@businessdash/sdk 0.9.60 → 0.9.80

package/src/client.ts

@@ -70,6 +70,9 @@ import {
 	type CheckoutStatusResponse,
 	type ConfirmVerificationInput,
 	type ConfirmVerificationResponse,
+	type CouponCreateInput,
+	type CouponCreateResponse,
+	type CouponListResponse,
 	type CouponValidateResponse,
 	type CreateCollectionInput,
 	type CreateCollectionResponse,
@@ -80,9 +83,12 @@ import {
 	type CustomerContactCompanyInput,
 	type CustomerContactCompanyResponse,
 	type CustomerContractDetail,
+	type CustomerContractListResponse,
 	type CustomerContractSignResponse,
 	type CustomerDownloadsResponse,
+	type CustomerInviteResendResponse,
 	type CustomerInvoiceDetail,
+	type CustomerInvoiceListResponse,
 	type CustomerInvoicePayInput,
 	type CustomerInvoicePayResponse,
 	type CustomerInvoicePdf,
@@ -95,24 +101,39 @@ import {
 	type CustomerNotificationPreferencesResponse,
 	type CustomerNotificationPreferencesUpdateInput,
 	type CustomerNotificationPreferencesUpdateResponse,
+	type CustomerNotReceivedResult,
 	type CustomerOrderDetail,
 	type CustomerOrderListResponse,
 	type CustomerPortalContextResponse,
+	type CustomerPortalMessage,
+	type CustomerPortalMessageListResponse,
+	type CustomerPortalMessagePostInput,
+	type CustomerPortalMessagesMarkReadResponse,
 	type CustomerPortalOtherOrgsResponse,
 	type CustomerPortalProfile,
+	type CustomerPortalQuizResultsResponse,
 	type CustomerPortalUpdateProfileInput,
 	type CustomerPortalUpdateProfileResponse,
+	type CustomerProductReviewCreated,
+	type CustomerProductReviewList,
+	type CustomerPushConfig,
 	type CustomerQuoteActionResponse,
 	type CustomerQuoteDetail,
+	type CustomerQuoteListResponse,
 	type CustomerReferralHistoryResponse,
 	type CustomerReferralPayoutsResponse,
 	type CustomerReferralStats,
 	type CustomerReturnRequestCreated,
 	type CustomerReturnRequestInput,
+	type CustomerReturnRequestListResponse,
 	type CustomerReviewListResponse,
 	type CustomerReviewSubmitInput,
 	type CustomerReviewSubmitResponse,
+	type CustomerShipmentListResponse,
 	type CustomerShipmentTracking,
+	type CustomerSubscriberContentResponse,
+	type CustomerSubscriptionCancelResponse,
+	type CustomerSubscriptionResponse,
 	type CustomerWorkBundle,
 	cartAddItemInputSchema,
 	cartCouponInputSchema,
@@ -142,6 +163,9 @@ import {
 	checkoutStatusResponseSchema,
 	confirmVerificationInputSchema,
 	confirmVerificationResponseSchema,
+	couponCreateInputSchema,
+	couponCreateResponseSchema,
+	couponListResponseSchema,
 	couponValidateInputSchema,
 	couponValidateResponseSchema,
 	createCollectionInputSchema,
@@ -153,9 +177,12 @@ import {
 	customerContactCompanyInputSchema,
 	customerContactCompanyResponseSchema,
 	customerContractDetailSchema,
+	customerContractListResponseSchema,
 	customerContractSignResponseSchema,
 	customerDownloadsResponseSchema,
+	customerInviteResendResponseSchema,
 	customerInvoiceDetailSchema,
+	customerInvoiceListResponseSchema,
 	customerInvoicePayInputSchema,
 	customerInvoicePayResponseSchema,
 	customerInvoicePdfSchema,
@@ -168,25 +195,39 @@ import {
 	customerNotificationPreferencesResponseSchema,
 	customerNotificationPreferencesUpdateInputSchema,
 	customerNotificationPreferencesUpdateResponseSchema,
+	customerNotReceivedResultSchema,
 	customerOrderDetailSchema,
 	customerOrderListResponseSchema,
 	customerPaymentHistoryResponseSchema,
 	customerPortalContextResponseSchema,
+	customerPortalMessageListResponseSchema,
+	customerPortalMessageSchema,
+	customerPortalMessagesMarkReadResponseSchema,
 	customerPortalOtherOrgsResponseSchema,
 	customerPortalProfileSchema,
+	customerPortalQuizResultsResponseSchema,
 	customerPortalUpdateProfileInputSchema,
 	customerPortalUpdateProfileResponseSchema,
+	customerProductReviewCreatedSchema,
+	customerProductReviewListSchema,
+	customerPushConfigSchema,
 	customerQuoteActionResponseSchema,
 	customerQuoteDetailSchema,
+	customerQuoteListResponseSchema,
 	customerReferralHistoryResponseSchema,
 	customerReferralPayoutsResponseSchema,
 	customerReferralStatsSchema,
 	customerReturnRequestCreatedSchema,
 	customerReturnRequestInputSchema,
+	customerReturnRequestListResponseSchema,
 	customerReviewListResponseSchema,
 	customerReviewSubmitInputSchema,
 	customerReviewSubmitResponseSchema,
+	customerShipmentListResponseSchema,
 	customerShipmentTrackingSchema,
+	customerSubscriberContentResponseSchema,
+	customerSubscriptionCancelResponseSchema,
+	customerSubscriptionResponseSchema,
 	customerWorkBundleSchema,
 	type DashboardSessionResponse,
 	type DataModelRecord,
@@ -230,6 +271,8 @@ import {
 	jobCategoryListResponseSchema,
 	jobPostingListResponseSchema,
 	jobPostingSchema,
+	type LegalDocument,
+	type LegalListResponse,
 	type ListCollectionsResponse,
 	type ListDataModelRecordsInput,
 	type ListDataModelRecordsResponse,
@@ -238,6 +281,8 @@ import {
 	type ListRowsInput,
 	type ListRowsResponse,
 	type ListSiteMarketingPagesResponse,
+	legalDocumentSchema,
+	legalListResponseSchema,
 	listCollectionsResponseSchema,
 	listDataModelRecordsInputSchema,
 	listDataModelRecordsResponseSchema,
@@ -264,6 +309,13 @@ import {
 	queryRowsResponseSchema,
 	type ReviewWallListResponse,
 	reviewWallListResponseSchema,
+	type SchedulingBookingResult,
