@businessdash/sdk 0.9.60 → 0.9.80

package/dist/index.cjs

@@ -9724,12 +9724,31 @@ var chatbotFormDefinitionSchema = external_exports.object({
   description: external_exports.string(),
   fields: external_exports.array(chatbotFormFieldSchema),
   addsInquiry: external_exports.boolean(),
-  addsLead: external_exports.boolean()
-});
+  addsLead: external_exports.boolean(),
+  /**
+   * The RENDER contract — animation, multi-step + progress style, exit
+   * confirmation, URL safety. The server has always sent this; the schema
+   * dropped it, so anyone building a form UI on the typed client got a
+   * bare field list and none of the behaviour the dashboard configured.
+   */
+  settings: external_exports.record(external_exports.unknown()).nullish(),
+  /** Org avatar for the form header, when the form opts in. */
+  orgIcon: external_exports.string().nullish(),
+  /** Public action previews ("submitting adds you to the list"). */
+  actions: external_exports.array(external_exports.record(external_exports.unknown())).nullish(),
+  /** Non-sensitive business functions so `calculation` fields compute. */
+  businessFunctions: external_exports.array(external_exports.record(external_exports.unknown())).nullish()
+}).passthrough();
 var chatbotFormSubmitInputSchema = external_exports.object({
   data: external_exports.record(external_exports.unknown()),
   submitterEmail: external_exports.string().email().optional(),
   submitterName: external_exports.string().optional(),
+  /** Validate and run the full pipeline WITHOUT persisting. */
+  dryRun: external_exports.boolean().optional(),
+  /** Provenance the route accepts and this schema previously omitted. */
+  source: external_exports.string().max(200).optional(),
+  referrer: external_exports.string().max(500).optional(),
+  metadata: external_exports.record(external_exports.unknown()).optional(),
   priorChat: external_exports.array(
     external_exports.object({
       role: external_exports.string().min(1).max(40),
@@ -9740,8 +9759,14 @@ var chatbotFormSubmitInputSchema = external_exports.object({
 });
 var chatbotFormSubmitResponseSchema = external_exports.object({
   success: external_exports.literal(true),
-  submissionId: external_exports.string(),
-  slug: external_exports.string()
+  /**
+   * NULL on a dry run — the submission validated but was deliberately not
+   * persisted. Requiring a string here made every test submit throw.
+   */
+  submissionId: external_exports.string().nullable(),
+  slug: external_exports.string(),
+  /** True when nothing was written. Pairs with a null `submissionId`. */
+  dryRun: external_exports.boolean().optional()
 });
 var chatbotPersistedSessionInputSchema = external_exports.object({
   visitorToken: external_exports.string().min(8).max(200),
@@ -9958,6 +9983,29 @@ var customerPortalProfileSchema = external_exports.object({
   lastSeenAt: timestampSchema.nullable(),
   joinedAt: timestampSchema.nullable()
 }).nullable();
+var customerPortalQuizResultSchema = external_exports.object({
+  invitationId: external_exports.string(),
+  quizName: external_exports.string(),
+  competency: external_exports.string().nullable(),
+  status: external_exports.string(),
+  completedAt: external_exports.string().nullable(),
+  scoreWithheld: external_exports.boolean(),
+  result: external_exports.object({
+    status: external_exports.string(),
+    scorePercent: external_exports.number().nullable(),
+    provisionalScorePercent: external_exports.number().nullable(),
+    passed: external_exports.boolean().nullable(),
+    pointsEarned: external_exports.number().nullable(),
+    pointsPossible: external_exports.number().nullable(),
+    passingScore: external_exports.number(),
+    results: external_exports.array(external_exports.record(external_exports.unknown())),
+    submittedAt: external_exports.string().nullable(),
+    durationSeconds: external_exports.number().nullable()
+  }).nullable()
+});
+var customerPortalQuizResultsResponseSchema = external_exports.object({
+  items: external_exports.array(customerPortalQuizResultSchema)
+});
 var customerPortalUpdateProfileInputSchema = external_exports.object({
   displayName: external_exports.string().min(1).max(120).optional(),
   profile: external_exports.record(external_exports.unknown()).optional()
@@ -10342,6 +10390,16 @@ var customerReturnRequestSchema = external_exports.object({
    * are separate enums and each is spelled as the database spells it.
    */
   status: openEnum("requested", "approved", "denied", "refunded", "cancelled"),
+  /**
+   * What was asked for: money back, or a replacement. Mirrors
+   * `order_return_request_kind`. Rows created before this existed read
+   * `refund`, which is what they were.
+   */
+  kind: openEnum("refund", "exchange"),
+  /** On an exchange: the variant wanted instead, when one was chosen. */
+  exchangeForVariantId: external_exports.string().nullable(),
+  /** Set once a replacement ships — track it like any other shipment. */
+  exchangeShipmentId: external_exports.string().nullable(),
   reason: external_exports.string().nullable(),
   items: external_exports.array(
     external_exports.object({
@@ -10383,6 +10441,16 @@ var customerOrderDetailSchema = external_exports.object({
   returnRequests: external_exports.array(customerReturnRequestSchema).optional()
 });
 var customerReturnRequestInputSchema = external_exports.object({
+  /**
+   * `refund` returns the money; `exchange` asks for a replacement. Defaults
+   * to `refund`, so an omitted field means what it always meant.
+   */
+  kind: external_exports.enum(["refund", "exchange"]).optional(),
+  /**
+   * On an exchange, the variant wanted instead. Optional even then — "a
+   * different size" is a real request that needs a conversation first.
