@businessdash/sdk 0.9.60 → 0.9.70

package/package.json

@@ -1,13 +1,14 @@
 {
 	"name": "@businessdash/sdk",
-	"version": "0.9.60",
+	"version": "0.9.70",
 	"description": "BusinessDash developer SDK \u2014 the data layer that lets you build customer-facing surfaces on your own domain while BusinessDash handles the operations stack behind the scenes. 0.9.x ships a comprehensive programmatic surface: storefront (products, categories, cart, checkout via Stripe Connect with Link payment), customer portal (work feed, per-item detail, quote accept/reject, job activity, comment threads, reviews, notification preferences), blog (posts, categories, threaded comments, reactions, paywalls, Mux video), Front Desk chat (sessions, AI bot, live human handoff, queue + place-in-line), coupons (validation against synced Stripe Promotion Codes \u2014 BOGO/BXGY/free-shipping kinds), shipping (multi-carrier rates + tracking via Shippo), address validation (Google Places, platform-proxied), customer notification preferences across in-app/email/SMS/webhook, subscriptions admin + Stripe sync, and followers/subscribers. Also: tenant sign-in/up/out via the auth handler, schema-driven marketing pages with restore semantics, typed JSON-LD SEO builders (LocalBusiness/Service/FAQ/Article/Breadcrumb/Review), and a CLI (`biab-dev sync-schema`) for the schema flow. The consumer renders the UI in their own design system on their own domain; BusinessDash supplies the data, the business logic, and the Stripe/Mux/Google/Shippo plumbing.",
 	"type": "module",
 	"sideEffects": false,
 	"files": [
 		"dist",
 		"openapi.json",
-		"src"
+		"src",
+		"assets"
 	],
 	"main": "./dist/index.js",
 	"module": "./dist/index.js",
@@ -31,6 +32,10 @@
 			"types": "./dist/contracts.d.ts",
 			"import": "./dist/contracts.js"
 		},
+		"./framework-support": {
+			"types": "./dist/framework-support.d.ts",
+			"import": "./dist/framework-support.js"
+		},
 		"./native": {
 			"types": "./dist/native.d.ts",
 			"import": "./dist/native.js"
@@ -51,6 +56,46 @@
 			"types": "./dist/forms.d.ts",
 			"import": "./dist/forms.js"
 		},
+		"./store": {
+			"types": "./dist/store.d.ts",
+			"import": "./dist/store.js"
+		},
+		"./chat": {
+			"types": "./dist/chat.d.ts",
+			"import": "./dist/chat.js"
+		},
+		"./blog": {
+			"types": "./dist/blog.d.ts",
+			"import": "./dist/blog.js"
+		},
+		"./checkout": {
+			"types": "./dist/checkout.d.ts",
+			"import": "./dist/checkout.js"
+		},
+		"./account": {
+			"types": "./dist/account.d.ts",
+			"import": "./dist/account.js"
+		},
+		"./marketing": {
+			"types": "./dist/marketing.d.ts",
+			"import": "./dist/marketing.js"
+		},
+		"./verify": {
+			"types": "./dist/verify.d.ts",
+			"import": "./dist/verify.js"
+		},
+		"./portal": {
+			"types": "./dist/portal.d.ts",
+			"import": "./dist/portal.js"
+		},
+		"./social": {
+			"types": "./dist/social.d.ts",
+			"import": "./dist/social.js"
+		},
+		"./seed": {
+			"types": "./dist/seed.d.ts",
+			"import": "./dist/seed.js"
+		},
 		"./collections": {
 			"types": "./dist/collections.d.ts",
 			"import": "./dist/collections.js"
@@ -113,6 +158,10 @@
 			"types": "./dist/mcp.d.ts",
 			"import": "./dist/mcp.js"
 		},
+		"./mcp-adapters": {
+			"types": "./dist/mcp-adapters.d.ts",
+			"import": "./dist/mcp-adapters.js"
+		},
 		"./proxy": {
 			"types": "./dist/proxy.d.ts",
 			"import": "./dist/proxy.js"
@@ -141,7 +190,38 @@
 			"types": "./dist/adapters-revalidate.d.ts",
 			"import": "./dist/adapters-revalidate.js"
 		},
-		"./biab-forms.css": "./dist/biab-forms.css"
+		"./biab-forms.css": "./dist/biab-forms.css",
+		"./seo-core": {
+			"types": "./dist/seo-core/index.d.ts",
+			"import": "./dist/seo-core/index.js",
+			"require": "./dist/seo-core/index.cjs"
+		},
+		"./push-core": {
+			"types": "./dist/push-core/index.d.ts",