+	type SchedulingBookingView,
+	type SchedulingCancelResult,
+	type SchedulingEventTypeDetail,
+	type SchedulingEventTypeList,
+	type SchedulingRescheduleResult,
+	type SchedulingSlotsResponse,
 	type ShippingRatesInput,
 	type ShippingRatesResponse,
 	type ShippingSettingsResponse,
@@ -282,10 +334,18 @@ import {
 	type StorefrontSessionInput,
 	type StorefrontSessionResponse,
 	type StorefrontSort,
+	type StorefrontSyncToStripeResponse,
 	type SubscriptionCheckoutInput,
 	type SubscriptionCheckoutResponse,
 	type SubscriptionOffering,
 	type SubscriptionOfferingsListResponse,
+	schedulingBookingResultSchema,
+	schedulingBookingViewSchema,
+	schedulingCancelResultSchema,
+	schedulingEventTypeDetailSchema,
+	schedulingEventTypeListSchema,
+	schedulingRescheduleResultSchema,
+	schedulingSlotsResponseSchema,
 	shippingRatesInputSchema,
 	shippingRatesResponseSchema,
 	shippingSettingsResponseSchema,
@@ -303,6 +363,7 @@ import {
 	storefrontRelatedProductsResponseSchema,
 	storefrontSessionInputSchema,
 	storefrontSessionResponseSchema,
+	storefrontSyncToStripeResponseSchema,
 	subscriptionCheckoutInputSchema,
 	subscriptionCheckoutResponseSchema,
 	subscriptionOfferingSchema,
@@ -513,6 +574,11 @@ export class BiabDevClient {
 		return new BiabDevShippingClient(this);
 	}
 
+	/** Customer-portal invitations — currently resend. */
+	get customerInvites() {
+		return new BiabDevCustomerInvitesClient(this);
+	}
+
 	get notifications() {
 		return new BiabDevNotificationsClient(this);
 	}
@@ -529,11 +595,32 @@ export class BiabDevClient {
 		return new BiabDevReviewsClient(this);
 	}
 
+	/**
+	 * Tracking consent for this org's site.
+	 *
+	 * Pair with `@businessdash/sdk/consent`, which handles the visitor cookie
+	 * and gives you a gate to check before starting analytics.
+	 */
+	get consent() {
+		return new BiabDevConsentClient(this);
+	}
+
 	/** Public job postings — build a careers page on your own domain. */
 	get hiring() {
 		return new BiabDevHiringClient(this);
 	}
 
+	/**
+	 * The org's published legal pages — privacy, terms, refund policy, whatever
+	 * they authored in the dashboard.
+	 *
+	 * Pair with `@businessdash/sdk/legal` to render them without writing a page
+	 * per document.
+	 */
+	get legal() {
+		return new BiabDevLegalClient(this);
+	}
+
 	get chatbot() {
 		return new BiabDevChatbotClient(this);
 	}
@@ -648,12 +735,21 @@ export class BiabDevSiteClient {
 	 */
 	readonly marketing: BiabDevMarketingClient;
 	readonly parallelPages: BiabDevParallelPagesClient;
+	/**
+	 * Booking and conference calls.
+	 *
+	 * Previously reachable only through `sdk.ts`'s separate scheduling
+	 * resource, which is why the OpenAPI generator — which reads this file —
+	 * never saw it, and why no non-JS starter had scheduling at all.
+	 */
+	readonly scheduling: BiabDevSchedulingClient;
 
 	constructor(
 		readonly client: BiabDevClient,
 		readonly siteId: string,
 	) {
 		this.collections = new BiabDevCollectionsClient(client, siteId);
+		this.scheduling = new BiabDevSchedulingClient(client, siteId);
 		this.rows = new BiabDevRowsClient(client, siteId);
 		this.dataModel = new BiabDevDataModelClient(client, siteId);
 		this.analytics = new BiabDevAnalyticsClient(client, siteId);
@@ -677,6 +773,30 @@ export class BiabDevSiteClient {
 	 * <img src={b.logoUrl ?? b.orgIcon ?? ""} alt={b.orgName ?? ""} />
 	 * ```
 	 */
+	/**
+	 * Every URL the PLATFORM owns the shape of, as JSON.
+	 *
+	 * Published site-builder pages, published legal documents, and every
+	 * materialised programmatic-page URL. Blog posts and products are not here
+	 * — the platform does not know where your site renders them. Merge those in
+	 * with `@businessdash/sdk/sitemap`, which handles the whole job.
+	 *
+	 * Paths are relative, so you join them against your own origin rather than
+	 * the org's primary verified domain.
+	 */
+	async sitemapEntries(): Promise<{
+		entries: Array<{ loc: string; lastmod?: string | undefined }>;
+	}> {
+		return this.client.request({
+			path: `sites/${encodeURIComponent(this.siteId)}/sitemap-entries`,
+			responseSchema: z.object({
+				entries: z.array(
+					z.object({ loc: z.string(), lastmod: z.string().optional() }),
+				),
+			}),
+		});
+	}
+
 	async branding(): Promise<SiteBranding> {
 		return this.client.request({
 			path: `sites/${encodeURIComponent(this.siteId)}/branding`,
@@ -1591,6 +1711,45 @@ export class BiabDevStorefrontClient {
 		});
 	}
 
+	/**
+	 * Push your catalog into YOUR OWN Stripe account.
+	 *
+	 * Products and their variant combinations become Stripe Products and
+	 * Prices on the Stripe account connected to your workspace, so you can
+	 * manage the catalog here and let Stripe be the system of record for
+	 * money. Safe to re-run: an unchanged product is left alone, and a new
+	 * Price is minted only when the amount actually changed (Stripe Prices
+	 * are immutable on amount).
+	 *
+	 * Requires a SECRET key holding `storefront:write` — never a publishable
+	 * token, because this spends against Stripe on your behalf.
+	 *
+	 * Pass `productId` to sync one product. Omit it to sync everything not yet
+	 * pushed, in bounded batches: check `remaining` and call again until it
+	 * reaches 0.
