @@ type SubmissionsApi = {
      */
     create: (input: CreateSubmissionInput) => Promise<Submission>;
 };
+type AppointmentSlot = {
+    /** UTC ISO 8601 timestamp of the slot start. */
+    start: string;
+    /** UTC ISO 8601 timestamp of the slot end. */
+    end: string;
+};
+type AppointmentAvailability = {
+    /** False = plugin not activated, or activation row's `enabled`
+     *  flag is off. Widgets should render a "not accepting bookings"
+     *  state, not throw. */
+    enabled: boolean;
+    /** Source-of-truth IANA timezone for the workspace's business
+     *  hours. Visitors see slots in their local TZ — use this for
+     *  the "(workspace local: HH:MM)" subtext. */
+    timezone: string;
+    slotDurationMinutes: number;
+    leadTimeHours: number;
+    bookingWindowDays: number;
+    policyText: string | null;
+    slots: AppointmentSlot[];
+    /** UTC ISO 8601. Useful for the widget's date range label. */
+    windowStart: string;
+    windowEnd: string;
+};
+type CreateAppointmentRequestInput = {
+    visitorName: string;
+    visitorEmail: string;
+    visitorPhone?: string;
+    visitorMessage?: string;
+    /** UTC ISO 8601 of the requested slot start. Server re-validates
+     *  against business hours + busy ranges before accepting. */
+    requestedAt: string;
+    /** Optional cookie-derived session id from the consumer site. */
+    visitorSessionId?: string;
+};
+type CreatedAppointmentRequest = {
+    id: string;
+    createdAt: string;
+    requestedAt: string;
+    durationMinutes: number;
+    status: 'PENDING';
+    /** Visitor's self-cancel token. Embed it in confirmation
+     *  emails / on-page UI so the visitor can cancel without an
+     *  account. One-time use; revoked once any party acts. */
+    cancellationToken: string | null;
+};
+type AppointmentRequestSummary = {
+    id: string;
+    visitorName: string;
+    visitorEmail: string;
+    requestedAt: string;
+    durationMinutes: number;
+    status: 'PENDING' | 'CONFIRMED' | 'REJECTED' | 'CANCELLED';
+    workspace: {
+        name: string;
+        slug: string;
+    };
+};
+type AppointmentsApi = {
+    /**
+     * Available slots for the workspace's booking window.
+     * `from` / `to` are optional clamps inside the workspace's
+     * configured window — the server ignores ranges outside.
+     */
+    getAvailability: (opts?: {
+        from?: Date | string;
+        to?: Date | string;
+    }) => Promise<AppointmentAvailability>;
+    /**
+     * Submit a visitor's appointment request. Returns the created
+     * row + a one-time cancellation token. Server-side validates
+     * the slot is still bookable; if it isn't, throws
+     * `BrandfineApiError` with status 404 / 409.
+     */
+    createRequest: (input: CreateAppointmentRequestInput) => Promise<CreatedAppointmentRequest>;
+    /**
+     * Look up an appointment by its cancellation token. Used by
+     * the widget's `?bf-cancel=<token>` URL flow to render a
+     * confirmation page before the visitor cancels.
+     */
+    getByCancellationToken: (token: string) => Promise<AppointmentRequestSummary>;
+    /**
+     * Visitor self-cancellation. The token is revoked after the
+     * call succeeds; subsequent calls return 400.
+     */
+    cancelByToken: (token: string) => Promise<{
+        id: string;
+        status: 'CANCELLED';
+    }>;
+};
 type AnalyticsConfig = {
     enabled: false;
 } | {

package/dist/index.d.ts

@@ -68,6 +68,7 @@ type BrandfineClient = {
     navigations: NavigationsApi;
     analytics: AnalyticsApi;
     submissions: SubmissionsApi;
+    appointments: AppointmentsApi;
 };
 type PostsApi = {
     /** Paginated list of published posts. Handles the cms's
@@ -125,6 +126,96 @@ type SubmissionsApi = {
      */
     create: (input: CreateSubmissionInput) => Promise<Submission>;
 };
+type AppointmentSlot = {
+    /** UTC ISO 8601 timestamp of the slot start. */
+    start: string;
+    /** UTC ISO 8601 timestamp of the slot end. */
+    end: string;
+};
+type AppointmentAvailability = {
+    /** False = plugin not activated, or activation row's `enabled`
+     *  flag is off. Widgets should render a "not accepting bookings"
+     *  state, not throw. */
+    enabled: boolean;
+    /** Source-of-truth IANA timezone for the workspace's business
+     *  hours. Visitors see slots in their local TZ — use this for
+     *  the "(workspace local: HH:MM)" subtext. */
+    timezone: string;
+    slotDurationMinutes: number;
+    leadTimeHours: number;
+    bookingWindowDays: number;
+    policyText: string | null;
+    slots: AppointmentSlot[];
+    /** UTC ISO 8601. Useful for the widget's date range label. */
+    windowStart: string;
+    windowEnd: string;
+};
+type CreateAppointmentRequestInput = {
+    visitorName: string;
+    visitorEmail: string;
+    visitorPhone?: string;
+    visitorMessage?: string;
+    /** UTC ISO 8601 of the requested slot start. Server re-validates
+     *  against business hours + busy ranges before accepting. */
+    requestedAt: string;
+    /** Optional cookie-derived session id from the consumer site. */
+    visitorSessionId?: string;
+};
+type CreatedAppointmentRequest = {
+    id: string;
+    createdAt: string;
+    requestedAt: string;
+    durationMinutes: number;
+    status: 'PENDING';
+    /** Visitor's self-cancel token. Embed it in confirmation
+     *  emails / on-page UI so the visitor can cancel without an
+     *  account. One-time use; revoked once any party acts. */
+    cancellationToken: string | null;
+};
+type AppointmentRequestSummary = {
+    id: string;
+    visitorName: string;
+    visitorEmail: string;
+    requestedAt: string;
+    durationMinutes: number;
+    status: 'PENDING' | 'CONFIRMED' | 'REJECTED' | 'CANCELLED';
+    workspace: {
+        name: string;
+        slug: string;
+    };
+};
+type AppointmentsApi = {
+    /**
+     * Available slots for the workspace's booking window.
+     * `from` / `to` are optional clamps inside the workspace's
+     * configured window — the server ignores ranges outside.
+     */
+    getAvailability: (opts?: {
+        from?: Date | string;
+        to?: Date | string;
+    }) => Promise<AppointmentAvailability>;
+    /**
+     * Submit a visitor's appointment request. Returns the created
+     * row + a one-time cancellation token. Server-side validates
+     * the slot is still bookable; if it isn't, throws
+     * `BrandfineApiError` with status 404 / 409.
+     */
+    createRequest: (input: CreateAppointmentRequestInput) => Promise<CreatedAppointmentRequest>;
+    /**
+     * Look up an appointment by its cancellation token. Used by
+     * the widget's `?bf-cancel=<token>` URL flow to render a
+     * confirmation page before the visitor cancels.
+     */
+    getByCancellationToken: (token: string) => Promise<AppointmentRequestSummary>;
+    /**
+     * Visitor self-cancellation. The token is revoked after the
+     * call succeeds; subsequent calls return 400.