+   */
+  exchangeForVariantId: external_exports.string().uuid().optional(),
   reason: external_exports.string().max(120).optional(),
   customerNote: external_exports.string().max(2e3).optional(),
   items: external_exports.array(
@@ -10396,6 +10464,262 @@ var customerReturnRequestCreatedSchema = external_exports.object({
   id: external_exports.string().nullable(),
   /** Mirrors the `order_return_request_status` pg enum. */
   status: openEnum("requested", "approved", "denied", "refunded", "cancelled"),
+  /** Echoes back what was opened, so a UI need not assume. */
+  kind: openEnum("refund", "exchange"),
+  createdAt: external_exports.string().nullable()
+});
+var customerNotReceivedResultSchema = external_exports.object({
+  id: external_exports.string(),
+  /** True when a claim was already open; the original report is unchanged. */
+  alreadyOpen: external_exports.boolean(),
+  reportedAt: external_exports.string(),
+  carrierStatus: openEnum(
+    "pending",
+    "label_created",
+    "in_transit",
+    "delivered",
+    "returned"
+  ),
+  carrierDeliveredAt: external_exports.string().nullable(),
+  contested: external_exports.boolean().optional()
+});
+var legalPresentationSchema = external_exports.object({
+  /** Already resolved against the company logo — render as given. */
+  logoUrl: external_exports.string().nullable(),
+  showLogoInHeader: external_exports.boolean(),
+  showLogoInFooter: external_exports.boolean(),
+  headerHtml: external_exports.string().nullable(),
+  footerHtml: external_exports.string().nullable()
+});
+var legalDocumentSummarySchema = external_exports.object({
+  /** The URL path, without a leading slash: `privacy`, `terms`, … */
+  slug: external_exports.string(),
+  title: external_exports.string(),
+  version: external_exports.number(),
+  /** ISO 8601. Render as "Last updated". */
+  effectiveDate: external_exports.string().nullable(),
+  showInFooter: external_exports.boolean(),
+  updatedAt: external_exports.string()
+});
+var legalListResponseSchema = external_exports.object({
+  items: external_exports.array(legalDocumentSummarySchema),
+  presentation: legalPresentationSchema
+});
+var legalDocumentSchema = legalDocumentSummarySchema.extend({
+  /** Sanitised server-side on write, so this is safe to render as HTML. */
+  contentHtml: external_exports.string(),
+  presentation: legalPresentationSchema
+});
+var customerPushDeviceSchema = external_exports.object({
+  id: external_exports.string(),
+  endpoint: external_exports.string(),
+  userAgent: external_exports.string().nullable(),
+  label: external_exports.string().nullable(),
+  /** Null = every category. `[]` = none, but the device stays registered. */
+  categories: external_exports.array(external_exports.string()).nullable(),
+  lastSeenAt: external_exports.string().nullable(),
+  createdAt: external_exports.string()
+});
+var customerPushConfigSchema = external_exports.object({
+  vapidPublicKey: external_exports.string().nullable(),
+  enabled: external_exports.boolean(),
+  devices: external_exports.array(customerPushDeviceSchema)
+});
+var customerInviteResendResponseSchema = external_exports.object({
+  id: external_exports.string(),
+  /** The NEW link. The previous one no longer works. */
+  url: external_exports.string(),
+  expiresAt: external_exports.string().nullable(),
+  /** Includes this send, so a list can show "sent 3 times". */
+  sendCount: external_exports.number()
+});
+var schedulingEventTypeSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  slug: external_exports.string(),
+  description: external_exports.string().nullable(),
+  durationMinutes: external_exports.number(),
+  locationType: external_exports.string(),
+  /** google_meet | zoom | teams | null when the meeting is in person. */
+  meetingProvider: external_exports.string().nullable(),
+  color: external_exports.string().nullable(),
+  /** When true a booking lands `pending`, not `confirmed`. */
+  requiresApproval: external_exports.boolean()
+});
+var schedulingQuestionSchema = external_exports.object({
+  id: external_exports.string(),
+  label: external_exports.string()
+}).passthrough();
+var schedulingEventTypeListSchema = external_exports.object({
+  eventTypes: external_exports.array(schedulingEventTypeSchema)
+});
+var schedulingEventTypeDetailSchema = external_exports.object({
+  eventType: schedulingEventTypeSchema,
+  questions: external_exports.array(schedulingQuestionSchema)
+});
+var schedulingSlotSchema = external_exports.object({
+  startAt: external_exports.string(),
+  endAt: external_exports.string()
+});
+var schedulingSlotsResponseSchema = external_exports.object({
+  slots: external_exports.array(schedulingSlotSchema)
+});
+var schedulingBookingStatusSchema = openEnum(
+  "pending",
+  "confirmed",
+  "canceled",
+  "rescheduled"
+);
+var schedulingBookingViewSchema = external_exports.object({
+  booking: external_exports.object({
+    id: external_exports.string(),
+    startAt: external_exports.string(),
+    endAt: external_exports.string(),
+    status: schedulingBookingStatusSchema,
+    title: external_exports.string(),
+    notes: external_exports.string().nullable(),
+    /** The conference URL, once there is one. */
+    conferenceLink: external_exports.string().nullable()
+  }),
+  invitee: external_exports.object({ name: external_exports.string(), email: external_exports.string(), timezone: external_exports.string() }).nullable()
+});
+var schedulingBookingResultSchema = external_exports.object({
+  bookingId: external_exports.string(),
+  status: schedulingBookingStatusSchema,
+  /**
+   * Three separate signed tokens, deliberately.
+   *
+   * A cancel link in an email must not also be able to reschedule, and
+   * neither should read the whole booking. Handing out one token for all
+   * three would make every emailed link as powerful as the strongest
+   * action it enables.
+   */
+  manageToken: external_exports.string(),
+  rescheduleToken: external_exports.string(),
+  cancelToken: external_exports.string()
+}).passthrough();
+var schedulingRescheduleResultSchema = external_exports.object({
+  bookingId: external_exports.string(),
+  startAt: external_exports.string(),
+  endAt: external_exports.string(),
+  /** Re-minted on reschedule — read it back rather than reusing the old one. */
+  conferenceLink: external_exports.string().nullable().optional()
+}).passthrough();
+var schedulingCancelResultSchema = external_exports.object({ ok: external_exports.boolean() }).passthrough();
+var customerSubscriptionOfferingSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  description: external_exports.string().nullable(),
+  imageUrl: external_exports.string().nullable(),
+  amountCents: external_exports.number(),
+  interval: external_exports.string()
+});
+var customerSubscriptionSchema = external_exports.object({
+  /** active | expired | cancelled | pending | failed */
+  status: openEnum("active", "expired", "cancelled", "pending", "failed"),
+  /** trial | monthly_subscribed | annual_subscribed | lifetime */
+  type: openEnum(
+    "trial",
+    "monthly_subscribed",
+    "annual_subscribed",
+    "lifetime"
+  ).nullable(),
+  /**
+   * The entitlement decision, computed server-side by the same function the
+   * content gates use.
+   *
+   * **Render from this, not from `status`.** Two cases break a naive
+   * `status === "active"` check: a lifetime purchase has no period to expire,
+   * and a cancelled subscription keeps access until the period already paid
+   * for runs out.
+   */
+  hasAccess: external_exports.boolean(),
+  /**
+   * Cancelled, but the paid period has not ended. The honest label is
+   * "active until {expiresAt}" — not "cancelled".
+   */
+  cancelledButActive: external_exports.boolean(),
+  startedAt: external_exports.string().nullable(),
+  /** End of the paid period. Null for lifetime. */
+  expiresAt: external_exports.string().nullable(),
+  cancelledAt: external_exports.string().nullable(),
+  renewedAt: external_exports.string().nullable(),
+  trialEndsAt: external_exports.string().nullable(),
+  trialUsed: external_exports.boolean(),
+  provider: external_exports.string().nullable(),
+  /** The offering they are on, when it still exists. */
+  plan: customerSubscriptionOfferingSchema.nullable(),
+  /** Null means the plan includes no service calls at all. */
+  includedServiceCallsPerPeriod: external_exports.number().nullable(),
+  serviceCallsUsedInPeriod: external_exports.number(),
+  periodStartedAt: external_exports.string().nullable()
+});
+var customerSubscriptionResponseSchema = external_exports.object({
+  /** Null when this customer has never subscribed to this org. */
+  subscription: customerSubscriptionSchema.nullable(),
+  /** The org's live offerings, cheapest first. */
+  offerings: external_exports.array(customerSubscriptionOfferingSchema)
+});
+var customerSubscriptionCancelResponseSchema = external_exports.object({
+  /** True when a cancellation is now pending at the end of the period. */
+  cancelAtPeriodEnd: external_exports.boolean(),
+  resumed: external_exports.boolean(),
+  /**
+   * Access continues until this moment. Say "active until {this}", because
+   * that is what is true — cancelling ends the renewal, not the access.
+   */
+  accessUntil: external_exports.string().nullable(),
+  /**
+   * The stored status still reads its old value until the provider's webhook
+   * lands. Render from `cancelAtPeriodEnd`, not from a re-read.
+   */
+  statusPending: external_exports.boolean()
+});
+var customerSubscriberContentItemSchema = external_exports.object({
+  id: external_exports.string(),
+  slug: external_exports.string(),
+  title: external_exports.string(),
+  /** The pitch. Travels even when locked — the BODY never does. */
+  excerpt: external_exports.string().nullable(),
+  featuredImageUrl: external_exports.string().nullable(),
+  publishedAt: external_exports.string().nullable(),
+  tags: external_exports.array(external_exports.string()),
+  accessLevel: external_exports.string(),
+  downloadAccessLevel: external_exports.string(),
+  /** False when the post is readable but its downloads are not. */
+  downloadsAvailable: external_exports.boolean()
+});
+var customerSubscriberContentResponseSchema = external_exports.object({
+  items: external_exports.array(customerSubscriberContentItemSchema),
+  /**
+   * False means these are LOCKED previews, not an empty entitlement. Show
+   * them with the offer — an empty list would hide the pitch at exactly the
+   * moment it is most relevant.