+	 *
+	 * ```ts
+	 * let remaining = 1;
+	 * while (remaining > 0) {
+	 *   const res = await biab.storefront.syncToStripe();
+	 *   remaining = res.remaining;
+	 * }
+	 * ```
+	 *
+	 * Per-product failures are returned in `failed` rather than throwing, so
+	 * one bad product doesn't abandon the batch.
+	 */
+	async syncToStripe(input?: {
+		productId?: string;
+	}): Promise<StorefrontSyncToStripeResponse> {
+		return this.client.request({
+			method: "POST",
+			path: "storefront/products/sync-to-stripe",
+			body: input?.productId ? { productId: input.productId } : {},
+			responseSchema: storefrontSyncToStripeResponseSchema,
+		});
+	}
+
 	/**
 	 * Paginated list of live products for the calling org's storefront.
 	 * Cursor is an opaque integer offset — pass back the response's
@@ -1662,6 +1821,43 @@ export class BiabDevStorefrontClient {
 	 * via `BiabApiError` if the product isn't live or doesn't belong
 	 * to the org bound to the API key.
 	 */
+	/**
+	 * The CAD file for a product — STEP, IGES, or a native part file.
+	 *
+	 * ## Call this from YOUR server, then proxy it
+	 *
+	 * The API key is a server secret, so a browser cannot reach this directly.
+	 * Expose your own route (`/api/products/:id/cad`), call this behind it, and
+	 * redirect the visitor to the URL it returns.
+	 *
+	 * The platform withholds the raw URL from every product payload on purpose:
+	 * CAD files are the largest thing it serves and are the org's intellectual
+	 * property, so a catalog of naked URLs is a design library published to
+	 * anyone willing to write a loop. This endpoint requires a `biab_cad` cookie
+	 * on the incoming request, rate-limits per IP, and re-checks the
+	 * `ecommerce.product_3d` entitlement before answering.
+	 *
+	 * `cacheSeconds` is what to put on your own response — CAD at a content URL
+	 * does not change, so caching hard is where the bandwidth saving comes from.
+	 *
+	 * Rejects 404 when the product is a draft, has no CAD file, or the org lacks
+	 * the add-on. Those are deliberately one answer.
+	 */
+	async getCadDownload(productId: string): Promise<{
+		url: string;
+		fileName: string | null;
+		cacheSeconds: number;
+	}> {
+		return this.client.request({
+			path: `storefront/products/${encodeURIComponent(productId)}/cad`,
+			responseSchema: z.object({
+				url: z.string(),
+				fileName: z.string().nullable(),
+				cacheSeconds: z.number(),
+			}),
+		});
+	}
+
 	async getProduct(productId: string): Promise<StorefrontProductDetail> {
 		return this.client.request({
 			path: `storefront/products/${encodeURIComponent(productId)}`,
@@ -2087,6 +2283,49 @@ export class BiabDevCouponsClient {
 	 * else toast.error(result.message);
 	 * ```
 	 */
+	/**
+	 * Create a coupon and make it live in YOUR OWN Stripe account in one call —
+	 * a Stripe Coupon plus a Promotion Code, so the same string works on your
+	 * storefront and on Stripe-hosted Checkout.
+	 *
+	 * Creation and the Stripe sync are one operation deliberately: a coupon
+	 * that exists locally but not in Stripe is the failure worth designing out,
+	 * where a customer types a code your storefront accepts and Stripe rejects.
+	 * If the sync fails the coupon is still created and `stripeSynced` comes
+	 * back `false` with the reason, rather than pretending it is live.
+	 *
+	 * Requires a SECRET key holding `storefront:write`.
+	 *
+	 * ```ts
+	 * const { coupon, stripeSynced } = await biab.coupons.create({
+	 *   code: 'WELCOME10',
+	 *   discountType: 'percent',
+	 *   value: 10,
+	 * })
+	 * ```
+	 *
+	 * Buy-X-get-Y and bundle-gift coupons aren't available here — Stripe has no
+	 * native BXGY, so those run through our own cart math and need the offer
+	 * rows the dashboard collects.
+	 */
+	async create(input: CouponCreateInput): Promise<CouponCreateResponse> {
+		const body = couponCreateInputSchema.parse(input);
+		return this.client.request({
+			method: "POST",
+			path: "coupons",
+			body,
+			responseSchema: couponCreateResponseSchema,
+		});
+	}
+
+	/** Every coupon on the workspace, newest first. Requires `storefront:write`. */
+	async list(): Promise<CouponListResponse> {
+		return this.client.request({
+			path: "coupons",
+			responseSchema: couponListResponseSchema,
+		});
+	}
+
 	async validate(code: string): Promise<CouponValidateResponse> {
 		const body = couponValidateInputSchema.parse({ code });
 		return this.client.request({
@@ -2555,6 +2794,118 @@ export class BiabDevHiringClient {
 	}
 }
 
+/**
+ * The org's published legal pages.
+ *
+ * Everything here is content the org deliberately put on the public internet;
+ * drafts are filtered server-side and unreachable. Requires `legal:read`, which
+ * is publishable — a browser token is the expected caller.
+ *
+ * @example
+ * ```ts
+ * const { items, presentation } = await client.legal.list();
+ * const privacy = await client.legal.get("privacy");
+ * ```
+ */
+export class BiabDevLegalClient {
+	constructor(private readonly client: BiabDevClient) {}
+
+	/**
+	 * Every published document, plus the header/footer presentation.
+	 *
+	 * Both in one response because the common use — a footer link list — needs
+	 * the titles and the presentation together, and a second round trip for the
+	 * latter is one a site either makes on every page or skips entirely.
+	 */
+	async list(): Promise<LegalListResponse> {
+		return this.client.request({
+			path: "legal",
+			responseSchema: legalListResponseSchema,
+		});
+	}
+
+	/**
+	 * One document by slug, body included.
+	 *
+	 * Rejects with a 404 when the slug is unpublished or absent — the two are
+	 * deliberately indistinguishable, since "exists but hidden" would leak that
+	 * an org is drafting a policy and is not something a caller can act on.