+     */
+    cancelByToken: (token: string) => Promise<{
+        id: string;
+        status: 'CANCELLED';
+    }>;
+};
 type AnalyticsConfig = {
     enabled: false;
 } | {

package/dist/index.js

@@ -1,6 +1,6 @@
 export { createCache, createKeyedCache } from './chunk-DHQHUIFO.js';
-export { createBrandfineWebhookHandler, parseWebhookPayload, verifyWebhookSecret } from './chunk-QQLAYITF.js';
 export { isLocale, localizePath, pickLocale, resolveNavigation, stripLocalePrefix } from './chunk-U6VJX7PP.js';
+export { createBrandfineWebhookHandler, parseWebhookPayload, verifyWebhookSecret } from './chunk-QQLAYITF.js';
 
 // src/client.ts
 var BrandfineApiError = class extends Error {
@@ -157,6 +157,59 @@ function createBrandfineClient(config) {
       return await res.json();
     }
   };
+  async function post(path, body, opts = {}) {
+    const url = `${baseUrl}${path}`;
+    const res = await fetchImpl(url, {
+      method: "POST",
+      headers: {
+        "X-Api-Key": apiKey,
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "User-Agent": userAgent
+      },
+      body: JSON.stringify(body),
+      signal: opts.signal
+    });
+    if (!res.ok) {
+      const errBody = await res.text().catch(() => "");
+      throw new BrandfineApiError({
+        status: res.status,
+        statusText: res.statusText,
+        body: errBody,
+        url
+      });
+    }
+    if (res.status === 204) return void 0;
+    return await res.json();
+  }
+  const appointments = {
+    getAvailability(opts = {}) {
+      const qs = [];
+      if (opts.from) qs.push(`from=${encodeURIComponent(toIso(opts.from))}`);
+      if (opts.to) qs.push(`to=${encodeURIComponent(toIso(opts.to))}`);
+      const suffix = qs.length ? `?${qs.join("&")}` : "";
+      return get(
+        `/external/appointments/availability${suffix}`
+      );
+    },
+    createRequest(input) {
+      return post(
+        "/external/appointments/requests",
+        input
+      );
+    },
+    getByCancellationToken(token) {
+      return get(
+        `/external/appointments/requests/${encodeURIComponent(token)}`
+      );
+    },
+    cancelByToken(token) {
+      return post(
+        `/external/appointments/requests/${encodeURIComponent(token)}/cancel`,
+        {}
+      );
+    }
+  };
   return {
     get,
     posts,
@@ -164,9 +217,13 @@ function createBrandfineClient(config) {
     workspace,
     navigations,
     analytics,
-    submissions
+    submissions,
+    appointments
   };
 }
+function toIso(d) {
+  return typeof d === "string" ? d : d.toISOString();
+}
 
 // src/index.ts
 var SDK_VERSION = "0.0.0";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.ts","../src/index.ts"],"names":[],"mappings":";;;;;AA8CO,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAA,EACzB,IAAA,GAAO,mBAAA;AAAA,EAChB,MAAA;AAAA,EACA,UAAA;AAAA,EACA,IAAA;AAAA,EACA,GAAA;AAAA,EAET,YAAY,IAAA,EAKT;AACD,IAAA,KAAA;AAAA,MACE,CAAA,YAAA,EAAe,IAAA,CAAK,MAAM,CAAA,CAAA,EAAI,KAAK,UAAU,CAAA,IAAA,EAAO,IAAA,CAAK,GAAG,WAAM,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,KAC3F;AACA,IAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACnB,IAAA,IAAA,CAAK,aAAa,IAAA,CAAK,UAAA;AACvB,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA;AAAA,EAClB;AACF;AAgKA,IAAM,gBAAA,GAAmB,0BAAA;AAEzB,IAAM,kBAAA,GAAqB,mBAAA;AAEpB,SAAS,sBACd,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA;AACV,IAAA,MAAM,IAAI,MAAM,8CAA8C,CAAA;AAChE,EAAA,IAAI,CAAC,MAAA,CAAO,MAAA;AACV,IAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAE/D,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAChD,EAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AAGtB,EAAA,MAAM,SAAA,GAA0B,MAAA,CAAO,KAAA,IAAS,UAAA,CAAW,KAAA;AAC3D,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,kBAAA;AAEtC,EAAA,eAAe,GAAA,CAAO,IAAA,EAAc,IAAA,GAAuB,EAAC,EAAe;AACzE,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,GAAA,EAAK;AAAA,MAC/B,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,WAAA,EAAa,MAAA;AAAA,QACb,MAAA,EAAQ,kBAAA;AAAA,QACR,YAAA,EAAc;AAAA,OAChB;AAAA,MACA,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AACD,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,IAAA,CAAK,WAAA,EAAa;AAI1C,MAAA,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC/B,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,MAAA,MAAM,IAAI,iBAAA,CAAkB;AAAA,QAC1B,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,YAAY,GAAA,CAAI,UAAA;AAAA,QAChB,IAAA;AAAA,QACA;AAAA,OACD,CAAA;AAAA,IACH;AACA,IAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,EACzB;AAEA,EAAA,MAAM,KAAA,GAAkB;AAAA,IACtB,MAAM,IAAA,CAAwB,IAAA,GAAyB,EAAC,EAAG;AACzD,MAAA,MAAM,MAAgC,EAAC;AACvC,MAAA,IAAI,IAAA,GAAO,CAAA;AACX,MAAA,MAAM,SAAA,GAAY,KAAK,IAAA,GAAO,CAAA,MAAA,EAAS,mBAAmB,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAAK,EAAA;AACzE,MAAA,MAAM,WAAA,GAAc,KAAK,MAAA,GACrB,CAAA,QAAA,EAAW,mBAAmB,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA,GAC1C,EAAA;AAIJ,MAAA,MAAM,YAAY,IAAA,CAAK,UAAA,GACnB,CAAA,aAAA,EAAgB,IAAA,CAAK,UAAU,CAAA,CAAA,GAC/B,WAAA;AAIJ,MAAA,MAAM,SAAA,GAAY,GAAA;AAClB,MAAA,OAAO,QAAQ,SAAA,EAAW;AACxB,QAAA,MAAM,OAAO,MAAM,GAAA;AAAA,UACjB,kCAAkC,SAAS,CAAA,MAAA,EAAS,IAAI,CAAA,EAAG,SAAS,GAAG,WAAW,CAAA;AAAA,SACpF;AACA,QAAA,GAAA,CAAI,IAAA,CAAK,GAAG,IAAA,CAAK,KAAK,CAAA;AACtB,QAAA,IAAI,CAAC,IAAA,CAAK,QAAA,CAAS,OAAA,EAAS;AAC5B,QAAA,IAAA,IAAQ,CAAA;AAAA,MACV;AACA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAM,UAA6B,IAAA,EAAc;AAC/C,MAAA,OAAO,GAAA;AAAA,QACL,CAAA,gBAAA,EAAmB,kBAAA,CAAmB,IAAI,CAAC,CAAA,CAAA;AAAA,QAC3C,EAAE,aAAa,IAAA;AAAK,OACtB;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAM,UAAA,GAA4B;AAAA,IAChC,MAAM,IAAA,CAAK,IAAA,GAA8B,EAAC,EAAG;AAC3C,MAAA,MAAM,EAAA,GAAK,KAAK,MAAA,GAAS,CAAA,QAAA,EAAW,mBAAmB,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA,GAAK,EAAA;AACxE,MAAA,MAAM,OAAO,MAAM,GAAA;AAAA,QACjB,uBAAuB,EAAE,CAAA;AAAA,OAC3B;AACA,MAAA,OAAO,IAAA,CAAK,KAAA;AAAA,IACd;AAAA,GACF;AAEA,EAAA,MAAM,SAAA,GAA0B;AAAA,IAC9B,GAAA,GAGI;AACF,MAAA,OAAO,GAAA;AAAA,QACL;AAAA,OACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAM,WAAA,GAA8B;AAAA,IAClC,IAAuB,GAAA,EAAa;AAClC,MAAA,OAAO,GAAA;AAAA,QACL,CAAA,sBAAA,EAAyB,kBAAA,CAAmB,GAAG,CAAC,CAAA,CAAA;AAAA,QAChD,EAAE,aAAa,IAAA;AAAK,OACtB;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAM,SAAA,GAA0B;AAAA,IAC9B,SAAA,GAAY;AACV,MAAA,OAAO,IAAqB,4BAA4B,CAAA;AAAA,IAC1D,CAAA;AAAA,IACA,MAAM,OAAA,CAAQ,IAAA,GAAuB,EAAC,EAAG;AAIvC,MAAA,IAAI,OAAO,aAAa,WAAA,EAAa;AACnC,QAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAe;AAAA,MACpD;AAIA,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,MAAA,IAAW,MAAM,UAAU,SAAA,EAAU;AACtD,MAAA,IAAI,CAAC,IAAI,OAAA,EAAS;AAChB,QAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAoB;AAAA,MACzD;AAOA,MAAA,MAAM,WAAW,QAAA,CAAS,aAAA;AAAA,QACxB,CAAA,OAAA,EAAU,gBAAgB,CAAA,EAAA,EAAK,GAAA,CAAI,SAAS,CAAA,EAAA;AAAA,OAC9C;AACA,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAA6B;AAAA,MAClE;AAEA,MAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,MAAA,MAAA,CAAO,KAAA,GAAQ,IAAA;AACf,MAAA,MAAA,CAAO,MAAM,GAAA,CAAI,SAAA;AACjB,MAAA,MAAA,CAAO,YAAA,CAAa,iBAAA,EAAmB,GAAA,CAAI,SAAS,CAAA;AAIpD,MAAA,MAAA,CAAO,YAAA,CAAa,gBAAA,EAAkB,GAAA,CAAI,SAAS,CAAA;AACnD,MAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAChC,MAAA,OAAO,EAAE,SAAA,EAAW,IAAA,EAAM,SAAA,EAAW,IAAI,SAAA,EAAU;AAAA,IACrD;AAAA,GACF;AAEA,EAAA,MAAM,WAAA,GAA8B;AAAA,IAClC,MAAM,OAAO,KAAA,EAA8B;AACzC,MAAA,MAAM,GAAA,GAAM,GAAG,OAAO,CAAA,qBAAA,CAAA;AACtB,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,GAAA,EAAK;AAAA,QAC/B,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,WAAA,EAAa,MAAA;AAAA,UACb,cAAA,EAAgB,kBAAA;AAAA,UAChB,MAAA,EAAQ,kBAAA;AAAA,UACR,YAAA,EAAc;AAAA,SAChB;AAAA,QACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAK;AAAA,OAC3B,CAAA;AACD,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,QAAA,MAAM,IAAI,iBAAA,CAAkB;AAAA,UAC1B,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,YAAY,GAAA,CAAI,UAAA;AAAA,UAChB,IAAA;AAAA,UACA;AAAA,SACD,CAAA;AAAA,MACH;AACA,MAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB;AAAA,GACF;AAEA,EAAA,OAAO;AAAA,IACL,GAAA;AAAA,IACA,KAAA;AAAA,IACA,UAAA;AAAA,IACA,SAAA;AAAA,IACA,WAAA;AAAA,IACA,SAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACxZO,IAAM,WAAA,GAAc","file":"index.js","sourcesContent":["/**\n * `createBrandfineClient` — the SDK's entry point.