+   */
+  entitled: external_exports.boolean()
+});
+var customerProductReviewSchema = external_exports.object({
+  id: external_exports.string(),
+  productId: external_exports.string(),
+  productName: external_exports.string(),
+  rating: external_exports.number(),
+  content: external_exports.string(),
+  /**
+   * False means QUEUED for the org to approve, not rejected. Surface it as
+   * "awaiting review" — a customer who thinks their review vanished writes it
+   * again, or writes to support.
+   */
+  isApproved: external_exports.boolean(),
+  createdAt: external_exports.string()
+});
+var customerProductReviewListSchema = external_exports.object({
+  items: external_exports.array(customerProductReviewSchema)
+});
+var customerProductReviewCreatedSchema = external_exports.object({
+  id: external_exports.string().nullable(),
+  isApproved: external_exports.boolean(),
+  /** The inverse of `isApproved`, named for what the UI should say. */
+  awaitingModeration: external_exports.boolean(),
   createdAt: external_exports.string().nullable()
 });
 var customerDownloadSchema = external_exports.object({
@@ -10439,6 +10763,75 @@ var siteBrandingSchema = external_exports.object({
   orgName: external_exports.string().nullable(),
   orgIcon: external_exports.string().nullable()
 });
+var customerInvoiceListResponseSchema = external_exports.object({
+  items: external_exports.array(customerInvoiceSummarySchema)
+});
+var customerQuoteListResponseSchema = external_exports.object({
+  items: external_exports.array(customerQuoteSummarySchema)
+});
+var customerContractListResponseSchema = external_exports.object({
+  items: external_exports.array(customerContractSummarySchema)
+});
+var customerShipmentSummarySchema = external_exports.object({
+  id: external_exports.string(),
+  orderId: external_exports.string(),
+  orderNumber: external_exports.string().nullable(),
+  carrier: external_exports.string().nullable(),
+  trackingNumber: external_exports.string().nullable(),
+  trackingUrl: external_exports.string().nullable(),
+  serviceName: external_exports.string().nullable(),
+  status: external_exports.string(),
+  /** A date STRING, not a timestamp — the column is text. */
+  estimatedDelivery: external_exports.string().nullable(),
+  shippedAt: external_exports.string().nullable(),
+  deliveredAt: external_exports.string().nullable()
+});
+var customerShipmentListResponseSchema = external_exports.object({
+  items: external_exports.array(customerShipmentSummarySchema)
+});
+var customerPortalMessageSchema = external_exports.object({
+  id: external_exports.string(),
+  /** `inbound` = the customer wrote it; `outbound` = staff did. */
+  direction: openEnum("inbound", "outbound"),
+  channel: openEnum("portal", "email", "sms"),
+  authorName: external_exports.string().nullable(),
+  body: external_exports.string(),
+  attachment: external_exports.object({
+    url: external_exports.string(),
+    name: external_exports.string(),
+    mimeType: external_exports.string(),
+    sizeBytes: external_exports.number()
+  }).nullable(),
+  jobId: external_exports.string().nullable(),
+  readByCustomerAt: external_exports.string().nullable(),
+  createdAt: external_exports.string()
+});
+var customerPortalMessageListResponseSchema = external_exports.object({
+  items: external_exports.array(customerPortalMessageSchema)
+});
+var customerPortalMessagePostInputSchema = external_exports.object({
+  body: external_exports.string().min(1).max(4e3),
+  /** Thread the message under a specific job. */
+  jobId: external_exports.string().uuid().optional()
+});
+var customerPortalMessagesMarkReadResponseSchema = external_exports.object({
+  marked: external_exports.number()
+});
+var customerReturnRequestStatusSchema = external_exports.object({
+  id: external_exports.string(),
+  /** Mirrors the `order_return_request_status` pg enum. */
+  status: openEnum("requested", "approved", "denied", "refunded", "cancelled"),
+  reason: external_exports.string().nullable(),
+  customerNote: external_exports.string().nullable(),
+  /** Staff's answer. The whole point when a return is denied. */
+  resolutionNote: external_exports.string().nullable(),
+  items: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())).nullable(),
+  resolvedAt: external_exports.string().nullable(),
+  createdAt: external_exports.string()
+});
+var customerReturnRequestListResponseSchema = external_exports.object({
+  items: external_exports.array(customerReturnRequestStatusSchema)
+});
 var customerReviewSummarySchema = external_exports.object({
   id: external_exports.string(),
   rating: external_exports.number().int(),
@@ -10489,7 +10882,19 @@ var customerContactCompanyResponseSchema = external_exports.object({
 var customerJobEtaAssignmentSchema = external_exports.object({
   displayName: external_exports.string(),
   role: external_exports.string().nullable(),
-  dispatchStatus: external_exports.string(),
+  /**
+   * This technician's own stage. `openEnum` because the column is TEXT and
+   * an org's board can grow a value before the SDK knows about it — an
+   * unknown status should render as itself, not break the response.
+   */
+  dispatchStatus: openEnum(
+    "pending",
+    "en_route",
+    "on_site",
+    "in_progress",
+    "completed",
+    "declined"
+  ),
   lastKnownLocation: external_exports.object({
     lat: external_exports.number(),
     lng: external_exports.number(),
@@ -10497,6 +10902,35 @@ var customerJobEtaAssignmentSchema = external_exports.object({
   }).nullable()
 });
 var customerJobEtaResponseSchema = external_exports.object({
+  /**
+   * Where the JOB is — promoted from the assignees by the dispatch board,
+   * NOT the same as any one technician's status.
+   *
+   * The promotion rules are why this is returned rather than left to the
+   * consumer: `en_route`/`arrived`/`started` land on the FIRST assignee to
+   * reach them, while `completed` waits for the LAST. Aggregating that
+   * client-side gets it wrong in the direction that tells a customer the work
+   * is finished when one of three techs has packed up.
+   */
+  dispatchStatus: openEnum(
+    "unscheduled",
+    "scheduled",
+    "en_route",
+    "arrived",
+    "started",
+    "completed"
+  ),
+  /**
+   * When each stage happened. A customer reading "en route" wants to know
+   * since when — a status with no timestamp is why people phone to ask.
+   */
+  timeline: external_exports.object({
+    scheduledStartAt: external_exports.string().nullable(),
+    enRouteAt: external_exports.string().nullable(),
+    arrivedAt: external_exports.string().nullable(),
+    startedAt: external_exports.string().nullable(),
+    completedAt: external_exports.string().nullable()
+  }),
   assignments: external_exports.array(customerJobEtaAssignmentSchema),
   eta: external_exports.object({
     seconds: external_exports.number().nullable(),
@@ -10636,12 +11070,83 @@ var storefrontProductRowSchema = external_exports.object({
   /** Resolved category (name/description), when the product is categorized. */
   category: storefrontProductCategorySchema.nullable().optional(),
   images: external_exports.array(external_exports.string()).nullable().optional(),
+  /**
+   * Web-renderable 3D model — `.glb`, `.gltf`, `.obj` or `.stl`.
+   *
+   * All four fields below are ABSENT (not null) unless the org has the
+   * `ecommerce.product_3d` add-on. Absence is the normal case: most
+   * businesses do not sell anything with a model. Use
+   * `@businessdash/sdk/model3d` to turn these into something renderable.
+   */
+  model3dUrl: external_exports.string().nullable().optional(),
+  /** Apple AR Quick Look companion, `.usdz`. iOS/iPadOS/visionOS Safari. */
+  model3dUsdzUrl: external_exports.string().nullable().optional(),
+  /**
+   * True when the org attached a CAD file (`.step`/`.iges`/native).