+	 */
+	async get(slug: string): Promise<LegalDocument> {
+		return this.client.request({
+			path: `legal/${encodeURIComponent(slug)}`,
+			responseSchema: legalDocumentSchema,
+		});
+	}
+}
+
+const consentStateSchema = z.object({
+	/** Categories this org uses at all — one banner row each. */
+	categories: z.array(z.string()),
+	noticeText: z.string().nullable(),
+	noticeVersion: z.number(),
+	/** What may be used right now. */
+	allowed: z.array(z.string()),
+	mustAsk: z.boolean(),
+	reason: z.string(),
+});
+
+/**
+ * Tracking consent, scoped to the calling org.
+ *
+ * Every call is answered for the org whose key made it. There is no shape here
+ * that could read or write another org's consent — consent is given to a
+ * controller, and one controller's record is not another's to act on.
+ *
+ * The visitor is identified by an `x-biab-visitor` header carrying an opaque id
+ * from the caller's own first-party cookie. `@businessdash/sdk/consent` manages
+ * that for you; these methods are the transport underneath it.
+ */
+export class BiabDevConsentClient {
+	constructor(private readonly client: BiabDevClient) {}
+
+	/** The notice to show, and what this visitor currently allows. */
+	async get(visitorKey?: string | null): Promise<{
+		categories: string[];
+		noticeText: string | null;
+		noticeVersion: number;
+		allowed: string[];
+		mustAsk: boolean;
+		reason: string;
+	}> {
+		return this.client.request({
+			path: "consent",
+			responseSchema: consentStateSchema,
+			...(visitorKey ? { headers: { "x-biab-visitor": visitorKey } } : {}),
+		});
+	}
+
+	/**
+	 * Record the visitor's answer.
+	 *
+	 * `granted: []` is a real answer — "asked, refused everything" — and is
+	 * stored as one, so the banner does not reappear on the next page.
+	 */
+	async record(input: {
+		visitorKey: string;
+		granted: string[];
+		noticeVersion: number;
+		source?: "banner" | "settings";
+	}): Promise<{ ok: boolean }> {
+		return this.client.request({
+			method: "POST",
+			path: "consent",
+			body: {
+				granted: input.granted,
+				noticeVersion: input.noticeVersion,
+				source: input.source ?? "banner",
+			},
+			headers: { "x-biab-visitor": input.visitorKey },
+			responseSchema: z.object({ ok: z.boolean() }),
+		});
+	}
+}
+
 export class BiabDevChatbotClient {
 	constructor(private readonly client: BiabDevClient) {}
 
@@ -2918,6 +3269,26 @@ export class BiabDevCustomerPortalClient {
 		});
 	}
 
+	/**
+	 * The signed-in customer's quiz results at this org — the SDK side of
+	 * the account-gated reveal: an invitation completed with "create an
+	 * account to see how you did" surfaces its result here (and only to
+	 * the invited email). Interview-mode quizzes come back with
+	 * `scoreWithheld: true` and no verdict, by the org's own setting.
+	 */
+	async myQuizResults(options?: {
+		token?: string;
+	}): Promise<CustomerPortalQuizResultsResponse> {
+		const params = new URLSearchParams();
+		if (options?.token) params.set("token", options.token);
+		const qs = params.toString();
+		return this.client.request({
+			path: `customer-portal/quiz-results${qs ? `?${qs}` : ""}`,
+			responseSchema: customerPortalQuizResultsResponseSchema,
+			headers: this.headers(),
+		});
+	}
+
 	async updateProfile(
 		input: CustomerPortalUpdateProfileInput,
 	): Promise<CustomerPortalUpdateProfileResponse> {
@@ -3225,6 +3596,157 @@ export class BiabDevCustomerPortalClient {
 		});
 	}
 
+	/**
+	 * The return requests on one order, newest first.
+	 *
+	 * `resolutionNote` carries staff's answer — when a return is denied that IS
+	 * the answer, and hiding it just moves the question to email.
+	 */
+	async listReturnRequests(
+		orderId: string,
+	): Promise<CustomerReturnRequestListResponse> {
+		return this.client.request({
+			path: `customer-portal/orders/${encodeURIComponent(orderId)}/return-request`,
+			responseSchema: customerReturnRequestListResponseSchema,
+			headers: this.headers(),
+		});
+	}
+
+	/**
+	 * The customer's message thread with the org's staff, newest first.
+	 *
+	 * Automated rows — the review-ask and similar — are excluded server-side, so
+	 * this is only what a person wrote.
+	 */
+	async listMessages(opts?: {
+		limit?: number;
+		jobId?: string;
+	}): Promise<CustomerPortalMessageListResponse> {
+		const params = new URLSearchParams();
+		if (typeof opts?.limit === "number")
+			params.set("limit", String(opts.limit));
+		if (opts?.jobId) params.set("jobId", opts.jobId);
+		const qs = params.toString();
+		return this.client.request({
+			path: `customer-portal/messages${qs ? `?${qs}` : ""}`,
+			responseSchema: customerPortalMessageListResponseSchema,
+			headers: this.headers(),
+		});
+	}
+
+	/** Send a message to the org's staff. Lands in the CRM timeline. */
+	async postMessage(
+		input: CustomerPortalMessagePostInput,
+	): Promise<CustomerPortalMessage> {
+		return this.client.request({
+			path: "customer-portal/messages",
+			method: "POST",
+			body: input,
+			responseSchema: customerPortalMessageSchema,
+			headers: this.headers(),
+		});
+	}
+
+	/**
+	 * Mark the staff messages read up to now.
+	 *
+	 * One-way: it never clears a stamp. A portal that could un-read a message
+	 * would let a customer hide from staff that they had seen something.
+	 */
+	async markMessagesRead(): Promise<CustomerPortalMessagesMarkReadResponse> {
+		return this.client.request({
+			path: "customer-portal/messages",
+			method: "PATCH",
+			responseSchema: customerPortalMessagesMarkReadResponseSchema,
+			headers: this.headers(),
+		});
+	}
+
+	/**
+	 * The customer's invoices, newest first.
+	 *
+	 * `unpaid: true` filters on the computed BALANCE rather than on the status
+	 * string, because a partially-paid invoice still owes money whatever it is
+	 * called. This is the call behind "show me everything I owe" — which had no
+	 * endpoint at all before 0.9.61.