+			"import": "./dist/push-core/index.js",
+			"require": "./dist/push-core/index.cjs"
+		},
+		"./notifications": {
+			"types": "./dist/notifications-core/index.d.ts",
+			"import": "./dist/notifications-core/index.js",
+			"require": "./dist/notifications-core/index.cjs"
+		},
+		"./legal": {
+			"types": "./dist/legal-core/index.d.ts",
+			"import": "./dist/legal-core/index.js",
+			"require": "./dist/legal-core/index.cjs"
+		},
+		"./sitemap": {
+			"types": "./dist/sitemap-core/index.d.ts",
+			"import": "./dist/sitemap-core/index.js",
+			"require": "./dist/sitemap-core/index.cjs"
+		},
+		"./model3d": {
+			"types": "./dist/model3d-core/index.d.ts",
+			"import": "./dist/model3d-core/index.js",
+			"require": "./dist/model3d-core/index.cjs"
+		},
+		"./biab-sw.js": "./assets/biab-sw.js"
 	},
 	"scripts": {
 		"clean": "node -e \"const fs=require('node:fs');fs.rmSync('dist',{recursive:true,force:true})\"",
@@ -149,19 +229,25 @@
 		"openapi": "tsx scripts/openapi.ts",
 		"openapi:check": "tsx scripts/openapi.ts --check",
 		"postbuild": "node scripts/publish-types.js",
-		"typecheck": "tsc -p tsconfig.json --noEmit",
+		"typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.solid.json --noEmit && tsc -p tsconfig.qwik.json --noEmit && tsc -p tsconfig.headless.json --noEmit",
 		"test:types": "tsc -p tsconfig.type-tests.json --noEmit",
 		"test": "tsx --test test/*.test.ts test/*.test.tsx",
 		"lint": "biome check .",
 		"lint:fix": "biome check --write .",
-		"prepublishOnly": "npm run build"
+		"prepublishOnly": "npm run build",
+		"typecheck:solid": "tsc -p tsconfig.solid.json --noEmit",
+		"typecheck:headless": "tsc -p tsconfig.headless.json --noEmit",
+		"typecheck:qwik": "tsc -p tsconfig.qwik.json --noEmit",
+		"gen:socials": "tsx scripts/gen-social-tables.ts",
+		"gen:socials:check": "tsx scripts/gen-social-tables.ts --check",
+		"typecheck:solid2": "tsc -p tsconfig.solid2.json --noEmit"
 	},
 	"publishConfig": {
 		"access": "public"
 	},
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/Gold240sx/business-in-a-box.git",
+		"url": "git+https://github.com/businessdash/platform.git",
 		"directory": "biab-dev"
 	},
 	"license": "MIT",
@@ -178,8 +264,13 @@
 		"zod-to-json-schema": "^3.25.2"
 	},
 	"peerDependencies": {
-		"react": ">=18.0.0",
-		"react-dom": ">=18.0.0"
+		"@angular/core": ">=17.0.0",
+		"@builder.io/qwik": ">=1.5.0 <2",
+		"react": ">=18.0.0 <20",
+		"react-dom": ">=18.0.0 <20",
+		"solid-js": ">=1.8.0 <3",
+		"svelte": ">=5.0.0 <6",
+		"vue": ">=3.3.0 <4"
 	},
 	"peerDependenciesMeta": {
 		"react": {
@@ -187,14 +278,35 @@
 		},
 		"react-dom": {
 			"optional": true
+		},
+		"solid-js": {
+			"optional": true
+		},
+		"vue": {
+			"optional": true
+		},
+		"svelte": {
+			"optional": true
+		},
+		"@builder.io/qwik": {
+			"optional": true
+		},
+		"@angular/core": {
+			"optional": true
 		}
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.5.1",
+		"@builder.io/qwik": "^1.5.0",
+		"@solidjs/web": "2.0.0-rc.1",
 		"@types/node": "^20.19.43",
 		"@types/react": "^19.2.17",
 		"esbuild": "^0.28.1",
-		"react": "^19.2.7",
+		"preact": "^10.29.8",
+		"preact-render-to-string": "^6.7.0",
+		"react": "^19.2.8",
+		"react-dom": "^19.2.8",
+		"solid-js-v2": "npm:solid-js@2.0.0-rc.1",
 		"tsx": "^4.22.4",
 		"typescript": "^5.9.3"
 	},

package/src/account-core/index.ts

@@ -0,0 +1,309 @@
+/**
+ * `@businessdash/sdk/account` — headless customer session and followers.
+ *
+ * Two small controllers that were React-only (plus Solid) and had no reason to
+ * be: neither has any framework-specific logic.
+ *
+ * ## Session
+ *
+ * `createUserController` reads the auth handler's `/me` route with the session
+ * cookie. It never touches an API key — the handler the consumer mounts owns
+ * the credential, and this only asks it who is signed in.