+   *
+   * The URL itself is deliberately NOT here. CAD files are the largest
+   * thing the platform serves and are the org's intellectual property, so
+   * they are issued by `GET storefront/products/{id}/cad`, which requires
+   * cookies, rate-limits the caller and re-checks the entitlement.
+   * Publishing the raw URL in a payload any visitor can fetch would route
+   * around all three.
+   */
+  model3dCadAvailable: external_exports.boolean().optional(),
+  /** Filename for the download link — "bracket-v3.step". */
+  model3dCadName: external_exports.string().nullable().optional(),
   createdAt: external_exports.string()
 }).passthrough();
 var storefrontListProductsResponseSchema = external_exports.object({
   items: external_exports.array(storefrontProductRowSchema),
   nextCursor: external_exports.number().nullable()
 });
+var couponSchema = external_exports.object({
+  id: external_exports.string(),
+  code: external_exports.string(),
+  discountType: external_exports.string(),
+  value: external_exports.number(),
+  isActive: external_exports.boolean(),
+  maxUses: external_exports.number().nullable(),
+  usedCount: external_exports.number(),
+  validUntil: external_exports.string().nullable(),
+  stripeCouponId: external_exports.string().nullable(),
+  stripePromotionCodeId: external_exports.string().nullable()
+});
+var couponCreateInputSchema = external_exports.object({
+  code: external_exports.string().min(3).max(64),
+  discountType: external_exports.enum(["percent", "amount"]),
+  value: external_exports.number().positive(),
+  validFrom: external_exports.coerce.date().optional(),
+  validUntil: external_exports.coerce.date().nullish(),
+  maxUses: external_exports.number().int().positive().nullish(),
+  isActive: external_exports.boolean().optional(),
+  duration: external_exports.enum(["once", "forever", "repeating"]).optional(),
+  durationInMonths: external_exports.number().int().positive().nullish(),
+  appliesTo: external_exports.enum(["order", "shipping", "both"]).optional()
+});
+var couponCreateResponseSchema = external_exports.object({
+  coupon: couponSchema,
+  stripeSynced: external_exports.boolean(),
+  stripeError: external_exports.string().nullable()
+});
+var couponListResponseSchema = external_exports.object({
+  coupons: external_exports.array(couponSchema)
+});
+var storefrontSyncToStripeResponseSchema = external_exports.object({
+  synced: external_exports.array(
+    external_exports.object({
+      productId: external_exports.string(),
+      stripeProductId: external_exports.string(),
+      /** Variant combinations that got a Stripe Price. */
+      combinationsSynced: external_exports.number()
+    })
+  ),
+  failed: external_exports.array(external_exports.object({ productId: external_exports.string(), error: external_exports.string() })),
+  /** Products still unsynced after this call — keep calling until 0. */
+  remaining: external_exports.number(),
+  /** Connected account written to; null means the platform account. */
+  connectedAccountId: external_exports.string().nullable()
+});
 var storefrontProductDetailSchema = storefrontProductRowSchema.and(
   external_exports.object({
     variants: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())),
@@ -11163,6 +11668,8 @@ var bundleCompanySchema = external_exports.object({
 });
 var bundleGalleryItemSchema = external_exports.object({
   id: external_exports.string(),
+  /** Sent by the server on every item and dropped here until now. */
+  description: external_exports.string().nullish(),
   type: external_exports.enum(["image", "video"]),
   src: external_exports.string(),
   width: external_exports.number().nullable(),
@@ -11778,6 +12285,10 @@ var BiabDevClient = class {
   get shipping() {
     return new BiabDevShippingClient(this);
   }
+  /** Customer-portal invitations — currently resend. */
+  get customerInvites() {
+    return new BiabDevCustomerInvitesClient(this);
+  }
   get notifications() {
     return new BiabDevNotificationsClient(this);
   }
@@ -11790,10 +12301,29 @@ var BiabDevClient = class {
   get reviews() {
     return new BiabDevReviewsClient(this);
   }
+  /**
+   * Tracking consent for this org's site.
+   *
+   * Pair with `@businessdash/sdk/consent`, which handles the visitor cookie
+   * and gives you a gate to check before starting analytics.
+   */
+  get consent() {
+    return new BiabDevConsentClient(this);
+  }
   /** Public job postings — build a careers page on your own domain. */
   get hiring() {
     return new BiabDevHiringClient(this);
   }
+  /**
+   * The org's published legal pages — privacy, terms, refund policy, whatever
+   * they authored in the dashboard.
+   *
+   * Pair with `@businessdash/sdk/legal` to render them without writing a page
+   * per document.
+   */
+  get legal() {
+    return new BiabDevLegalClient(this);
+  }
   get chatbot() {
     return new BiabDevChatbotClient(this);
   }
@@ -11861,6 +12391,7 @@ var BiabDevSiteClient = class {
     this.client = client;
     this.siteId = siteId;
     this.collections = new BiabDevCollectionsClient(client, siteId);
+    this.scheduling = new BiabDevSchedulingClient(client, siteId);
     this.rows = new BiabDevRowsClient(client, siteId);
     this.dataModel = new BiabDevDataModelClient(client, siteId);
     this.analytics = new BiabDevAnalyticsClient(client, siteId);
@@ -11905,6 +12436,14 @@ var BiabDevSiteClient = class {
    */
   marketing;
   parallelPages;
+  /**
+   * Booking and conference calls.
+   *
+   * Previously reachable only through `sdk.ts`'s separate scheduling
+   * resource, which is why the OpenAPI generator — which reads this file —
+   * never saw it, and why no non-JS starter had scheduling at all.
+   */
+  scheduling;
   /**
    * The org's storefront branding — logo + favicon (site static media) plus
    * the org name + icon. Render the masthead/favicon/og without the org
@@ -11916,6 +12455,27 @@ var BiabDevSiteClient = class {
    * <img src={b.logoUrl ?? b.orgIcon ?? ""} alt={b.orgName ?? ""} />
    * ```
    */
+  /**
+   * Every URL the PLATFORM owns the shape of, as JSON.
+   *
+   * Published site-builder pages, published legal documents, and every
+   * materialised programmatic-page URL. Blog posts and products are not here
+   * — the platform does not know where your site renders them. Merge those in
+   * with `@businessdash/sdk/sitemap`, which handles the whole job.
+   *
+   * Paths are relative, so you join them against your own origin rather than
+   * the org's primary verified domain.
+   */
+  async sitemapEntries() {
+    return this.client.request({
+      path: `sites/${encodeURIComponent(this.siteId)}/sitemap-entries`,
+      responseSchema: external_exports.object({
+        entries: external_exports.array(
+          external_exports.object({ loc: external_exports.string(), lastmod: external_exports.string().optional() })
+        )
+      })
+    });
+  }
   async branding() {
     return this.client.request({
       path: `sites/${encodeURIComponent(this.siteId)}/branding`,
@@ -12548,6 +13108,42 @@ var BiabDevStorefrontClient = class {
       responseSchema: storefrontSessionResponseSchema
     });
   }
+  /**
+   * Push your catalog into YOUR OWN Stripe account.
+   *
+   * Products and their variant combinations become Stripe Products and
+   * Prices on the Stripe account connected to your workspace, so you can
+   * manage the catalog here and let Stripe be the system of record for
+   * money. Safe to re-run: an unchanged product is left alone, and a new
+   * Price is minted only when the amount actually changed (Stripe Prices
+   * are immutable on amount).
+   *
+   * Requires a SECRET key holding `storefront:write` — never a publishable
+   * token, because this spends against Stripe on your behalf.
+   *
+   * Pass `productId` to sync one product. Omit it to sync everything not yet
+   * pushed, in bounded batches: check `remaining` and call again until it
+   * reaches 0.
+   *
+   * ```ts
+   * let remaining = 1;
+   * while (remaining > 0) {
+   *   const res = await biab.storefront.syncToStripe();
+   *   remaining = res.remaining;
+   * }
+   * ```
+   *
+   * Per-product failures are returned in `failed` rather than throwing, so
+   * one bad product doesn't abandon the batch.