+	 */
+	async listInvoices(opts?: {
+		limit?: number;
+		status?: string;
+		unpaid?: boolean;
+	}): Promise<CustomerInvoiceListResponse> {
+		const params = new URLSearchParams();
+		if (typeof opts?.limit === "number")
+			params.set("limit", String(opts.limit));
+		if (opts?.status) params.set("status", opts.status);
+		if (opts?.unpaid) params.set("unpaid", "1");
+		const qs = params.toString();
+		return this.client.request({
+			path: `customer-portal/invoices${qs ? `?${qs}` : ""}`,
+			responseSchema: customerInvoiceListResponseSchema,
+			headers: this.headers(),
+		});
+	}
+
+	/** The customer's quotes. `status: "sent"` is the set still awaiting them. */
+	async listQuotes(opts?: {
+		limit?: number;
+		status?: string;
+	}): Promise<CustomerQuoteListResponse> {
+		const params = new URLSearchParams();
+		if (typeof opts?.limit === "number")
+			params.set("limit", String(opts.limit));
+		if (opts?.status) params.set("status", opts.status);
+		const qs = params.toString();
+		return this.client.request({
+			path: `customer-portal/quotes${qs ? `?${qs}` : ""}`,
+			responseSchema: customerQuoteListResponseSchema,
+			headers: this.headers(),
+		});
+	}
+
+	/** The customer's contracts. `status: "sent"` still awaits a signature. */
+	async listContracts(opts?: {
+		limit?: number;
+		status?: string;
+	}): Promise<CustomerContractListResponse> {
+		const params = new URLSearchParams();
+		if (typeof opts?.limit === "number")
+			params.set("limit", String(opts.limit));
+		if (opts?.status) params.set("status", opts.status);
+		const qs = params.toString();
+		return this.client.request({
+			path: `customer-portal/contracts${qs ? `?${qs}` : ""}`,
+			responseSchema: customerContractListResponseSchema,
+			headers: this.headers(),
+		});
+	}
+
+	/**
+	 * Every shipment across the customer's orders. `active: true` narrows to
+	 * parcels still moving.
+	 *
+	 * STORED status only — no live carrier poll. `trackShipment(id)` spends a
+	 * Shippo request because it is one parcel the customer opened; doing that
+	 * per row here would mean a carrier call for every parcel in their history
+	 * on every page load.
+	 */
+	async listShipments(opts?: {
+		limit?: number;
+		active?: boolean;
+	}): Promise<CustomerShipmentListResponse> {
+		const params = new URLSearchParams();
+		if (typeof opts?.limit === "number")
+			params.set("limit", String(opts.limit));
+		if (opts?.active) params.set("active", "1");
+		const qs = params.toString();
+		return this.client.request({
+			path: `customer-portal/shipments${qs ? `?${qs}` : ""}`,
+			responseSchema: customerShipmentListResponseSchema,
+			headers: this.headers(),
+		});
+	}
+
 	/**
 	 * The signed-in customer's orders (newest first), each with a shipment
 	 * roll-up (`overallStatus`, `anyInTransit`, `latestEstimatedDelivery`) for
@@ -3320,6 +3842,281 @@ export class BiabDevCustomerPortalClient {
 		});
 	}
 
+	/**
+	 * Ask for a replacement instead of a refund.
+	 *
+	 * Sugar over `submitReturnRequest` with `kind: "exchange"`, because an
+	 * exchange reads as its own action to the person writing the UI, and burying
+	 * it in an options bag is how it stays undiscovered. `variantId` is the one
+	 * they want instead — omit it when that still needs a conversation.
+	 *
+	 * @example
+	 * ```ts
+	 * await portal.submitExchangeRequest(orderId, {
+	 *   exchangeForVariantId: largeVariantId,
+	 *   reason: "wrong size",
+	 * });
+	 * ```
+	 */
+	async submitExchangeRequest(
+		orderId: string,
+		input?: Omit<CustomerReturnRequestInput, "kind">,
+	): Promise<CustomerReturnRequestCreated> {
+		return this.submitReturnRequest(orderId, {
+			...(input ?? {}),
+			kind: "exchange",
+		});
+	}
+
+	/**
+	 * Report that a parcel never arrived.
+	 *
+	 * This does NOT change the shipment's carrier status, and deliberately so:
+	 * when the carrier says delivered and the customer says otherwise, both
+	 * facts matter — the carrier's scan is what the org files a claim against.
+	 * The result carries `carrierStatus` alongside the report so a UI can show
+	 * both: *"Carrier says delivered Aug 14 · You reported not received Aug 16."*
+	 *
+	 * `contested: true` means exactly that disagreement. Re-reporting an open
+	 * claim returns it with `alreadyOpen: true` rather than erroring — a
+	 * customer tapping twice is anxious, not hostile.
+	 *
+	 * @example
+	 * ```ts
+	 * const r = await portal.reportNotReceived(shipmentId, {
+	 *   note: "Nothing on the porch, checked with neighbours.",
+	 * });
+	 * if (r.contested) showCarrierDisputeHelp();
+	 * ```
+	 */
+	async reportNotReceived(
+		shipmentId: string,
+		input?: { note?: string },
+	): Promise<CustomerNotReceivedResult> {
+		const body = input?.note ? { note: input.note } : {};
+		return this.client.request({
+			method: "POST",
+			path: `customer-portal/shipments/${encodeURIComponent(shipmentId)}/not-received`,
+			body,
+			responseSchema: customerNotReceivedResultSchema,
+			headers: this.headers(),
+		});
+	}
+
+	/**
+	 * The product reviews this customer has written for this org.
+	 *
+	 * Distinct from `listReviews()`, which is reviews of the ORG. Both exist
+	 * because "are these people good to deal with" and "is this thing any good"
+	 * are different questions, stored in different tables, and shown in
+	 * different places.
+	 *
+	 * `isApproved: false` means QUEUED, not rejected — render it as "awaiting
+	 * review" or the customer will assume it was lost and write it again.
+	 */
+	/**
+	 * The customer's subscription with this org, and what the org offers.