+ *
+ * Sign-in, sign-up and sign-out are navigations, not requests, so they are
+ * plain functions over `buildAuthHref` rather than controller actions. Every
+ * one of them no-ops outside a browser instead of throwing, so an SSR render
+ * that touches them degrades rather than crashes.
+ *
+ * ## Followers
+ *
+ * `createFollowersController` wraps subscribe/unsubscribe with the local
+ * "this browser already subscribed" hint. The hint is a convenience for hiding
+ * a footer form without a round trip — it is NOT authority. `me()` is.
+ *
+ * @module
+ */
+
+import {
+	buildAuthHref,
+	clearLocalFollow,
+	DEFAULT_AUTH_BASE_PATH,
+	followerStoreKey,
+	type LocalFollow,
+	readLocalFollow,
+	writeLocalFollow,
+} from "../auth-links.js";
+import type { TenantAuthMeResponse } from "../contracts.js";
+
+// ─── Session ─────────────────────────────────────────────────────────────────
+
+export type UserStatus = "loading" | "signed-in" | "signed-out";
+
+export type UserSnapshot = {
+	status: UserStatus;
+	user: TenantAuthMeResponse | null;
+};
+
+export type UserController = {
+	snapshot(): UserSnapshot;
+	subscribe(callback: (snapshot: UserSnapshot) => void): () => void;
+	/** Read `/me`. Called once by `start()`; call again to re-check. */
+	refresh(): Promise<UserSnapshot>;
+	/** Kick off the first read. Bindings call this on mount. */
+	start(): void;
+	destroy(): void;
+};
+
+export type CreateUserControllerOptions = {
+	/** Where `createAuthHandler` is mounted. Defaults to `/api/biab-auth`. */
+	basePath?: string;
+	/** Injectable for tests; defaults to global `fetch`. */
+	fetchImpl?: typeof fetch;
+};
+
+export function createUserController(
+	options: CreateUserControllerOptions = {},
+): UserController {
+	const basePath = (options.basePath ?? DEFAULT_AUTH_BASE_PATH).replace(
+		/\/$/,
+		"",
+	);
+	const doFetch = options.fetchImpl ?? globalThis.fetch;
+
+	let destroyed = false;
+	const subscribers = new Set<(s: UserSnapshot) => void>();
+	let state: UserSnapshot = { status: "loading", user: null };
+
+	function notify(): void {
+		if (destroyed) return;
+		for (const cb of subscribers) cb(state);
+	}
+
+	async function refresh(): Promise<UserSnapshot> {
+		if (destroyed) return state;
+		try {
+			const res = await doFetch(`${basePath}/me`, { credentials: "include" });
+			const body = res.ok ? ((await res.json()) as TenantAuthMeResponse) : null;
+			if (destroyed) return state;
+			state = body
+				? { status: "signed-in", user: body }
+				: { status: "signed-out", user: null };
+		} catch {
+			// A network failure is indistinguishable from "not signed in" from the
+			// page's point of view, and treating it as an error would leave every
+			// consumer writing the same fallback.
+			if (!destroyed) state = { status: "signed-out", user: null };
+		}
+		notify();
+		return state;
+	}
+
+	return {
+		snapshot: () => state,
+		subscribe(callback) {
+			subscribers.add(callback);
+			return () => {
+				subscribers.delete(callback);
+			};
+		},
+		refresh,
+		start() {
+			void refresh();
+		},
+		destroy() {
+			destroyed = true;
+			subscribers.clear();
+		},
+	};
+}
+
+export type ProgrammaticAuthOptions = {
+	/** Where to send the customer afterwards. */
+	returnTo?: string;
+	/** Pre-fill the email on the hosted page (sign-in / sign-up only). */
+	loginHint?: string;
+	/** Override the auth-handler basePath. */
+	basePath?: string;
+};
+
+/** Href for the auth handler's sign-in route — render it in your own link. */
+export function signInHref(options: ProgrammaticAuthOptions = {}): string {
+	return buildAuthHref("sign-in", options);
+}
+
+/** Href for the auth handler's sign-up route. */
+export function signUpHref(options: ProgrammaticAuthOptions = {}): string {
+	return buildAuthHref("sign-up", options);
+}
+
+/** Href for the auth handler's sign-out route. */
+export function signOutHref(options: { basePath?: string } = {}): string {
+	return buildAuthHref("sign-out", options);
+}
+
+/** Navigate to sign-in. No-ops outside a browser. */
+export function signIn(options: ProgrammaticAuthOptions = {}): void {
+	if (typeof window === "undefined") return;
+	window.location.assign(signInHref(options));
+}
+
+/** Navigate to sign-up. No-ops outside a browser. */
+export function signUp(options: ProgrammaticAuthOptions = {}): void {