+   */
+  async syncToStripe(input) {
+    return this.client.request({
+      method: "POST",
+      path: "storefront/products/sync-to-stripe",
+      body: input?.productId ? { productId: input.productId } : {},
+      responseSchema: storefrontSyncToStripeResponseSchema
+    });
+  }
   /**
    * Paginated list of live products for the calling org's storefront.
    * Cursor is an opaque integer offset — pass back the response's
@@ -12602,6 +13198,38 @@ var BiabDevStorefrontClient = class {
    * via `BiabApiError` if the product isn't live or doesn't belong
    * to the org bound to the API key.
    */
+  /**
+   * The CAD file for a product — STEP, IGES, or a native part file.
+   *
+   * ## Call this from YOUR server, then proxy it
+   *
+   * The API key is a server secret, so a browser cannot reach this directly.
+   * Expose your own route (`/api/products/:id/cad`), call this behind it, and
+   * redirect the visitor to the URL it returns.
+   *
+   * The platform withholds the raw URL from every product payload on purpose:
+   * CAD files are the largest thing it serves and are the org's intellectual
+   * property, so a catalog of naked URLs is a design library published to
+   * anyone willing to write a loop. This endpoint requires a `biab_cad` cookie
+   * on the incoming request, rate-limits per IP, and re-checks the
+   * `ecommerce.product_3d` entitlement before answering.
+   *
+   * `cacheSeconds` is what to put on your own response — CAD at a content URL
+   * does not change, so caching hard is where the bandwidth saving comes from.
+   *
+   * Rejects 404 when the product is a draft, has no CAD file, or the org lacks
+   * the add-on. Those are deliberately one answer.
+   */
+  async getCadDownload(productId) {
+    return this.client.request({
+      path: `storefront/products/${encodeURIComponent(productId)}/cad`,
+      responseSchema: external_exports.object({
+        url: external_exports.string(),
+        fileName: external_exports.string().nullable(),
+        cacheSeconds: external_exports.number()
+      })
+    });
+  }
   async getProduct(productId) {
     return this.client.request({
       path: `storefront/products/${encodeURIComponent(productId)}`,
@@ -12942,6 +13570,47 @@ var BiabDevCouponsClient = class {
    * else toast.error(result.message);
    * ```
    */
+  /**
+   * Create a coupon and make it live in YOUR OWN Stripe account in one call —
+   * a Stripe Coupon plus a Promotion Code, so the same string works on your
+   * storefront and on Stripe-hosted Checkout.
+   *
+   * Creation and the Stripe sync are one operation deliberately: a coupon
+   * that exists locally but not in Stripe is the failure worth designing out,
+   * where a customer types a code your storefront accepts and Stripe rejects.
+   * If the sync fails the coupon is still created and `stripeSynced` comes
+   * back `false` with the reason, rather than pretending it is live.
+   *
+   * Requires a SECRET key holding `storefront:write`.
+   *
+   * ```ts
+   * const { coupon, stripeSynced } = await biab.coupons.create({
+   *   code: 'WELCOME10',
+   *   discountType: 'percent',
+   *   value: 10,
+   * })
+   * ```
+   *
+   * Buy-X-get-Y and bundle-gift coupons aren't available here — Stripe has no
+   * native BXGY, so those run through our own cart math and need the offer
+   * rows the dashboard collects.
+   */
+  async create(input) {
+    const body = couponCreateInputSchema.parse(input);
+    return this.client.request({
+      method: "POST",
+      path: "coupons",
+      body,
+      responseSchema: couponCreateResponseSchema
+    });
+  }
+  /** Every coupon on the workspace, newest first. Requires `storefront:write`. */
+  async list() {
+    return this.client.request({
+      path: "coupons",
+      responseSchema: couponListResponseSchema
+    });
+  }
   async validate(code) {
     const body = couponValidateInputSchema.parse({ code });
     return this.client.request({
@@ -13288,35 +13957,110 @@ var BiabDevHiringClient = class {
     });
   }
 };
-var BiabDevChatbotClient = class {
+var BiabDevLegalClient = class {
   constructor(client) {
     this.client = client;
   }
   client;
-  /** Returns the iframe URL for `<Chatbot/>`. */
-  async createSession() {
-    return this.client.request({
-      method: "POST",
-      path: "chatbot/session",
-      responseSchema: chatbotSessionResponseSchema
-    });
-  }
-  /** Reads the org's persisted chatbot config (system prompt, KB, model). */
-  async getConfig() {
+  /**
+   * Every published document, plus the header/footer presentation.
+   *
+   * Both in one response because the common use — a footer link list — needs
+   * the titles and the presentation together, and a second round trip for the
+   * latter is one a site either makes on every page or skips entirely.
+   */
+  async list() {
     return this.client.request({
-      method: "GET",
-      path: "chatbot/config",
-      responseSchema: chatbotConfigSchema
+      path: "legal",
+      responseSchema: legalListResponseSchema
     });
   }
   /**
-   * Persists the org's chatbot config. Requires `chatbot:write` scope on the
-   * API key — typically only used by admin tools, not embedded widgets.
+   * One document by slug, body included.
+   *
+   * Rejects with a 404 when the slug is unpublished or absent — the two are
+   * deliberately indistinguishable, since "exists but hidden" would leak that
+   * an org is drafting a policy and is not something a caller can act on.
    */
-  async updateConfig(input) {
-    const body = chatbotConfigUpdateInputSchema.parse(input);
+  async get(slug) {
     return this.client.request({
-      method: "PATCH",
+      path: `legal/${encodeURIComponent(slug)}`,
+      responseSchema: legalDocumentSchema
+    });
+  }
+};
+var consentStateSchema = external_exports.object({
+  /** Categories this org uses at all — one banner row each. */
+  categories: external_exports.array(external_exports.string()),
+  noticeText: external_exports.string().nullable(),
+  noticeVersion: external_exports.number(),
+  /** What may be used right now. */
+  allowed: external_exports.array(external_exports.string()),
+  mustAsk: external_exports.boolean(),
+  reason: external_exports.string()
+});
+var BiabDevConsentClient = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** The notice to show, and what this visitor currently allows. */
+  async get(visitorKey) {
+    return this.client.request({
+      path: "consent",
+      responseSchema: consentStateSchema,
+      ...visitorKey ? { headers: { "x-biab-visitor": visitorKey } } : {}
+    });
+  }
+  /**
+   * Record the visitor's answer.
+   *
+   * `granted: []` is a real answer — "asked, refused everything" — and is
+   * stored as one, so the banner does not reappear on the next page.
+   */
+  async record(input) {
+    return this.client.request({
+      method: "POST",
+      path: "consent",
+      body: {
+        granted: input.granted,
+        noticeVersion: input.noticeVersion,
+        source: input.source ?? "banner"
+      },
+      headers: { "x-biab-visitor": input.visitorKey },
+      responseSchema: external_exports.object({ ok: external_exports.boolean() })
+    });
+  }
+};
+var BiabDevChatbotClient = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** Returns the iframe URL for `<Chatbot/>`. */
+  async createSession() {
+    return this.client.request({
+      method: "POST",
+      path: "chatbot/session",
+      responseSchema: chatbotSessionResponseSchema
+    });
+  }
+  /** Reads the org's persisted chatbot config (system prompt, KB, model). */
+  async getConfig() {
+    return this.client.request({
+      method: "GET",
+      path: "chatbot/config",
+      responseSchema: chatbotConfigSchema
+    });
+  }
+  /**
+   * Persists the org's chatbot config. Requires `chatbot:write` scope on the
+   * API key — typically only used by admin tools, not embedded widgets.