+	 *
+	 * One subscription per org — `user_subscriptions` is unique on
+	 * (user, org) — so there is no id to pass. The org's live offerings come
+	 * back alongside, because a portal that reports "not subscribed" and
+	 * nothing else is a dead end.
+	 *
+	 * **Render entitlement from `subscription.hasAccess`, not from `status`.**
+	 * A lifetime purchase has no period to expire and a cancelled subscription
+	 * keeps access until the period already paid for ends; `hasAccess` is
+	 * computed by the same function the content gates use, so the portal and
+	 * the gate cannot disagree.
+	 */
+	async getSubscription(): Promise<CustomerSubscriptionResponse> {
+		return this.client.request({
+			path: "customer-portal/subscription",
+			responseSchema: customerSubscriptionResponseSchema,
+			headers: this.headers(),
+		});
+	}
+
+	/**
+	 * Cancel the subscription at the end of the paid period.
+	 *
+	 * Cancelling ends the RENEWAL, not the access: the customer has paid for
+	 * the period they are in and keeps everything until `accessUntil`. Ending
+	 * access on the click would take back something they already bought, which
+	 * is the most common way a subscription flow feels like a trap.
+	 *
+	 * Read `accessUntil` back to them — "active until 14 March" is the true
+	 * statement, not "cancelled".
+	 */
+	async cancelSubscription(): Promise<CustomerSubscriptionCancelResponse> {
+		return this.client.request({
+			method: "POST",
+			path: "customer-portal/subscription/cancel",
+			body: { resume: false },
+			responseSchema: customerSubscriptionCancelResponseSchema,
+			headers: this.headers(),
+		});
+	}
+
+	/**
+	 * Clear a pending cancellation.
+	 *
+	 * Between cancelling and the period ending nothing has actually been lost,
+	 * so changing your mind should cost one call rather than a re-purchase.
+	 * After the period ends there is nothing to resume and they subscribe again
+	 * like anyone else.
+	 */
+	async resumeSubscription(): Promise<CustomerSubscriptionCancelResponse> {
+		return this.client.request({
+			method: "POST",
+			path: "customer-portal/subscription/cancel",
+			body: { resume: true },
+			responseSchema: customerSubscriptionCancelResponseSchema,
+			headers: this.headers(),
+		});
+	}
+
+	/**
+	 * The content this subscription entitles them to — the answer to "what am
+	 * I actually getting for this?", which is the question asked right before
+	 * someone cancels.
+	 *
+	 * When `entitled` is false these are LOCKED previews, not an empty
+	 * entitlement: titles, excerpts and images, no bodies. Show them beside the
+	 * offer. Rendering an empty list would hide the pitch at exactly the moment
+	 * it is most relevant.
+	 */
+	async getSubscriberContent(opts?: {
+		limit?: number;
+	}): Promise<CustomerSubscriberContentResponse> {
+		const params = new URLSearchParams();
+		if (typeof opts?.limit === "number")
+			params.set("limit", String(opts.limit));
+		const qs = params.toString();
+		return this.client.request({
+			path: `customer-portal/subscription/content${qs ? `?${qs}` : ""}`,
+			responseSchema: customerSubscriberContentResponseSchema,
+			headers: this.headers(),
+		});
+	}
+
+	/**
+	 * Push config and the browsers this customer has registered.
+	 *
+	 * Returns `vapidPublicKey` too, because a page cannot subscribe without it.
+	 */
+	async getPushConfig(): Promise<CustomerPushConfig> {
+		return this.client.request({
+			path: "customer-portal/push",
+			responseSchema: customerPushConfigSchema,
+			headers: this.headers(),
+		});
+	}
+
+	/**
+	 * Register this browser.
+	 *
+	 * Pair with `subscribeToPush()` from `@businessdash/sdk/push-core`, which
+	 * handles the service worker, the permission prompt and the key encoding
+	 * and hands back exactly this payload.
+	 *
+	 * Upserted on the endpoint, so re-subscribing from the same browser
+	 * refreshes the row rather than creating a second one.
+	 */
+	async subscribePush(input: {
+		endpoint: string;
+		p256dh: string;
+		auth: string;
+		userAgent?: string | null;
+		label?: string | null;
+		categories?: string[] | null;
+	}): Promise<{ id: string; created: boolean }> {
+		return this.client.request({
+			method: "POST",
+			path: "customer-portal/push",
+			body: input,
+			responseSchema: z.object({ id: z.string(), created: z.boolean() }),
+			headers: this.headers(),
+		});
+	}
+
+	/**
+	 * Rename a device, or narrow what it receives.
+	 *
+	 * `categories: []` means "nothing for now" and keeps the subscription
+	 * warm — browsers make re-granting a revoked permission deliberately
+	 * awkward, so an "off" that discards the subscription is hard to undo.
+	 */
+	async updatePushDevice(input: {
+		id: string;
+		label?: string | null;
+		categories?: string[] | null;
+	}): Promise<{ ok: boolean }> {
+		return this.client.request({
+			method: "PATCH",
+			path: "customer-portal/push",
+			body: input,
+			responseSchema: z.object({ ok: z.boolean() }),
+			headers: this.headers(),
+		});
+	}
+
+	/**
+	 * Forget a device. Takes an id or the endpoint.
+	 *
+	 * A browser tearing its own subscription down knows its endpoint, not our
+	 * row id — so pass what `unsubscribeFromPush()` returns.
+	 */
+	async unsubscribePush(input: {
+		id?: string;
+		endpoint?: string;
+	}): Promise<{ ok: boolean; deletedId: string | null }> {
+		return this.client.request({
+			method: "DELETE",
+			path: "customer-portal/push",
+			body: input,
+			responseSchema: z.object({
+				ok: z.boolean(),
+				deletedId: z.string().nullable(),
+			}),
+			headers: this.headers(),
+		});
+	}
+
+	async listProductReviews(): Promise<CustomerProductReviewList> {
+		return this.client.request({
+			path: "customer-portal/product-reviews",
+			responseSchema: customerProductReviewListSchema,
+			headers: this.headers(),
+		});
+	}
+
+	/**
+	 * Review a product this customer BOUGHT.
+	 *
+	 * The portal requires a matching order — it is standing inside the
+	 * customer's purchase history, which is the one thing the public storefront
+	 * does not know. That makes these verified-buyer reviews, and it stops a
+	 * competitor one-starring a catalogue they never bought.