\n *\n * Returns a stateless, multi-instance-safe handle scoped to a\n * single `(baseUrl, apiKey)` pair. Pattern follows the Stripe /\n * Algolia / OpenAI SDKs — explicit construction with config,\n * namespaced methods (`bf.posts.list(...)`, `bf.workspace.get()`),\n * no module-level singletons.\n *\n * Why factory not module-level state: multi-tenant consumers\n * sometimes need two clients in the same process (e.g. main site\n * + admin preview). Module-level env reading makes that impossible\n * without monkey-patching.\n */\n\nimport type {\n  BrandfineCategory,\n  BrandfineNavigation,\n  BrandfinePost,\n  BrandfinePostListResponse,\n  BrandfineWorkspace,\n  ListCategoriesOptions,\n  ListPostsOptions,\n} from './types'\n\nexport type BrandfineClientConfig = {\n  /** Base URL of the Brandfine API. No trailing slash — the client\n   *  trims one if you pass it anyway. e.g. `https://api.brandfine.co` */\n  baseUrl: string\n  /** Workspace-scoped API key. Generated from the cms's Workspace\n   *  settings; identifies which workspace the client talks to. */\n  apiKey: string\n  /** Optional fetch override. Useful for tests (inject a stub),\n   *  for runtimes that need a custom implementation (edge workers\n   *  with non-standard fetch), or to add cross-cutting concerns\n   *  like tracing / retries. Defaults to `globalThis.fetch`. */\n  fetch?: typeof globalThis.fetch\n  /** Optional User-Agent header. Falls back to a generic SDK tag. */\n  userAgent?: string\n}\n\n/**\n * Structured error thrown by every request helper on non-2xx\n * responses. Carries the raw body so consumers can log it for\n * debugging without re-fetching.\n */\nexport class BrandfineApiError extends Error {\n  override readonly name = 'BrandfineApiError'\n  readonly status: number\n  readonly statusText: string\n  readonly body: string\n  readonly url: string\n\n  constructor(args: {\n    status: number\n    statusText: string\n    body: string\n    url: string\n  }) {\n    super(\n      `[brandfine] ${args.status} ${args.statusText} on ${args.url} — ${args.body.slice(0, 200)}`,\n    )\n    this.status = args.status\n    this.statusText = args.statusText\n    this.body = args.body\n    this.url = args.url\n  }\n}\n\ntype RequestOptions = {\n  /** When true and the response is 404, return `null` instead of\n   *  throwing. Used by endpoints where 404 is a meaningful empty\n   *  state (navigation by key, single post by slug). */\n  nullable404?: boolean\n  signal?: AbortSignal\n}\n\nexport type BrandfineClient = {\n  /** Low-level GET. Reserved for endpoints we don't have a typed\n   *  helper for yet. Adds the X-Api-Key header automatically. */\n  get: <T>(path: string, opts?: RequestOptions) => Promise<T>\n  posts: PostsApi\n  categories: CategoriesApi\n  workspace: WorkspaceApi\n  navigations: NavigationsApi\n  analytics: AnalyticsApi\n  submissions: SubmissionsApi\n}\n\ntype PostsApi = {\n  /** Paginated list of published posts. Handles the cms's\n   *  pagination transparently — caller gets a flat array. */\n  list: <TConfig = unknown>(\n    opts?: ListPostsOptions,\n  ) => Promise<BrandfinePost<TConfig>[]>\n  /** Single post by per-locale URL slug, scoped to the active\n   *  locale on the workspace's content. Returns `null` for 404 so\n   *  callers can render their own \"not found\" page without try/catch. */\n  getBySlug: <TConfig = unknown>(\n    slug: string,\n  ) => Promise<BrandfinePost<TConfig> | null>\n}\n\ntype CategoriesApi = {\n  list: (opts?: ListCategoriesOptions) => Promise<BrandfineCategory[]>\n}\n\ntype WorkspaceApi = {\n  get: <\n    TCustomConfig = Record<string, unknown>,\n    TSchemaOrg = Record<string, unknown>,\n  >() => Promise<BrandfineWorkspace<TCustomConfig, TSchemaOrg>>\n}\n\ntype NavigationsApi = {\n  /** Navigation by its workspace-scoped `key` (e.g. `'header'`).\n   *  Returns `null` for 404 so consumers can fall back to a\n   *  hardcoded default without try/catch. `TConfig` narrows each\n   *  item's `customConfig` (default `unknown`). */\n  get: <TConfig = unknown>(\n    key: string,\n  ) => Promise<BrandfineNavigation<TConfig> | null>\n}\n\nexport type CreateSubmissionInput = {\n  /** Required. Display name of the submitter. */\n  name: string\n  /** Required. Validated server-side. */\n  email: string\n  /** Optional. Free-text up to 40 chars. */\n  phone?: string\n  /** Optional. Free-text up to 200 chars. */\n  subject?: string\n  /** Required. The message body — up to 10,000 chars. */\n  message: string\n  /** Optional. Where the submission came from — e.g. a route path\n   *  like `/contact`, or a marketing campaign label. Up to 500 chars. */\n  source?: string\n  /** Optional. Free-form JSON metadata the consumer attaches; the\n   *  cms surfaces it verbatim in the submissions admin view. */\n  metadata?: Record<string, unknown>\n}\n\nexport type Submission = {\n  id: string\n  createdAt: string\n}\n\ntype SubmissionsApi = {\n  /**\n   * Posts a contact-form submission to `POST /external/submissions`\n   * for this workspace. The cms surfaces the submission in the\n   * Submissions inbox.\n   *\n   * Throws `BrandfineApiError` on validation failures (400) or\n   * any other non-2xx — caller decides whether to surface that as\n   * a user-visible error or a silent retry.\n   */\n  create: (input: CreateSubmissionInput) => Promise<Submission>\n}\n\nexport type AnalyticsConfig =\n  | { enabled: false }\n  | { enabled: true; websiteId: string; scriptUrl: string }\n\nexport type AnalyticsInstallResult =\n  | { installed: false; reason: 'disabled' | 'ssr' | 'already-installed' }\n  | { installed: true; websiteId: string }\n\nexport type InstallOptions = {\n  /**\n   * Pre-known config. When provided, `install()` skips the round-\n   * trip to `/external/analytics-config` and injects the script\n   * immediately. Use this when you've baked the values into your\n   * build (env vars, CMS-side config dump, etc.) — typical for\n   * static sites where the analytics state is decided at deploy\n   * time, not per page load.\n   *\n   * Trade-off vs the default fetch path: if you disable analytics\n   * in Brandfine, the tracker keeps loading until your next\n   * deploy. That's usually the right trade for static sites\n   * (which redeploy on every content change anyway) and the wrong\n   * trade for dynamic sites where the api round-trip is cheap\n   * relative to the rest of the page.\n   *\n   * Pass `{ enabled: false }` to force a no-op without touching\n   * the api (e.g. to disable analytics for one environment without\n   * changing Brandfine's state).\n   */\n  config?: AnalyticsConfig\n}\n\ntype AnalyticsApi = {\n  /**\n   * Injects the Brandfine analytics tracker into `document.head`\n   * once. Safe to call on every page load — idempotent via a\n   * marker attribute on the injected script tag.\n   *\n   * Two paths:\n   *  - `install()` — fetches the config from Brandfine, then\n   *    injects. Reflects enable/disable state on next page load.\n   *  - `install({ config })` — uses caller-provided config, skips\n   *    the fetch. Faster, no round-trip; ignores Brandfine state\n   *    changes until the consumer's next deploy.\n   *\n   * Returns details about what happened:\n   *  - `{ installed: true, websiteId }` — script was just injected.\n   *  - `{ installed: false, reason: 'disabled' }` — config says\n   *    analytics is off; no-op.\n   *  - `{ installed: false, reason: 'ssr' }` — no `document` in\n   *    scope (server-side). Call again on the client.