+   */
+  async updateConfig(input) {
+    const body = chatbotConfigUpdateInputSchema.parse(input);
+    return this.client.request({
+      method: "PATCH",
       path: "chatbot/config",
       body,
       responseSchema: chatbotConfigSchema
@@ -13582,6 +14326,23 @@ var BiabDevCustomerPortalClient = class _BiabDevCustomerPortalClient {
       headers: this.headers()
     });
   }
+  /**
+   * The signed-in customer's quiz results at this org — the SDK side of
+   * the account-gated reveal: an invitation completed with "create an
+   * account to see how you did" surfaces its result here (and only to
+   * the invited email). Interview-mode quizzes come back with
+   * `scoreWithheld: true` and no verdict, by the org's own setting.
+   */
+  async myQuizResults(options) {
+    const params = new URLSearchParams();
+    if (options?.token) params.set("token", options.token);
+    const qs = params.toString();
+    return this.client.request({
+      path: `customer-portal/quiz-results${qs ? `?${qs}` : ""}`,
+      responseSchema: customerPortalQuizResultsResponseSchema,
+      headers: this.headers()
+    });
+  }
   async updateProfile(input) {
     const body = customerPortalUpdateProfileInputSchema.parse(input);
     return this.client.request({
@@ -13854,6 +14615,129 @@ var BiabDevCustomerPortalClient = class _BiabDevCustomerPortalClient {
       headers: this.headers()
     });
   }
+  /**
+   * The return requests on one order, newest first.
+   *
+   * `resolutionNote` carries staff's answer — when a return is denied that IS
+   * the answer, and hiding it just moves the question to email.
+   */
+  async listReturnRequests(orderId) {
+    return this.client.request({
+      path: `customer-portal/orders/${encodeURIComponent(orderId)}/return-request`,
+      responseSchema: customerReturnRequestListResponseSchema,
+      headers: this.headers()
+    });
+  }
+  /**
+   * The customer's message thread with the org's staff, newest first.
+   *
+   * Automated rows — the review-ask and similar — are excluded server-side, so
+   * this is only what a person wrote.
+   */
+  async listMessages(opts) {
+    const params = new URLSearchParams();
+    if (typeof opts?.limit === "number")
+      params.set("limit", String(opts.limit));
+    if (opts?.jobId) params.set("jobId", opts.jobId);
+    const qs = params.toString();
+    return this.client.request({
+      path: `customer-portal/messages${qs ? `?${qs}` : ""}`,
+      responseSchema: customerPortalMessageListResponseSchema,
+      headers: this.headers()
+    });
+  }
+  /** Send a message to the org's staff. Lands in the CRM timeline. */
+  async postMessage(input) {
+    return this.client.request({
+      path: "customer-portal/messages",
+      method: "POST",
+      body: input,
+      responseSchema: customerPortalMessageSchema,
+      headers: this.headers()
+    });
+  }
+  /**
+   * Mark the staff messages read up to now.
+   *
+   * One-way: it never clears a stamp. A portal that could un-read a message
+   * would let a customer hide from staff that they had seen something.
+   */
+  async markMessagesRead() {
+    return this.client.request({
+      path: "customer-portal/messages",
+      method: "PATCH",
+      responseSchema: customerPortalMessagesMarkReadResponseSchema,
+      headers: this.headers()
+    });
+  }
+  /**
+   * The customer's invoices, newest first.
+   *
+   * `unpaid: true` filters on the computed BALANCE rather than on the status
+   * string, because a partially-paid invoice still owes money whatever it is
+   * called. This is the call behind "show me everything I owe" — which had no
+   * endpoint at all before 0.9.61.
+   */
+  async listInvoices(opts) {
+    const params = new URLSearchParams();
+    if (typeof opts?.limit === "number")
+      params.set("limit", String(opts.limit));
+    if (opts?.status) params.set("status", opts.status);
+    if (opts?.unpaid) params.set("unpaid", "1");
+    const qs = params.toString();
+    return this.client.request({
+      path: `customer-portal/invoices${qs ? `?${qs}` : ""}`,
+      responseSchema: customerInvoiceListResponseSchema,
+      headers: this.headers()
+    });
+  }
+  /** The customer's quotes. `status: "sent"` is the set still awaiting them. */
+  async listQuotes(opts) {
+    const params = new URLSearchParams();
+    if (typeof opts?.limit === "number")
+      params.set("limit", String(opts.limit));
+    if (opts?.status) params.set("status", opts.status);
+    const qs = params.toString();
+    return this.client.request({
+      path: `customer-portal/quotes${qs ? `?${qs}` : ""}`,
+      responseSchema: customerQuoteListResponseSchema,
+      headers: this.headers()
+    });
+  }
+  /** The customer's contracts. `status: "sent"` still awaits a signature. */
+  async listContracts(opts) {
+    const params = new URLSearchParams();
+    if (typeof opts?.limit === "number")
+      params.set("limit", String(opts.limit));
+    if (opts?.status) params.set("status", opts.status);
+    const qs = params.toString();
+    return this.client.request({
+      path: `customer-portal/contracts${qs ? `?${qs}` : ""}`,
+      responseSchema: customerContractListResponseSchema,
+      headers: this.headers()
+    });
+  }
+  /**
+   * Every shipment across the customer's orders. `active: true` narrows to
+   * parcels still moving.
+   *
+   * STORED status only — no live carrier poll. `trackShipment(id)` spends a
+   * Shippo request because it is one parcel the customer opened; doing that
+   * per row here would mean a carrier call for every parcel in their history
+   * on every page load.
+   */
+  async listShipments(opts) {
+    const params = new URLSearchParams();
+    if (typeof opts?.limit === "number")
+      params.set("limit", String(opts.limit));
+    if (opts?.active) params.set("active", "1");
+    const qs = params.toString();
+    return this.client.request({
+      path: `customer-portal/shipments${qs ? `?${qs}` : ""}`,
+      responseSchema: customerShipmentListResponseSchema,
+      headers: this.headers()
+    });
+  }
   /**
    * The signed-in customer's orders (newest first), each with a shipment
    * roll-up (`overallStatus`, `anyInTransit`, `latestEstimatedDelivery`) for
@@ -13932,6 +14816,243 @@ var BiabDevCustomerPortalClient = class _BiabDevCustomerPortalClient {
       headers: this.headers()
     });
   }
+  /**
+   * Ask for a replacement instead of a refund.
+   *
+   * Sugar over `submitReturnRequest` with `kind: "exchange"`, because an
+   * exchange reads as its own action to the person writing the UI, and burying
+   * it in an options bag is how it stays undiscovered. `variantId` is the one
+   * they want instead — omit it when that still needs a conversation.
+   *
+   * @example
+   * ```ts
+   * await portal.submitExchangeRequest(orderId, {
+   *   exchangeForVariantId: largeVariantId,
+   *   reason: "wrong size",
+   * });
+   * ```
+   */
+  async submitExchangeRequest(orderId, input) {
+    return this.submitReturnRequest(orderId, {
+      ...input ?? {},
+      kind: "exchange"
+    });
+  }
+  /**
+   * Report that a parcel never arrived.
+   *
+   * This does NOT change the shipment's carrier status, and deliberately so:
+   * when the carrier says delivered and the customer says otherwise, both
+   * facts matter — the carrier's scan is what the org files a claim against.
+   * The result carries `carrierStatus` alongside the report so a UI can show
+   * both: *"Carrier says delivered Aug 14 · You reported not received Aug 16."*
+   *
+   * `contested: true` means exactly that disagreement. Re-reporting an open
+   * claim returns it with `alreadyOpen: true` rather than erroring — a
+   * customer tapping twice is anxious, not hostile.