+	 *
+	 * Rejects with `not_purchased` (403) when no order matches, and
+	 * `already_reviewed` (409) on a second review of the same product.
+	 * Moderation follows the ORG's policy, so the result may be
+	 * `awaitingModeration`.
+	 */
+	async submitProductReview(input: {
+		productId: string;
+		rating: number;
+		content: string;
+	}): Promise<CustomerProductReviewCreated> {
+		return this.client.request({
+			method: "POST",
+			path: "customer-portal/product-reviews",
+			body: input,
+			responseSchema: customerProductReviewCreatedSchema,
+			headers: this.headers(),
+		});
+	}
+
 	/**
 	 * List the digital downloads the customer is entitled to for a paid order
 	 * (P10d). Each item is a ready-to-use URL — a short-lived presigned link for
@@ -3430,6 +4227,22 @@ export class BiabDevCustomerPortalClient {
 	 * dispatch travel-time recompute layer ships, at which point the
 	 * `eta` field switches sources without breaking this shape.
 	 */
+	/**
+	 * Where the job and its technicians are in the dispatch lifecycle.
+	 *
+	 * Named for ETA historically; it is the DISPATCH STATUS surface, which is
+	 * why `getDispatchStatus` below is the same call under the name people
+	 * look for.
+	 *
+	 * Read `dispatchStatus` (job-level) for "is anyone on the way" and
+	 * `assignments[].dispatchStatus` for per-technician detail. They differ on
+	 * purpose: the job is `completed` only once the LAST assignee finishes.
+	 *
+	 * Nothing about the dispatch CASCADE is exposed — who was offered the job,
+	 * who declined, how many people were asked before someone accepted. That
+	 * is staff-internal, and a customer learning they were the fourth choice
+	 * helps nobody.
+	 */
 	async getJobEta(jobId: string): Promise<CustomerJobEtaResponse> {
 		return this.client.request({
 			path: `customer-portal/jobs/${encodeURIComponent(jobId)}/eta`,
@@ -3438,6 +4251,17 @@ export class BiabDevCustomerPortalClient {
 		});
 	}
 
+	/**
+	 * Dispatch status for a job — the same call as `getJobEta`, under the name
+	 * developers actually search for.
+	 *
+	 * An alias rather than a second route: two endpoints returning the same
+	 * thing is how they drift.
+	 */
+	async getDispatchStatus(jobId: string): Promise<CustomerJobEtaResponse> {
+		return this.getJobEta(jobId);
+	}
+
 	/**
 	 * Unified job activity feed: structured events (status changes,
 	 * dispatch lifecycle, media uploads, quote/contract/invoice
@@ -3576,3 +4400,276 @@ export class BiabDevAuthClient {
 		});
 	}
 }
+
+/**
+ * Booking, rescheduling, cancelling — and the conference call attached to it.
+ *
+ * ## Both sides of every flow
+ *
+ * An invitee acts with a signed TOKEN from their confirmation email; staff act
+ * with the API key. Both reach the same service, so the same notifications fire
+ * to the invitee AND every host either way, and the booking records which of
+ * them made the change.
+ *
+ * ## Three tokens, not one
+ *
+ * A confirmed booking yields `manageToken`, `rescheduleToken` and `cancelToken`
+ * separately. A cancel link in an email must not also be able to reschedule,
+ * and neither should be able to read the whole booking. One token for all three
+ * would make every emailed link as powerful as the strongest thing it enables.
+ *
+ * ## The conference link is re-minted on reschedule
+ *
+ * Moving a booking can issue a new meeting URL. Read `conferenceLink` back from
+ * the reschedule result rather than reusing the one from confirmation —
+ * otherwise the calendar invite you send points at a dead room.
+ */
+/**
+ * Customer-portal invitations.
+ *
+ * For an org running its own admin tooling rather than the dashboard.
+ */
+export class BiabDevCustomerInvitesClient {
+	constructor(private readonly client: BiabDevClient) {}
+
+	/**
+	 * Hand an invite link out again.
+	 *
+	 * **Rotates the token** — the previous link stops working. That is the
+	 * point rather than a side effect: if the reason for resending was "it went
+	 * to the wrong address", rotating IS the fix, and reusing the token would
+	 * leave the wrong recipient holding a working invitation. The cost is that
+	 * someone who finds the original email later gets a dead link, which is a
+	 * support message rather than an account.
+	 *
+	 * Rate limited to one send a minute per invitation, answering **429** with
+	 * a retry hint. Resend mails an address the caller chose, so an unbounded
+	 * one is a mail-bombing tool. Staff clicking the button in the dashboard
+	 * skip the wait; an API key does not, because an API key is the automated
+	 * caller the limit exists for.
+	 *
+	 * Refuses a **revoked** invitation (resending would quietly un-revoke it)
+	 * and a **fully-redeemed** one (it did its job; a new invitation should be
+	 * created as one, so the list keeps showing what happened).
+	 */
+	async resend(
+		inviteId: string,
+		opts?: { expiresInDays?: number | null },
+	): Promise<CustomerInviteResendResponse> {
+		return this.client.request({
+			method: "POST",
+			path: `customer-invites/${encodeURIComponent(inviteId)}/resend`,
+			body:
+				opts?.expiresInDays === undefined
+					? {}
+					: { expiresInDays: opts.expiresInDays },
+			responseSchema: customerInviteResendResponseSchema,
+		});
+	}
+}
+
+export class BiabDevSchedulingClient {
+	constructor(
+		private readonly client: BiabDevClient,
+		private readonly siteId: string,
+	) {}
+
+	private path(suffix: string): string {
+		return `sites/${encodeURIComponent(this.siteId)}/scheduling/${suffix}`;
+	}
+
+	/** What the org offers to book. */
+	async listEventTypes(): Promise<SchedulingEventTypeList> {
+		return this.client.request({
+			path: this.path("event-types"),
+			responseSchema: schedulingEventTypeListSchema,
+		});
+	}
+
+	/** One event type, plus the questions asked when booking it. */
+	async getEventType(slug: string): Promise<SchedulingEventTypeDetail> {
+		return this.client.request({
+			path: this.path(`event-types/${encodeURIComponent(slug)}`),
+			responseSchema: schedulingEventTypeDetailSchema,
+		});
+	}
+
+	/**
+	 * Free slots in a window.