\n   *  - `{ installed: false, reason: 'already-installed' }` — a\n   *    prior call (or another tab in the same SPA) already injected.\n   *\n   * Throws `BrandfineApiError` on non-2xx responses other than the\n   * disabled case (which is a valid `{ enabled: false }` body).\n   */\n  install: (opts?: InstallOptions) => Promise<AnalyticsInstallResult>\n\n  /** Lower-level helper — fetches the raw config without touching\n   *  the DOM. Useful when you want to inject the script yourself\n   *  (e.g. via a framework's <Script> component for nonce/csp). */\n  getConfig: () => Promise<AnalyticsConfig>\n}\n\n/** Attribute we stamp on the injected <script> so `install()` is\n *  idempotent across re-renders and SPA route changes. */\nconst INSTALLED_MARKER = 'data-brandfine-analytics'\n\nconst DEFAULT_USER_AGENT = '@brandfine/client'\n\nexport function createBrandfineClient(\n  config: BrandfineClientConfig,\n): BrandfineClient {\n  if (!config.baseUrl)\n    throw new Error('createBrandfineClient: `baseUrl` is required')\n  if (!config.apiKey)\n    throw new Error('createBrandfineClient: `apiKey` is required')\n\n  const baseUrl = config.baseUrl.replace(/\\/$/, '')\n  const apiKey = config.apiKey\n  // Resolve fetch lazily so consumers in environments without a\n  // global fetch can polyfill before constructing the client.\n  const fetchImpl: typeof fetch = config.fetch ?? globalThis.fetch\n  const userAgent = config.userAgent ?? DEFAULT_USER_AGENT\n\n  async function get<T>(path: string, opts: RequestOptions = {}): Promise<T> {\n    const url = `${baseUrl}${path}`\n    const res = await fetchImpl(url, {\n      method: 'GET',\n      headers: {\n        'X-Api-Key': apiKey,\n        Accept: 'application/json',\n        'User-Agent': userAgent,\n      },\n      signal: opts.signal,\n    })\n    if (res.status === 404 && opts.nullable404) {\n      // Drain the body so the underlying socket can be reused —\n      // fetch implementations that don't auto-drain (older Node)\n      // can leak otherwise.\n      await res.text().catch(() => '')\n      return null as T\n    }\n    if (!res.ok) {\n      const body = await res.text().catch(() => '')\n      throw new BrandfineApiError({\n        status: res.status,\n        statusText: res.statusText,\n        body,\n        url,\n      })\n    }\n    return (await res.json()) as T\n  }\n\n  const posts: PostsApi = {\n    async list<TConfig = unknown>(opts: ListPostsOptions = {}) {\n      const out: BrandfinePost<TConfig>[] = []\n      let page = 1\n      const typeQuery = opts.type ? `&type=${encodeURIComponent(opts.type)}` : ''\n      const localeQuery = opts.locale\n        ? `&locale=${encodeURIComponent(opts.locale)}`\n        : ''\n      // Default pagination at the cms's 50-per-page cap. `forceLimit`\n      // opts past it for content types that would otherwise need\n      // many round-trips.\n      const sizeQuery = opts.forceLimit\n        ? `&force_limit=${opts.forceLimit}`\n        : '&limit=50'\n      // Pathological safety brake — 200 pages × 50 = 10k posts. If\n      // a workspace ever needs more, callers should hit the API\n      // directly with their own pagination logic.\n      const MAX_PAGES = 200\n      while (page <= MAX_PAGES) {\n        const data = await get<BrandfinePostListResponse<TConfig>>(\n          `/external/posts?include=content${sizeQuery}&page=${page}${typeQuery}${localeQuery}`,\n        )\n        out.push(...data.items)\n        if (!data.pageInfo.hasNext) break\n        page += 1\n      }\n      return out\n    },\n    async getBySlug<TConfig = unknown>(slug: string) {\n      return get<BrandfinePost<TConfig> | null>(\n        `/external/posts/${encodeURIComponent(slug)}`,\n        { nullable404: true },\n      )\n    },\n  }\n\n  const categories: CategoriesApi = {\n    async list(opts: ListCategoriesOptions = {}) {\n      const qs = opts.locale ? `?locale=${encodeURIComponent(opts.locale)}` : ''\n      const data = await get<{ items: BrandfineCategory[] }>(\n        `/external/categories${qs}`,\n      )\n      return data.items\n    },\n  }\n\n  const workspace: WorkspaceApi = {\n    get<\n      TCustomConfig = Record<string, unknown>,\n      TSchemaOrg = Record<string, unknown>,\n    >() {\n      return get<BrandfineWorkspace<TCustomConfig, TSchemaOrg>>(\n        '/external/workspace',\n      )\n    },\n  }\n\n  const navigations: NavigationsApi = {\n    get<TConfig = unknown>(key: string) {\n      return get<BrandfineNavigation<TConfig> | null>(\n        `/external/navigations/${encodeURIComponent(key)}`,\n        { nullable404: true },\n      )\n    },\n  }\n\n  const analytics: AnalyticsApi = {\n    getConfig() {\n      return get<AnalyticsConfig>('/external/analytics-config')\n    },\n    async install(opts: InstallOptions = {}) {\n      // SSR safety: nothing to inject without a DOM. Consumers\n      // call this from useEffect / onMount, but defensive anyway\n      // (some frameworks still execute the file body on the server).\n      if (typeof document === 'undefined') {\n        return { installed: false, reason: 'ssr' as const }\n      }\n\n      // Use caller-provided config if present (build-time path),\n      // otherwise fetch (runtime path).\n      const cfg = opts.config ?? (await analytics.getConfig())\n      if (!cfg.enabled) {\n        return { installed: false, reason: 'disabled' as const }\n      }\n\n      // Idempotency: a prior call (StrictMode double-invoke, SPA\n      // re-mount, second instance with the same workspace) may\n      // have already injected. The marker attribute is the source\n      // of truth — checking by script src would also miss the case\n      // where two workspaces share the same scriptUrl.\n      const existing = document.querySelector<HTMLScriptElement>(\n        `script[${INSTALLED_MARKER}=\"${cfg.websiteId}\"]`,\n      )\n      if (existing) {\n        return { installed: false, reason: 'already-installed' as const }\n      }\n\n      const script = document.createElement('script')\n      script.defer = true\n      script.src = cfg.scriptUrl\n      script.setAttribute('data-website-id', cfg.websiteId)\n      // The marker doubles as a sentinel + a debug aid (you can\n      // grep the DOM for `data-brandfine-analytics` to confirm\n      // an install).\n      script.setAttribute(INSTALLED_MARKER, cfg.websiteId)\n      document.head.appendChild(script)\n      return { installed: true, websiteId: cfg.websiteId }\n    },\n  }\n\n  const submissions: SubmissionsApi = {\n    async create(input: CreateSubmissionInput) {\n      const url = `${baseUrl}/external/submissions`\n      const res = await fetchImpl(url, {\n        method: 'POST',\n        headers: {\n          'X-Api-Key': apiKey,\n          'Content-Type': 'application/json',\n          Accept: 'application/json',\n          'User-Agent': userAgent,\n        },\n        body: JSON.stringify(input),\n      })\n      if (!res.ok) {\n        const body = await res.text().catch(() => '')\n        throw new BrandfineApiError({\n          status: res.status,\n          statusText: res.statusText,\n          body,\n          url,\n        })\n      }\n      return (await res.json()) as Submission\n    },\n  }\n\n  return {\n    get,\n    posts,\n    categories,\n    workspace,\n    navigations,\n    analytics,\n    submissions,\n  }\n}\n","/**\n * @brandfine/client — root entry.\n *\n * The full SDK surface is exposed here for \"import everything from\n * one place\" usage. Tree-shaking + `sideEffects: false` mean\n * consumers don't pay a bundle cost for what they don't import.\n *\n * Heavier or framework-coupled pieces still live under subpath\n * exports (`@brandfine/client/cache`, `/resolvers`, `/webhook`) so\n * consumers with poor tree-shaking — or who only need one slice —\n * can scope their imports.\n */\n\nexport const SDK_VERSION = '0.0.0' as const\n\nexport {\n  BrandfineApiError,\n  createBrandfineClient,\n  type AnalyticsConfig,\n  type AnalyticsInstallResult,\n  type BrandfineClient,\n  type BrandfineClientConfig,\n  type CreateSubmissionInput,\n  type InstallOptions,\n  type Submission,\n} from './client'\n\nexport {\n  createCache,\n  createKeyedCache,\n  type Cache,\n  type CacheOptions,\n  type KeyedCache,\n  type KeyedCacheOptions,\n} from './cache/index'\n\nexport {\n  isLocale,\n  localizePath,\n  pickLocale,\n  resolveNavigation,\n  stripLocalePrefix,\n  type HydratedNav,\n  type HydratedNavItem,\n  type LocaleOptions,\n  type ResolveNavigationOptions,\n} from './resolvers/index'\n\nexport {\n  createBrandfineWebhookHandler,\n  parseWebhookPayload,\n  verifyWebhookSecret,\n  type BrandfineWebhookEvent,\n  type BrandfineWebhookHandlerOptions,\n  type BrandfineWebhookPayload,\n} from './webhook/index'\n\nexport type {\n  BrandfineCategory,\n  BrandfineNavItem,\n  BrandfineNavItemType,\n  BrandfineNavPost,\n  BrandfineNavigation,\n  BrandfinePost,\n  BrandfinePostListResponse,\n  BrandfinePostTranslation,\n  BrandfineWorkspace,\n  ListCategoriesOptions,\n  ListPostsOptions,\n} from './types'\n"]}