+   *
+   * @example
+   * ```ts
+   * const r = await portal.reportNotReceived(shipmentId, {
+   *   note: "Nothing on the porch, checked with neighbours.",
+   * });
+   * if (r.contested) showCarrierDisputeHelp();
+   * ```
+   */
+  async reportNotReceived(shipmentId, input) {
+    const body = input?.note ? { note: input.note } : {};
+    return this.client.request({
+      method: "POST",
+      path: `customer-portal/shipments/${encodeURIComponent(shipmentId)}/not-received`,
+      body,
+      responseSchema: customerNotReceivedResultSchema,
+      headers: this.headers()
+    });
+  }
+  /**
+   * The product reviews this customer has written for this org.
+   *
+   * Distinct from `listReviews()`, which is reviews of the ORG. Both exist
+   * because "are these people good to deal with" and "is this thing any good"
+   * are different questions, stored in different tables, and shown in
+   * different places.
+   *
+   * `isApproved: false` means QUEUED, not rejected — render it as "awaiting
+   * review" or the customer will assume it was lost and write it again.
+   */
+  /**
+   * The customer's subscription with this org, and what the org offers.
+   *
+   * One subscription per org — `user_subscriptions` is unique on
+   * (user, org) — so there is no id to pass. The org's live offerings come
+   * back alongside, because a portal that reports "not subscribed" and
+   * nothing else is a dead end.
+   *
+   * **Render entitlement from `subscription.hasAccess`, not from `status`.**
+   * A lifetime purchase has no period to expire and a cancelled subscription
+   * keeps access until the period already paid for ends; `hasAccess` is
+   * computed by the same function the content gates use, so the portal and
+   * the gate cannot disagree.
+   */
+  async getSubscription() {
+    return this.client.request({
+      path: "customer-portal/subscription",
+      responseSchema: customerSubscriptionResponseSchema,
+      headers: this.headers()
+    });
+  }
+  /**
+   * Cancel the subscription at the end of the paid period.
+   *
+   * Cancelling ends the RENEWAL, not the access: the customer has paid for
+   * the period they are in and keeps everything until `accessUntil`. Ending
+   * access on the click would take back something they already bought, which
+   * is the most common way a subscription flow feels like a trap.
+   *
+   * Read `accessUntil` back to them — "active until 14 March" is the true
+   * statement, not "cancelled".
+   */
+  async cancelSubscription() {
+    return this.client.request({
+      method: "POST",
+      path: "customer-portal/subscription/cancel",
+      body: { resume: false },
+      responseSchema: customerSubscriptionCancelResponseSchema,
+      headers: this.headers()
+    });
+  }
+  /**
+   * Clear a pending cancellation.
+   *
+   * Between cancelling and the period ending nothing has actually been lost,
+   * so changing your mind should cost one call rather than a re-purchase.
+   * After the period ends there is nothing to resume and they subscribe again
+   * like anyone else.
+   */
+  async resumeSubscription() {
+    return this.client.request({
+      method: "POST",
+      path: "customer-portal/subscription/cancel",
+      body: { resume: true },
+      responseSchema: customerSubscriptionCancelResponseSchema,
+      headers: this.headers()
+    });
+  }
+  /**
+   * The content this subscription entitles them to — the answer to "what am
+   * I actually getting for this?", which is the question asked right before
+   * someone cancels.
+   *
+   * When `entitled` is false these are LOCKED previews, not an empty
+   * entitlement: titles, excerpts and images, no bodies. Show them beside the
+   * offer. Rendering an empty list would hide the pitch at exactly the moment
+   * it is most relevant.
+   */
+  async getSubscriberContent(opts) {
+    const params = new URLSearchParams();
+    if (typeof opts?.limit === "number")
+      params.set("limit", String(opts.limit));
+    const qs = params.toString();
+    return this.client.request({
+      path: `customer-portal/subscription/content${qs ? `?${qs}` : ""}`,
+      responseSchema: customerSubscriberContentResponseSchema,
+      headers: this.headers()
+    });
+  }
+  /**
+   * Push config and the browsers this customer has registered.
+   *
+   * Returns `vapidPublicKey` too, because a page cannot subscribe without it.
+   */
+  async getPushConfig() {
+    return this.client.request({
+      path: "customer-portal/push",
+      responseSchema: customerPushConfigSchema,
+      headers: this.headers()
+    });
+  }
+  /**
+   * Register this browser.
+   *
+   * Pair with `subscribeToPush()` from `@businessdash/sdk/push-core`, which
+   * handles the service worker, the permission prompt and the key encoding
+   * and hands back exactly this payload.
+   *
+   * Upserted on the endpoint, so re-subscribing from the same browser
+   * refreshes the row rather than creating a second one.
+   */
+  async subscribePush(input) {
+    return this.client.request({
+      method: "POST",
+      path: "customer-portal/push",
+      body: input,
+      responseSchema: external_exports.object({ id: external_exports.string(), created: external_exports.boolean() }),
+      headers: this.headers()
+    });
+  }
+  /**
+   * Rename a device, or narrow what it receives.
+   *
+   * `categories: []` means "nothing for now" and keeps the subscription
+   * warm — browsers make re-granting a revoked permission deliberately
+   * awkward, so an "off" that discards the subscription is hard to undo.
+   */
+  async updatePushDevice(input) {
+    return this.client.request({
+      method: "PATCH",
+      path: "customer-portal/push",
+      body: input,
+      responseSchema: external_exports.object({ ok: external_exports.boolean() }),
+      headers: this.headers()
+    });
+  }
+  /**
+   * Forget a device. Takes an id or the endpoint.
+   *
+   * A browser tearing its own subscription down knows its endpoint, not our
+   * row id — so pass what `unsubscribeFromPush()` returns.
+   */
+  async unsubscribePush(input) {
+    return this.client.request({
+      method: "DELETE",
+      path: "customer-portal/push",
+      body: input,
+      responseSchema: external_exports.object({
+        ok: external_exports.boolean(),
+        deletedId: external_exports.string().nullable()
+      }),
+      headers: this.headers()
+    });
+  }
+  async listProductReviews() {
+    return this.client.request({
+      path: "customer-portal/product-reviews",
+      responseSchema: customerProductReviewListSchema,
+      headers: this.headers()
+    });
+  }
+  /**
+   * Review a product this customer BOUGHT.
+   *
+   * The portal requires a matching order — it is standing inside the
+   * customer's purchase history, which is the one thing the public storefront
+   * does not know. That makes these verified-buyer reviews, and it stops a
+   * competitor one-starring a catalogue they never bought.
+   *
+   * Rejects with `not_purchased` (403) when no order matches, and
+   * `already_reviewed` (409) on a second review of the same product.
+   * Moderation follows the ORG's policy, so the result may be
+   * `awaitingModeration`.
+   */
+  async submitProductReview(input) {
+    return this.client.request({
+      method: "POST",
+      path: "customer-portal/product-reviews",
+      body: input,
+      responseSchema: customerProductReviewCreatedSchema,
+      headers: this.headers()
+    });
+  }
   /**
    * List the digital downloads the customer is entitled to for a paid order
    * (P10d). Each item is a ready-to-use URL — a short-lived presigned link for
@@ -14027,6 +15148,22 @@ var BiabDevCustomerPortalClient = class _BiabDevCustomerPortalClient {
    * dispatch travel-time recompute layer ships, at which point the
    * `eta` field switches sources without breaking this shape.
    */
+  /**
+   * Where the job and its technicians are in the dispatch lifecycle.
+   *
+   * Named for ETA historically; it is the DISPATCH STATUS surface, which is
+   * why `getDispatchStatus` below is the same call under the name people
+   * look for.
+   *
+   * Read `dispatchStatus` (job-level) for "is anyone on the way" and
+   * `assignments[].dispatchStatus` for per-technician detail. They differ on
+   * purpose: the job is `completed` only once the LAST assignee finishes.