+	 *
+	 * Ask for the window you are about to render, not the whole month: slot
+	 * computation walks every host's calendar and busy times, so a wide range
+	 * is a slow one.
+	 */
+	async getAvailableSlots(
+		slug: string,
+		params: { from: Date | string; to: Date | string },
+	): Promise<SchedulingSlotsResponse> {
+		const query = new URLSearchParams({
+			from:
+				typeof params.from === "string"
+					? params.from
+					: params.from.toISOString(),
+			to: typeof params.to === "string" ? params.to : params.to.toISOString(),
+		});
+		return this.client.request({
+			path: this.path(
+				`event-types/${encodeURIComponent(slug)}/slots?${query.toString()}`,
+			),
+			responseSchema: schedulingSlotsResponseSchema,
+		});
+	}
+
+	/**
+	 * Book a slot.
+	 *
+	 * Returns `pending` rather than `confirmed` when the event type requires
+	 * approval — say "requested" in the UI for that case, because telling
+	 * someone their meeting is booked when staff still have to accept it is the
+	 * kind of thing they plan a day around.
+	 */
+	async confirmBooking(input: {
+		eventTypeSlug: string;
+		startAt: Date | string;
+		invitee: {
+			email: string;
+			name: string;
+			phone?: string | null;
+			timezone: string;
+		};
+		answers?: Array<{ questionId: string; value: string }>;
+		notes?: string | null;
+		schedulingLinkId?: string;
+		holderKey?: string | null;
+	}): Promise<SchedulingBookingResult> {
+		const body = {
+			...input,
+			startAt:
+				typeof input.startAt === "string"
+					? input.startAt
+					: input.startAt.toISOString(),
+		};
+		return this.client.request({
+			method: "POST",
+			path: this.path("bookings"),
+			body,
+			responseSchema: schedulingBookingResultSchema,
+		});
+	}
+
+	/**
+	 * Read a booking with one of its signed tokens.
+	 *
+	 * `type` must match the token you hold — a cancel token will not open the
+	 * manage view. That is the point of issuing three.
+	 */
+	async getBooking(
+		token: string,
+		type: "manage" | "cancel" | "reschedule" = "manage",
+	): Promise<SchedulingBookingView> {
+		return this.client.request({
+			path: this.path(
+				`bookings/by-token/${encodeURIComponent(token)}?type=${encodeURIComponent(type)}`,
+			),
+			responseSchema: schedulingBookingViewSchema,
+		});
+	}
+
+	/**
+	 * Move a booking — the INVITEE side, with their reschedule token.
+	 *
+	 * Notifies the invitee and every host, and cancels the reminder jobs queued
+	 * against the old time so nobody gets "your meeting starts in 15 minutes"
+	 * for a slot that moved.
+	 */
+	async rescheduleBooking(input: {
+		token: string;
+		newStartAt: Date | string;
+		reason?: string | null;
+	}): Promise<SchedulingRescheduleResult> {
+		return this.client.request({
+			method: "POST",
+			path: this.path(`bookings/by-token/${encodeURIComponent(input.token)}`),
+			body: {
+				action: "reschedule",
+				newStartAt:
+					typeof input.newStartAt === "string"
+						? input.newStartAt
+						: input.newStartAt.toISOString(),
+				...(input.reason ? { reason: input.reason } : {}),
+			},
+			responseSchema: schedulingRescheduleResultSchema,
+		});
+	}
+
+	/**
+	 * Move a booking as STAFF, with the API key rather than an invitee token.
+	 *
+	 * Same service as the token path, so the invitee AND every host are
+	 * notified either way, and the reminder jobs for the old time are
+	 * cancelled either way. `actorUserId` records WHO moved it, which is what
+	 * lets a customer's history say "they rescheduled" rather than leaving an
+	 * unexplained change.
+	 */
+	async rescheduleBookingAsStaff(input: {
+		bookingId: string;
+		newStartAt: Date | string;
+		reason?: string | null;
+		actorUserId?: string | null;
+	}): Promise<SchedulingRescheduleResult> {
+		return this.client.request({
+			method: "POST",
+			path: this.path(`bookings/${encodeURIComponent(input.bookingId)}/manage`),
+			body: {
+				action: "reschedule",
+				newStartAt:
+					typeof input.newStartAt === "string"
+						? input.newStartAt
+						: input.newStartAt.toISOString(),
+				...(input.reason ? { reason: input.reason } : {}),
+				...(input.actorUserId ? { actorUserId: input.actorUserId } : {}),
+			},
+			responseSchema: schedulingRescheduleResultSchema,
+		});
+	}
+
+	/** Cancel a booking as STAFF. Notifies the invitee and every host. */
+	async cancelBookingAsStaff(input: {
+		bookingId: string;
+		reason?: string | null;
+		actorUserId?: string | null;
+	}): Promise<SchedulingCancelResult> {
+		return this.client.request({
+			method: "POST",
+			path: this.path(`bookings/${encodeURIComponent(input.bookingId)}/manage`),
+			body: {
+				action: "cancel",
+				...(input.reason ? { reason: input.reason } : {}),
+				...(input.actorUserId ? { actorUserId: input.actorUserId } : {}),
+			},
+			responseSchema: schedulingCancelResultSchema,
+		});
+	}
+
+	/**
+	 * Cancel a booking — the INVITEE side, with their cancel token.
+	 *
+	 * `reason` is passed to the hosts. Worth collecting: "something came up" and
+	 * "I booked the wrong service" lead to different follow-ups, and the second
+	 * is recoverable revenue.
+	 */
+	async cancelBooking(input: {
+		token: string;
+		reason?: string | null;
+	}): Promise<SchedulingCancelResult> {
+		return this.client.request({
+			method: "POST",
+			path: this.path(`bookings/by-token/${encodeURIComponent(input.token)}`),
+			body: {
+				action: "cancel",
+				...(input.reason ? { reason: input.reason } : {}),
+			},
+			responseSchema: schedulingCancelResultSchema,
+		});
+	}
+}