+{"version":3,"sources":["../src/client.ts","../src/index.ts"],"names":[],"mappings":";;;;;AA8CO,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAA,EACzB,IAAA,GAAO,mBAAA;AAAA,EAChB,MAAA;AAAA,EACA,UAAA;AAAA,EACA,IAAA;AAAA,EACA,GAAA;AAAA,EAET,YAAY,IAAA,EAKT;AACD,IAAA,KAAA;AAAA,MACE,CAAA,YAAA,EAAe,IAAA,CAAK,MAAM,CAAA,CAAA,EAAI,KAAK,UAAU,CAAA,IAAA,EAAO,IAAA,CAAK,GAAG,WAAM,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,KAC3F;AACA,IAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACnB,IAAA,IAAA,CAAK,aAAa,IAAA,CAAK,UAAA;AACvB,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA;AAAA,EAClB;AACF;AAyQA,IAAM,gBAAA,GAAmB,0BAAA;AAEzB,IAAM,kBAAA,GAAqB,mBAAA;AAEpB,SAAS,sBACd,MAAA,EACiB;AACjB,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA;AACV,IAAA,MAAM,IAAI,MAAM,8CAA8C,CAAA;AAChE,EAAA,IAAI,CAAC,MAAA,CAAO,MAAA;AACV,IAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAE/D,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AAChD,EAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AAGtB,EAAA,MAAM,SAAA,GAA0B,MAAA,CAAO,KAAA,IAAS,UAAA,CAAW,KAAA;AAC3D,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,kBAAA;AAEtC,EAAA,eAAe,GAAA,CAAO,IAAA,EAAc,IAAA,GAAuB,EAAC,EAAe;AACzE,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,GAAA,EAAK;AAAA,MAC/B,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,WAAA,EAAa,MAAA;AAAA,QACb,MAAA,EAAQ,kBAAA;AAAA,QACR,YAAA,EAAc;AAAA,OAChB;AAAA,MACA,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AACD,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,IAAA,CAAK,WAAA,EAAa;AAI1C,MAAA,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC/B,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,MAAA,MAAM,IAAI,iBAAA,CAAkB;AAAA,QAC1B,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,YAAY,GAAA,CAAI,UAAA;AAAA,QAChB,IAAA;AAAA,QACA;AAAA,OACD,CAAA;AAAA,IACH;AACA,IAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,EACzB;AAEA,EAAA,MAAM,KAAA,GAAkB;AAAA,IACtB,MAAM,IAAA,CAAwB,IAAA,GAAyB,EAAC,EAAG;AACzD,MAAA,MAAM,MAAgC,EAAC;AACvC,MAAA,IAAI,IAAA,GAAO,CAAA;AACX,MAAA,MAAM,SAAA,GAAY,KAAK,IAAA,GAAO,CAAA,MAAA,EAAS,mBAAmB,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAAK,EAAA;AACzE,MAAA,MAAM,WAAA,GAAc,KAAK,MAAA,GACrB,CAAA,QAAA,EAAW,mBAAmB,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA,GAC1C,EAAA;AAIJ,MAAA,MAAM,YAAY,IAAA,CAAK,UAAA,GACnB,CAAA,aAAA,EAAgB,IAAA,CAAK,UAAU,CAAA,CAAA,GAC/B,WAAA;AAIJ,MAAA,MAAM,SAAA,GAAY,GAAA;AAClB,MAAA,OAAO,QAAQ,SAAA,EAAW;AACxB,QAAA,MAAM,OAAO,MAAM,GAAA;AAAA,UACjB,kCAAkC,SAAS,CAAA,MAAA,EAAS,IAAI,CAAA,EAAG,SAAS,GAAG,WAAW,CAAA;AAAA,SACpF;AACA,QAAA,GAAA,CAAI,IAAA,CAAK,GAAG,IAAA,CAAK,KAAK,CAAA;AACtB,QAAA,IAAI,CAAC,IAAA,CAAK,QAAA,CAAS,OAAA,EAAS;AAC5B,QAAA,IAAA,IAAQ,CAAA;AAAA,MACV;AACA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAM,UAA6B,IAAA,EAAc;AAC/C,MAAA,OAAO,GAAA;AAAA,QACL,CAAA,gBAAA,EAAmB,kBAAA,CAAmB,IAAI,CAAC,CAAA,CAAA;AAAA,QAC3C,EAAE,aAAa,IAAA;AAAK,OACtB;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAM,UAAA,GAA4B;AAAA,IAChC,MAAM,IAAA,CAAK,IAAA,GAA8B,EAAC,EAAG;AAC3C,MAAA,MAAM,EAAA,GAAK,KAAK,MAAA,GAAS,CAAA,QAAA,EAAW,mBAAmB,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA,GAAK,EAAA;AACxE,MAAA,MAAM,OAAO,MAAM,GAAA;AAAA,QACjB,uBAAuB,EAAE,CAAA;AAAA,OAC3B;AACA,MAAA,OAAO,IAAA,CAAK,KAAA;AAAA,IACd;AAAA,GACF;AAEA,EAAA,MAAM,SAAA,GAA0B;AAAA,IAC9B,GAAA,GAGI;AACF,MAAA,OAAO,GAAA;AAAA,QACL;AAAA,OACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAM,WAAA,GAA8B;AAAA,IAClC,IAAuB,GAAA,EAAa;AAClC,MAAA,OAAO,GAAA;AAAA,QACL,CAAA,sBAAA,EAAyB,kBAAA,CAAmB,GAAG,CAAC,CAAA,CAAA;AAAA,QAChD,EAAE,aAAa,IAAA;AAAK,OACtB;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAM,SAAA,GAA0B;AAAA,IAC9B,SAAA,GAAY;AACV,MAAA,OAAO,IAAqB,4BAA4B,CAAA;AAAA,IAC1D,CAAA;AAAA,IACA,MAAM,OAAA,CAAQ,IAAA,GAAuB,EAAC,EAAG;AAIvC,MAAA,IAAI,OAAO,aAAa,WAAA,EAAa;AACnC,QAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAe;AAAA,MACpD;AAIA,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,MAAA,IAAW,MAAM,UAAU,SAAA,EAAU;AACtD,MAAA,IAAI,CAAC,IAAI,OAAA,EAAS;AAChB,QAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,UAAA,EAAoB;AAAA,MACzD;AAOA,MAAA,MAAM,WAAW,QAAA,CAAS,aAAA;AAAA,QACxB,CAAA,OAAA,EAAU,gBAAgB,CAAA,EAAA,EAAK,GAAA,CAAI,SAAS,CAAA,EAAA;AAAA,OAC9C;AACA,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAA6B;AAAA,MAClE;AAEA,MAAA,MAAM,MAAA,GAAS,QAAA,CAAS,aAAA,CAAc,QAAQ,CAAA;AAC9C,MAAA,MAAA,CAAO,KAAA,GAAQ,IAAA;AACf,MAAA,MAAA,CAAO,MAAM,GAAA,CAAI,SAAA;AACjB,MAAA,MAAA,CAAO,YAAA,CAAa,iBAAA,EAAmB,GAAA,CAAI,SAAS,CAAA;AAIpD,MAAA,MAAA,CAAO,YAAA,CAAa,gBAAA,EAAkB,GAAA,CAAI,SAAS,CAAA;AACnD,MAAA,QAAA,CAAS,IAAA,CAAK,YAAY,MAAM,CAAA;AAChC,MAAA,OAAO,EAAE,SAAA,EAAW,IAAA,EAAM,SAAA,EAAW,IAAI,SAAA,EAAU;AAAA,IACrD;AAAA,GACF;AAEA,EAAA,MAAM,WAAA,GAA8B;AAAA,IAClC,MAAM,OAAO,KAAA,EAA8B;AACzC,MAAA,MAAM,GAAA,GAAM,GAAG,OAAO,CAAA,qBAAA,CAAA;AACtB,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,GAAA,EAAK;AAAA,QAC/B,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,WAAA,EAAa,MAAA;AAAA,UACb,cAAA,EAAgB,kBAAA;AAAA,UAChB,MAAA,EAAQ,kBAAA;AAAA,UACR,YAAA,EAAc;AAAA,SAChB;AAAA,QACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAK;AAAA,OAC3B,CAAA;AACD,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,QAAA,MAAM,IAAI,iBAAA,CAAkB;AAAA,UAC1B,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,YAAY,GAAA,CAAI,UAAA;AAAA,UAChB,IAAA;AAAA,UACA;AAAA,SACD,CAAA;AAAA,MACH;AACA,MAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB;AAAA,GACF;AASA,EAAA,eAAe,IAAA,CACb,IAAA,EACA,IAAA,EACA,IAAA,GAAuB,EAAC,EACZ;AACZ,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,GAAA,EAAK;AAAA,MAC/B,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,WAAA,EAAa,MAAA;AAAA,QACb,cAAA,EAAgB,kBAAA;AAAA,QAChB,MAAA,EAAQ,kBAAA;AAAA,QACR,YAAA,EAAc;AAAA,OAChB;AAAA,MACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAAA,MACzB,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AACD,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,UAAU,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC/C,MAAA,MAAM,IAAI,iBAAA,CAAkB;AAAA,QAC1B,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,YAAY,GAAA,CAAI,UAAA;AAAA,QAChB,IAAA,EAAM,OAAA;AAAA,QACN;AAAA,OACD,CAAA;AAAA,IACH;AACA,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,EAAK,OAAO,MAAA;AAC/B,IAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,EACzB;AAEA,EAAA,MAAM,YAAA,GAAgC;AAAA,IACpC,eAAA,CAAgB,IAAA,GAAO,EAAC,EAAG;AACzB,MAAA,MAAM,KAAe,EAAC;AACtB,MAAA,IAAI,IAAA,CAAK,IAAA,EAAM,EAAA,CAAG,IAAA,CAAK,CAAA,KAAA,EAAQ,kBAAA,CAAmB,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAC,CAAA,CAAE,CAAA;AACrE,MAAA,IAAI,IAAA,CAAK,EAAA,EAAI,EAAA,CAAG,IAAA,CAAK,CAAA,GAAA,EAAM,kBAAA,CAAmB,KAAA,CAAM,IAAA,CAAK,EAAE,CAAC,CAAC,CAAA,CAAE,CAAA;AAC/D,MAAA,MAAM,MAAA,GAAS,GAAG,MAAA,GAAS,CAAA,CAAA,EAAI,GAAG,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,GAAK,EAAA;AAChD,MAAA,OAAO,GAAA;AAAA,QACL,sCAAsC,MAAM,CAAA;AAAA,OAC9C;AAAA,IACF,CAAA;AAAA,IACA,cAAc,KAAA,EAAO;AACnB,MAAA,OAAO,IAAA;AAAA,QACL,iCAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,CAAA;AAAA,IACA,uBAAuB,KAAA,EAAO;AAC5B,MAAA,OAAO,GAAA;AAAA,QACL,CAAA,gCAAA,EAAmC,kBAAA,CAAmB,KAAK,CAAC,CAAA;AAAA,OAC9D;AAAA,IACF,CAAA;AAAA,IACA,cAAc,KAAA,EAAO;AACnB,MAAA,OAAO,IAAA;AAAA,QACL,CAAA,gCAAA,EAAmC,kBAAA,CAAmB,KAAK,CAAC,CAAA,OAAA,CAAA;AAAA,QAC5D;AAAC,OACH;AAAA,IACF;AAAA,GACF;AAEA,EAAA,OAAO;AAAA,IACL,GAAA;AAAA,IACA,KAAA;AAAA,IACA,UAAA;AAAA,IACA,SAAA;AAAA,IACA,WAAA;AAAA,IACA,SAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF;AACF;AAIA,SAAS,MAAM,CAAA,EAA0B;AACvC,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,EAAE,WAAA,EAAY;AACnD;;;AC1kBO,IAAM,WAAA,GAAc","file":"index.js","sourcesContent":["/**\n * `createBrandfineClient` — the SDK's entry point.