+   *
+   * Nothing about the dispatch CASCADE is exposed — who was offered the job,
+   * who declined, how many people were asked before someone accepted. That
+   * is staff-internal, and a customer learning they were the fourth choice
+   * helps nobody.
+   */
   async getJobEta(jobId) {
     return this.client.request({
       path: `customer-portal/jobs/${encodeURIComponent(jobId)}/eta`,
@@ -14034,6 +15171,16 @@ var BiabDevCustomerPortalClient = class _BiabDevCustomerPortalClient {
       headers: this.headers()
     });
   }
+  /**
+   * Dispatch status for a job — the same call as `getJobEta`, under the name
+   * developers actually search for.
+   *
+   * An alias rather than a second route: two endpoints returning the same
+   * thing is how they drift.
+   */
+  async getDispatchStatus(jobId) {
+    return this.getJobEta(jobId);
+  }
   /**
    * Unified job activity feed: structured events (status changes,
    * dispatch lifecycle, media uploads, quote/contract/invoice
@@ -14139,6 +15286,190 @@ var BiabDevAuthClient = class {
     });
   }
 };
+var BiabDevCustomerInvitesClient = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /**
+   * Hand an invite link out again.
+   *
+   * **Rotates the token** — the previous link stops working. That is the
+   * point rather than a side effect: if the reason for resending was "it went
+   * to the wrong address", rotating IS the fix, and reusing the token would
+   * leave the wrong recipient holding a working invitation. The cost is that
+   * someone who finds the original email later gets a dead link, which is a
+   * support message rather than an account.
+   *
+   * Rate limited to one send a minute per invitation, answering **429** with
+   * a retry hint. Resend mails an address the caller chose, so an unbounded
+   * one is a mail-bombing tool. Staff clicking the button in the dashboard
+   * skip the wait; an API key does not, because an API key is the automated
+   * caller the limit exists for.
+   *
+   * Refuses a **revoked** invitation (resending would quietly un-revoke it)
+   * and a **fully-redeemed** one (it did its job; a new invitation should be
+   * created as one, so the list keeps showing what happened).
+   */
+  async resend(inviteId, opts) {
+    return this.client.request({
+      method: "POST",
+      path: `customer-invites/${encodeURIComponent(inviteId)}/resend`,
+      body: opts?.expiresInDays === void 0 ? {} : { expiresInDays: opts.expiresInDays },
+      responseSchema: customerInviteResendResponseSchema
+    });
+  }
+};
+var BiabDevSchedulingClient = class {
+  constructor(client, siteId) {
+    this.client = client;
+    this.siteId = siteId;
+  }
+  client;
+  siteId;
+  path(suffix) {
+    return `sites/${encodeURIComponent(this.siteId)}/scheduling/${suffix}`;
+  }
+  /** What the org offers to book. */
+  async listEventTypes() {
+    return this.client.request({
+      path: this.path("event-types"),
+      responseSchema: schedulingEventTypeListSchema
+    });
+  }
+  /** One event type, plus the questions asked when booking it. */
+  async getEventType(slug) {
+    return this.client.request({
+      path: this.path(`event-types/${encodeURIComponent(slug)}`),
+      responseSchema: schedulingEventTypeDetailSchema
+    });
+  }
+  /**
+   * Free slots in a window.
+   *
+   * Ask for the window you are about to render, not the whole month: slot
+   * computation walks every host's calendar and busy times, so a wide range
+   * is a slow one.
+   */
+  async getAvailableSlots(slug, params) {
+    const query = new URLSearchParams({
+      from: typeof params.from === "string" ? params.from : params.from.toISOString(),
+      to: typeof params.to === "string" ? params.to : params.to.toISOString()
+    });
+    return this.client.request({
+      path: this.path(
+        `event-types/${encodeURIComponent(slug)}/slots?${query.toString()}`
+      ),
+      responseSchema: schedulingSlotsResponseSchema
+    });
+  }
+  /**
+   * Book a slot.
+   *
+   * Returns `pending` rather than `confirmed` when the event type requires
+   * approval — say "requested" in the UI for that case, because telling
+   * someone their meeting is booked when staff still have to accept it is the
+   * kind of thing they plan a day around.
+   */
+  async confirmBooking(input) {
+    const body = {
+      ...input,
+      startAt: typeof input.startAt === "string" ? input.startAt : input.startAt.toISOString()
+    };
+    return this.client.request({
+      method: "POST",
+      path: this.path("bookings"),
+      body,
+      responseSchema: schedulingBookingResultSchema
+    });
+  }
+  /**
+   * Read a booking with one of its signed tokens.
+   *
+   * `type` must match the token you hold — a cancel token will not open the
+   * manage view. That is the point of issuing three.
+   */
+  async getBooking(token, type = "manage") {
+    return this.client.request({
+      path: this.path(
+        `bookings/by-token/${encodeURIComponent(token)}?type=${encodeURIComponent(type)}`
+      ),
+      responseSchema: schedulingBookingViewSchema
+    });
+  }
+  /**
+   * Move a booking — the INVITEE side, with their reschedule token.
+   *
+   * Notifies the invitee and every host, and cancels the reminder jobs queued
+   * against the old time so nobody gets "your meeting starts in 15 minutes"
+   * for a slot that moved.
+   */
+  async rescheduleBooking(input) {
+    return this.client.request({
+      method: "POST",
+      path: this.path(`bookings/by-token/${encodeURIComponent(input.token)}`),
+      body: {
+        action: "reschedule",
+        newStartAt: typeof input.newStartAt === "string" ? input.newStartAt : input.newStartAt.toISOString(),
+        ...input.reason ? { reason: input.reason } : {}
+      },
+      responseSchema: schedulingRescheduleResultSchema
+    });
+  }
+  /**
+   * Move a booking as STAFF, with the API key rather than an invitee token.
+   *
+   * Same service as the token path, so the invitee AND every host are
+   * notified either way, and the reminder jobs for the old time are
+   * cancelled either way. `actorUserId` records WHO moved it, which is what
+   * lets a customer's history say "they rescheduled" rather than leaving an
+   * unexplained change.
+   */
+  async rescheduleBookingAsStaff(input) {
+    return this.client.request({
+      method: "POST",
+      path: this.path(`bookings/${encodeURIComponent(input.bookingId)}/manage`),
+      body: {
+        action: "reschedule",
+        newStartAt: typeof input.newStartAt === "string" ? input.newStartAt : input.newStartAt.toISOString(),
+        ...input.reason ? { reason: input.reason } : {},
+        ...input.actorUserId ? { actorUserId: input.actorUserId } : {}
+      },
+      responseSchema: schedulingRescheduleResultSchema
+    });
+  }
+  /** Cancel a booking as STAFF. Notifies the invitee and every host. */
+  async cancelBookingAsStaff(input) {
+    return this.client.request({
+      method: "POST",
+      path: this.path(`bookings/${encodeURIComponent(input.bookingId)}/manage`),
+      body: {
+        action: "cancel",
+        ...input.reason ? { reason: input.reason } : {},
+        ...input.actorUserId ? { actorUserId: input.actorUserId } : {}
+      },
+      responseSchema: schedulingCancelResultSchema
+    });
+  }
+  /**
+   * Cancel a booking — the INVITEE side, with their cancel token.
+   *
+   * `reason` is passed to the hosts. Worth collecting: "something came up" and
+   * "I booked the wrong service" lead to different follow-ups, and the second
+   * is recoverable revenue.
+   */
+  async cancelBooking(input) {
+    return this.client.request({
+      method: "POST",
+      path: this.path(`bookings/by-token/${encodeURIComponent(input.token)}`),
+      body: {
+        action: "cancel",
+        ...input.reason ? { reason: input.reason } : {}
+      },
+      responseSchema: schedulingCancelResultSchema
+    });
+  }
+};
 
 // src/auth-handler.ts
 var DEFAULT_AUTH_COOKIE_NAME = "biab_session";