+	if (typeof window === "undefined") return;
+	window.location.assign(signUpHref(options));
+}
+
+/** Navigate to sign-out. No-ops outside a browser. */
+export function signOut(options: { basePath?: string } = {}): void {
+	if (typeof window === "undefined") return;
+	window.location.assign(signOutHref(options));
+}
+
+// ─── Followers ───────────────────────────────────────────────────────────────
+
+export type FollowersCoreClient = {
+	followers: {
+		join(input: {
+			email: string;
+			name?: string;
+			source?: string;
+		}): Promise<unknown>;
+		leave(input: { email: string }): Promise<unknown>;
+		me(input: { email: string }): Promise<unknown>;
+		edit(input: {
+			email: string;
+			patch: { name?: string; source?: string };
+		}): Promise<unknown>;
+	};
+};
+
+export type FollowersSnapshot = {
+	/** This browser already subscribed. A hint for hiding a form, not authority. */
+	subscribedLocally: boolean;
+	/** The email this browser subscribed with, or `null`. */
+	localEmail: string | null;
+	isPending: boolean;
+	error: Error | null;
+};
+
+export type FollowersController = {
+	snapshot(): FollowersSnapshot;
+	subscribe(callback: (snapshot: FollowersSnapshot) => void): () => void;
+	join(input: {
+		email: string;
+		name?: string;
+		source?: string;
+	}): Promise<unknown>;
+	leave(email: string): Promise<unknown>;
+	/** Authoritative status for an email — unlike `subscribedLocally`. */
+	me(email: string): Promise<unknown>;
+	edit(
+		email: string,
+		patch: { name?: string; source?: string },
+	): Promise<unknown>;
+	destroy(): void;
+};
+
+export type CreateFollowersControllerOptions = {
+	client: FollowersCoreClient;
+	/** Site id — namespaces the local hint so two sites don't share it. */
+	siteId: string;
+	onError?: (error: Error) => void;
+};
+
+export function createFollowersController(
+	options: CreateFollowersControllerOptions,
+): FollowersController {
+	const { client, siteId, onError } = options;
+	const storeKey = followerStoreKey(siteId);
+
+	let destroyed = false;
+	const subscribers = new Set<(s: FollowersSnapshot) => void>();
+	let local: LocalFollow | null = readLocalFollow(storeKey);
+	let isPending = false;
+	let error: Error | null = null;
+	let cached: FollowersSnapshot | null = null;
+
+	function snapshot(): FollowersSnapshot {
+		if (!cached) {
+			cached = {
+				subscribedLocally: local !== null,
+				localEmail: local?.email ?? null,
+				isPending,
+				error,
+			};
+		}
+		return cached;
+	}
+
+	function notify(): void {
+		if (destroyed) return;
+		cached = null;
+		const next = snapshot();
+		for (const cb of subscribers) cb(next);
+	}
+
+	async function run<T>(work: () => Promise<T>, fallback: string): Promise<T> {
+		isPending = true;
+		error = null;
+		notify();
+		try {
+			return await work();
+		} catch (cause) {
+			const err = cause instanceof Error ? cause : new Error(fallback);
+			error = err;
+			onError?.(err);
+			throw err;
+		} finally {
+			isPending = false;
+			notify();
+		}
+	}
+
+	return {
+		snapshot,
+		subscribe(callback) {
+			subscribers.add(callback);
+			return () => {
+				subscribers.delete(callback);
+			};
+		},
+
+		join(input) {
+			return run(async () => {
+				const res = await client.followers.join(input);
+				local = { email: input.email, at: Date.now() };
+				writeLocalFollow(storeKey, local);
+				return res;
+			}, "Could not subscribe.");
+		},
+
+		leave(email) {
+			return run(async () => {
+				const res = await client.followers.leave({ email });
+				clearLocalFollow(storeKey);
+				local = null;
+				return res;
+			}, "Could not unsubscribe.");
+		},
+
+		me(email) {
+			return run(
+				() => client.followers.me({ email }),
+				"Could not read status.",
+			);
+		},
+
+		edit(email, patch) {
+			return run(
+				() => client.followers.edit({ email, patch }),
+				"Could not update the subscription.",
+			);
+		},
+
+		destroy() {
+			destroyed = true;
+			subscribers.clear();
+		},
+	};
+}

package/src/account.ts

@@ -0,0 +1,11 @@
+/**
+ * `@businessdash/sdk/account` — the framework-agnostic customer session and
+ * followers cores.
+ *
+ * Source-shipped bindings import through this public subpath, as they do for
+ * `forms`, `store`, `chat` and `blog`.
+ *
+ * @module
+ */
+
+export * from "./account-core/index.js";