\n *\n * Returns a stateless, multi-instance-safe handle scoped to a\n * single `(baseUrl, apiKey)` pair. Pattern follows the Stripe /\n * Algolia / OpenAI SDKs — explicit construction with config,\n * namespaced methods (`bf.posts.list(...)`, `bf.workspace.get()`),\n * no module-level singletons.\n *\n * Why factory not module-level state: multi-tenant consumers\n * sometimes need two clients in the same process (e.g. main site\n * + admin preview). Module-level env reading makes that impossible\n * without monkey-patching.\n */\n\nimport type {\n  BrandfineCategory,\n  BrandfineNavigation,\n  BrandfinePost,\n  BrandfinePostListResponse,\n  BrandfineWorkspace,\n  ListCategoriesOptions,\n  ListPostsOptions,\n} from './types'\n\nexport type BrandfineClientConfig = {\n  /** Base URL of the Brandfine API. No trailing slash — the client\n   *  trims one if you pass it anyway. e.g. `https://api.brandfine.co` */\n  baseUrl: string\n  /** Workspace-scoped API key. Generated from the cms's Workspace\n   *  settings; identifies which workspace the client talks to. */\n  apiKey: string\n  /** Optional fetch override. Useful for tests (inject a stub),\n   *  for runtimes that need a custom implementation (edge workers\n   *  with non-standard fetch), or to add cross-cutting concerns\n   *  like tracing / retries. Defaults to `globalThis.fetch`. */\n  fetch?: typeof globalThis.fetch\n  /** Optional User-Agent header. Falls back to a generic SDK tag. */\n  userAgent?: string\n}\n\n/**\n * Structured error thrown by every request helper on non-2xx\n * responses. Carries the raw body so consumers can log it for\n * debugging without re-fetching.\n */\nexport class BrandfineApiError extends Error {\n  override readonly name = 'BrandfineApiError'\n  readonly status: number\n  readonly statusText: string\n  readonly body: string\n  readonly url: string\n\n  constructor(args: {\n    status: number\n    statusText: string\n    body: string\n    url: string\n  }) {\n    super(\n      `[brandfine] ${args.status} ${args.statusText} on ${args.url} — ${args.body.slice(0, 200)}`,\n    )\n    this.status = args.status\n    this.statusText = args.statusText\n    this.body = args.body\n    this.url = args.url\n  }\n}\n\ntype RequestOptions = {\n  /** When true and the response is 404, return `null` instead of\n   *  throwing. Used by endpoints where 404 is a meaningful empty\n   *  state (navigation by key, single post by slug). */\n  nullable404?: boolean\n  signal?: AbortSignal\n}\n\nexport type BrandfineClient = {\n  /** Low-level GET. Reserved for endpoints we don't have a typed\n   *  helper for yet. Adds the X-Api-Key header automatically. */\n  get: <T>(path: string, opts?: RequestOptions) => Promise<T>\n  posts: PostsApi\n  categories: CategoriesApi\n  workspace: WorkspaceApi\n  navigations: NavigationsApi\n  analytics: AnalyticsApi\n  submissions: SubmissionsApi\n  appointments: AppointmentsApi\n}\n\ntype PostsApi = {\n  /** Paginated list of published posts. Handles the cms's\n   *  pagination transparently — caller gets a flat array. */\n  list: <TConfig = unknown>(\n    opts?: ListPostsOptions,\n  ) => Promise<BrandfinePost<TConfig>[]>\n  /** Single post by per-locale URL slug, scoped to the active\n   *  locale on the workspace's content. Returns `null` for 404 so\n   *  callers can render their own \"not found\" page without try/catch. */\n  getBySlug: <TConfig = unknown>(\n    slug: string,\n  ) => Promise<BrandfinePost<TConfig> | null>\n}\n\ntype CategoriesApi = {\n  list: (opts?: ListCategoriesOptions) => Promise<BrandfineCategory[]>\n}\n\ntype WorkspaceApi = {\n  get: <\n    TCustomConfig = Record<string, unknown>,\n    TSchemaOrg = Record<string, unknown>,\n  >() => Promise<BrandfineWorkspace<TCustomConfig, TSchemaOrg>>\n}\n\ntype NavigationsApi = {\n  /** Navigation by its workspace-scoped `key` (e.g. `'header'`).\n   *  Returns `null` for 404 so consumers can fall back to a\n   *  hardcoded default without try/catch. `TConfig` narrows each\n   *  item's `customConfig` (default `unknown`). */\n  get: <TConfig = unknown>(\n    key: string,\n  ) => Promise<BrandfineNavigation<TConfig> | null>\n}\n\nexport type CreateSubmissionInput = {\n  /** Required. Display name of the submitter. */\n  name: string\n  /** Required. Validated server-side. */\n  email: string\n  /** Optional. Free-text up to 40 chars. */\n  phone?: string\n  /** Optional. Free-text up to 200 chars. */\n  subject?: string\n  /** Required. The message body — up to 10,000 chars. */\n  message: string\n  /** Optional. Where the submission came from — e.g. a route path\n   *  like `/contact`, or a marketing campaign label. Up to 500 chars. */\n  source?: string\n  /** Optional. Free-form JSON metadata the consumer attaches; the\n   *  cms surfaces it verbatim in the submissions admin view. */\n  metadata?: Record<string, unknown>\n}\n\nexport type Submission = {\n  id: string\n  createdAt: string\n}\n\ntype SubmissionsApi = {\n  /**\n   * Posts a contact-form submission to `POST /external/submissions`\n   * for this workspace. The cms surfaces the submission in the\n   * Submissions inbox.\n   *\n   * Throws `BrandfineApiError` on validation failures (400) or\n   * any other non-2xx — caller decides whether to surface that as\n   * a user-visible error or a silent retry.\n   */\n  create: (input: CreateSubmissionInput) => Promise<Submission>\n}\n\n// ----------------------------------------------------------------\n// Appointments plugin SDK — pairs with the Appointments embed\n// widget. Consumers who want full control over the booking UI use\n// these methods directly; consumers who want the drop-in widget\n// use the `<script>` embed (which itself uses these methods under\n// the hood). The same `BrandfineClient` instance powers both.\n// ----------------------------------------------------------------\n\nexport type AppointmentSlot = {\n  /** UTC ISO 8601 timestamp of the slot start. */\n  start: string\n  /** UTC ISO 8601 timestamp of the slot end. */\n  end: string\n}\n\nexport type AppointmentAvailability = {\n  /** False = plugin not activated, or activation row's `enabled`\n   *  flag is off. Widgets should render a \"not accepting bookings\"\n   *  state, not throw. */\n  enabled: boolean\n  /** Source-of-truth IANA timezone for the workspace's business\n   *  hours. Visitors see slots in their local TZ — use this for\n   *  the \"(workspace local: HH:MM)\" subtext. */\n  timezone: string\n  slotDurationMinutes: number\n  leadTimeHours: number\n  bookingWindowDays: number\n  policyText: string | null\n  slots: AppointmentSlot[]\n  /** UTC ISO 8601. Useful for the widget's date range label. */\n  windowStart: string\n  windowEnd: string\n}\n\nexport type CreateAppointmentRequestInput = {\n  visitorName: string\n  visitorEmail: string\n  visitorPhone?: string\n  visitorMessage?: string\n  /** UTC ISO 8601 of the requested slot start. Server re-validates\n   *  against business hours + busy ranges before accepting. */\n  requestedAt: string\n  /** Optional cookie-derived session id from the consumer site. */\n  visitorSessionId?: string\n}\n\nexport type CreatedAppointmentRequest = {\n  id: string\n  createdAt: string\n  requestedAt: string\n  durationMinutes: number\n  status: 'PENDING'\n  /** Visitor's self-cancel token. Embed it in confirmation\n   *  emails / on-page UI so the visitor can cancel without an\n   *  account. One-time use; revoked once any party acts. */\n  cancellationToken: string | null\n}\n\nexport type AppointmentRequestSummary = {\n  id: string\n  visitorName: string\n  visitorEmail: string\n  requestedAt: string\n  durationMinutes: number\n  status: 'PENDING' | 'CONFIRMED' | 'REJECTED' | 'CANCELLED'\n  workspace: { name: string; slug: string }\n}\n\ntype AppointmentsApi = {\n  /**\n   * Available slots for the workspace's booking window.\n   * `from` / `to` are optional clamps inside the workspace's\n   * configured window — the server ignores ranges outside.\n   */\n  getAvailability: (opts?: {\n    from?: Date | string\n    to?: Date | string\n  }) => Promise<AppointmentAvailability>\n  /**\n   * Submit a visitor's appointment request. Returns the created\n   * row + a one-time cancellation token. Server-side validates\n   * the slot is still bookable; if it isn't, throws\n   * `BrandfineApiError` with status 404 / 409.\n   */\n  createRequest: (\n    input: CreateAppointmentRequestInput,\n  ) => Promise<CreatedAppointmentRequest>\n  /**\n   * Look up an appointment by its cancellation token. Used by\n   * the widget's `?bf-cancel=<token>` URL flow to render a\n   * confirmation page before the visitor cancels.\n   */\n  getByCancellationToken: (\n    token: string,\n  ) => Promise<AppointmentRequestSummary>\n  /**\n   * Visitor self-cancellation. The token is revoked after the\n   * call succeeds; subsequent calls return 400.\n   */\n  cancelByToken: (\n    token: string,\n  ) => Promise<{ id: string; status: 'CANCELLED' }>\n}\n\nexport type AnalyticsConfig =\n  | { enabled: false }\n  | { enabled: true; websiteId: string; scriptUrl: string }\n\nexport type AnalyticsInstallResult =\n  | { installed: false; reason: 'disabled' | 'ssr' | 'already-installed' }\n  | { installed: true; websiteId: string }\n\nexport type InstallOptions = {\n  /**\n   * Pre-known config. When provided, `install()` skips the round-\n   * trip to `/external/analytics-config` and injects the script\n   * immediately. Use this when you've baked the values into your\n   * build (env vars, CMS-side config dump, etc.) — typical for\n   * static sites where the analytics state is decided at deploy\n   * time, not per page load.\n   *\n   * Trade-off vs the default fetch path: if you disable analytics\n   * in Brandfine, the tracker keeps loading until your next\n   * deploy. That's usually the right trade for static sites\n   * (which redeploy on every content change anyway) and the wrong\n   * trade for dynamic sites where the api round-trip is cheap\n   * relative to the rest of the page.\n   *\n   * Pass `{ enabled: false }` to force a no-op without touching\n   * the api (e.g. to disable analytics for one environment without\n   * changing Brandfine's state).\n   */\n  config?: AnalyticsConfig\n}\n\ntype AnalyticsApi = {\n  /**\n   * Injects the Brandfine analytics tracker into `document.head`\n   * once. Safe to call on every page load — idempotent via a\n   * marker attribute on the injected script tag.\n   *\n   * Two paths:\n   *  - `install()` — fetches the config from Brandfine, then\n   *    injects. Reflects enable/disable state on next page load.\n   *  - `install({ config })` — uses caller-provided config, skips\n   *    the fetch. Faster, no round-trip; ignores Brandfine state\n   *    changes until the consumer's next deploy.\n   *\n   * Returns details about what happened:\n   *  - `{ installed: true, websiteId }` — script was just injected.\n   *  - `{ installed: false, reason: 'disabled' }` — config says\n   *    analytics is off; no-op.\n   *  - `{ installed: false, reason: 'ssr' }` — no `document` in\n   *    scope (server-side). Call again on the client.\n   *  - `{ installed: false, reason: 'already-installed' }` — a\n   *    prior call (or another tab in the same SPA) already injected.\n   *\n   * Throws `BrandfineApiError` on non-2xx responses other than the\n   * disabled case (which is a valid `{ enabled: false }` body).\n   */\n  install: (opts?: InstallOptions) => Promise<AnalyticsInstallResult>\n\n  /** Lower-level helper — fetches the raw config without touching\n   *  the DOM. Useful when you want to inject the script yourself\n   *  (e.g. via a framework's <Script> component for nonce/csp). */\n  getConfig: () => Promise<AnalyticsConfig>\n}\n\n/** Attribute we stamp on the injected <script> so `install()` is\n *  idempotent across re-renders and SPA route changes. */\nconst INSTALLED_MARKER = 'data-brandfine-analytics'\n\nconst DEFAULT_USER_AGENT = '@brandfine/client'\n\nexport function createBrandfineClient(\n  config: BrandfineClientConfig,\n): BrandfineClient {\n  if (!config.baseUrl)\n    throw new Error('createBrandfineClient: `baseUrl` is required')\n  if (!config.apiKey)\n    throw new Error('createBrandfineClient: `apiKey` is required')\n\n  const baseUrl = config.baseUrl.replace(/\\/$/, '')\n  const apiKey = config.apiKey\n  // Resolve fetch lazily so consumers in environments without a\n  // global fetch can polyfill before constructing the client.\n  const fetchImpl: typeof fetch = config.fetch ?? globalThis.fetch\n  const userAgent = config.userAgent ?? DEFAULT_USER_AGENT\n\n  async function get<T>(path: string, opts: RequestOptions = {}): Promise<T> {\n    const url = `${baseUrl}${path}`\n    const res = await fetchImpl(url, {\n      method: 'GET',\n      headers: {\n        'X-Api-Key': apiKey,\n        Accept: 'application/json',\n        'User-Agent': userAgent,\n      },\n      signal: opts.signal,\n    })\n    if (res.status === 404 && opts.nullable404) {\n      // Drain the body so the underlying socket can be reused —\n      // fetch implementations that don't auto-drain (older Node)\n      // can leak otherwise.\n      await res.text().catch(() => '')\n      return null as T\n    }\n    if (!res.ok) {\n      const body = await res.text().catch(() => '')\n      throw new BrandfineApiError({\n        status: res.status,\n        statusText: res.statusText,\n        body,\n        url,\n      })\n    }\n    return (await res.json()) as T\n  }\n\n  const posts: PostsApi = {\n    async list<TConfig = unknown>(opts: ListPostsOptions = {}) {\n      const out: BrandfinePost<TConfig>[] = []\n      let page = 1\n      const typeQuery = opts.type ? `&type=${encodeURIComponent(opts.type)}` : ''\n      const localeQuery = opts.locale\n        ? `&locale=${encodeURIComponent(opts.locale)}`\n        : ''\n      // Default pagination at the cms's 50-per-page cap. `forceLimit`\n      // opts past it for content types that would otherwise need\n      // many round-trips.\n      const sizeQuery = opts.forceLimit\n        ? `&force_limit=${opts.forceLimit}`\n        : '&limit=50'\n      // Pathological safety brake — 200 pages × 50 = 10k posts. If\n      // a workspace ever needs more, callers should hit the API\n      // directly with their own pagination logic.\n      const MAX_PAGES = 200\n      while (page <= MAX_PAGES) {\n        const data = await get<BrandfinePostListResponse<TConfig>>(\n          `/external/posts?include=content${sizeQuery}&page=${page}${typeQuery}${localeQuery}`,\n        )\n        out.push(...data.items)\n        if (!data.pageInfo.hasNext) break\n        page += 1\n      }\n      return out\n    },\n    async getBySlug<TConfig = unknown>(slug: string) {\n      return get<BrandfinePost<TConfig> | null>(\n        `/external/posts/${encodeURIComponent(slug)}`,\n        { nullable404: true },\n      )\n    },\n  }\n\n  const categories: CategoriesApi = {\n    async list(opts: ListCategoriesOptions = {}) {\n      const qs = opts.locale ? `?locale=${encodeURIComponent(opts.locale)}` : ''\n      const data = await get<{ items: BrandfineCategory[] }>(\n        `/external/categories${qs}`,\n      )\n      return data.items\n    },\n  }\n\n  const workspace: WorkspaceApi = {\n    get<\n      TCustomConfig = Record<string, unknown>,\n      TSchemaOrg = Record<string, unknown>,\n    >() {\n      return get<BrandfineWorkspace<TCustomConfig, TSchemaOrg>>(\n        '/external/workspace',\n      )\n    },\n  }\n\n  const navigations: NavigationsApi = {\n    get<TConfig = unknown>(key: string) {\n      return get<BrandfineNavigation<TConfig> | null>(\n        `/external/navigations/${encodeURIComponent(key)}`,\n        { nullable404: true },\n      )\n    },\n  }\n\n  const analytics: AnalyticsApi = {\n    getConfig() {\n      return get<AnalyticsConfig>('/external/analytics-config')\n    },\n    async install(opts: InstallOptions = {}) {\n      // SSR safety: nothing to inject without a DOM. Consumers\n      // call this from useEffect / onMount, but defensive anyway\n      // (some frameworks still execute the file body on the server).\n      if (typeof document === 'undefined') {\n        return { installed: false, reason: 'ssr' as const }\n      }\n\n      // Use caller-provided config if present (build-time path),\n      // otherwise fetch (runtime path).\n      const cfg = opts.config ?? (await analytics.getConfig())\n      if (!cfg.enabled) {\n        return { installed: false, reason: 'disabled' as const }\n      }\n\n      // Idempotency: a prior call (StrictMode double-invoke, SPA\n      // re-mount, second instance with the same workspace) may\n      // have already injected. The marker attribute is the source\n      // of truth — checking by script src would also miss the case\n      // where two workspaces share the same scriptUrl.\n      const existing = document.querySelector<HTMLScriptElement>(\n        `script[${INSTALLED_MARKER}=\"${cfg.websiteId}\"]`,\n      )\n      if (existing) {\n        return { installed: false, reason: 'already-installed' as const }\n      }\n\n      const script = document.createElement('script')\n      script.defer = true\n      script.src = cfg.scriptUrl\n      script.setAttribute('data-website-id', cfg.websiteId)\n      // The marker doubles as a sentinel + a debug aid (you can\n      // grep the DOM for `data-brandfine-analytics` to confirm\n      // an install).\n      script.setAttribute(INSTALLED_MARKER, cfg.websiteId)\n      document.head.appendChild(script)\n      return { installed: true, websiteId: cfg.websiteId }\n    },\n  }\n\n  const submissions: SubmissionsApi = {\n    async create(input: CreateSubmissionInput) {\n      const url = `${baseUrl}/external/submissions`\n      const res = await fetchImpl(url, {\n        method: 'POST',\n        headers: {\n          'X-Api-Key': apiKey,\n          'Content-Type': 'application/json',\n          Accept: 'application/json',\n          'User-Agent': userAgent,\n        },\n        body: JSON.stringify(input),\n      })\n      if (!res.ok) {\n        const body = await res.text().catch(() => '')\n        throw new BrandfineApiError({\n          status: res.status,\n          statusText: res.statusText,\n          body,\n          url,\n        })\n      }\n      return (await res.json()) as Submission\n    },\n  }\n\n  /**\n   * Shared POST helper for the appointments namespace. The main\n   * `get()` helper handles GETs; submissions has its own inline\n   * POST because it predates this refactor. New plugin namespaces\n   * (appointments first, others to follow) share this one so the\n   * error-handling shape stays consistent.\n   */\n  async function post<T>(\n    path: string,\n    body: unknown,\n    opts: RequestOptions = {},\n  ): Promise<T> {\n    const url = `${baseUrl}${path}`\n    const res = await fetchImpl(url, {\n      method: 'POST',\n      headers: {\n        'X-Api-Key': apiKey,\n        'Content-Type': 'application/json',\n        Accept: 'application/json',\n        'User-Agent': userAgent,\n      },\n      body: JSON.stringify(body),\n      signal: opts.signal,\n    })\n    if (!res.ok) {\n      const errBody = await res.text().catch(() => '')\n      throw new BrandfineApiError({\n        status: res.status,\n        statusText: res.statusText,\n        body: errBody,\n        url,\n      })\n    }\n    if (res.status === 204) return undefined as T\n    return (await res.json()) as T\n  }\n\n  const appointments: AppointmentsApi = {\n    getAvailability(opts = {}) {\n      const qs: string[] = []\n      if (opts.from) qs.push(`from=${encodeURIComponent(toIso(opts.from))}`)\n      if (opts.to) qs.push(`to=${encodeURIComponent(toIso(opts.to))}`)\n      const suffix = qs.length ? `?${qs.join('&')}` : ''\n      return get<AppointmentAvailability>(\n        `/external/appointments/availability${suffix}`,\n      )\n    },\n    createRequest(input) {\n      return post<CreatedAppointmentRequest>(\n        '/external/appointments/requests',\n        input,\n      )\n    },\n    getByCancellationToken(token) {\n      return get<AppointmentRequestSummary>(\n        `/external/appointments/requests/${encodeURIComponent(token)}`,\n      )\n    },\n    cancelByToken(token) {\n      return post<{ id: string; status: 'CANCELLED' }>(\n        `/external/appointments/requests/${encodeURIComponent(token)}/cancel`,\n        {},\n      )\n    },\n  }\n\n  return {\n    get,\n    posts,\n    categories,\n    workspace,\n    navigations,\n    analytics,\n    submissions,\n    appointments,\n  }\n}\n\n/** Accepts a Date or an already-ISO string and returns ISO. Saves\n *  every caller from `.toISOString()`-ing manually. */\nfunction toIso(d: Date | string): string {\n  return typeof d === 'string' ? d : d.toISOString()\n}\n","/**\n * @brandfine/client — root entry.\n *\n * The full SDK surface is exposed here for \"import everything from\n * one place\" usage. Tree-shaking + `sideEffects: false` mean\n * consumers don't pay a bundle cost for what they don't import.\n *\n * Heavier or framework-coupled pieces still live under subpath\n * exports (`@brandfine/client/cache`, `/resolvers`, `/webhook`) so\n * consumers with poor tree-shaking — or who only need one slice —\n * can scope their imports.\n */\n\nexport const SDK_VERSION = '0.0.0' as const\n\nexport {\n  BrandfineApiError,\n  createBrandfineClient,\n  type AnalyticsConfig,\n  type AnalyticsInstallResult,\n  type BrandfineClient,\n  type BrandfineClientConfig,\n  type CreateSubmissionInput,\n  type InstallOptions,\n  type Submission,\n} from './client'\n\nexport {\n  createCache,\n  createKeyedCache,\n  type Cache,\n  type CacheOptions,\n  type KeyedCache,\n  type KeyedCacheOptions,\n} from './cache/index'\n\nexport {\n  isLocale,\n  localizePath,\n  pickLocale,\n  resolveNavigation,\n  stripLocalePrefix,\n  type HydratedNav,\n  type HydratedNavItem,\n  type LocaleOptions,\n  type ResolveNavigationOptions,\n} from './resolvers/index'\n\nexport {\n  createBrandfineWebhookHandler,\n  parseWebhookPayload,\n  verifyWebhookSecret,\n  type BrandfineWebhookEvent,\n  type BrandfineWebhookHandlerOptions,\n  type BrandfineWebhookPayload,\n} from './webhook/index'\n\nexport type {\n  BrandfineCategory,\n  BrandfineNavItem,\n  BrandfineNavItemType,\n  BrandfineNavPost,\n  BrandfineNavigation,\n  BrandfinePost,\n  BrandfinePostListResponse,\n  BrandfinePostTranslation,\n  BrandfineWorkspace,\n  ListCategoriesOptions,\n  ListPostsOptions,\n} from './types'\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brandfine/client",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Brandfine consumer SDK — typed HTTP client, server-side caches, locale + navigation resolvers, and webhook helpers for landing-page integrations.",
   "license": "MIT",
   "type": "module",