@businessdash/sdk 0.9.60 → 0.9.80

package/dist/client.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { addressDetailsResponseSchema, addressFormValuesSchema, addressSearchInputSchema, addressSearchResponseSchema, addressVerifyResponseSchema, aiVisibilityInputSchema, aiVisibilityResponseSchema, attributionHeartbeatInputSchema, attributionHeartbeatResponseSchema, attributionPolicySchema, authIntrospectResponseSchema, blogCategoryListResponseSchema, blogCommentListResponseSchema, blogCommentPostInputSchema, blogCommentPostResponseSchema, blogLikeResponseSchema, blogListPostsResponseSchema, blogPostBySlugResponseSchema, blogSessionInputSchema, blogSessionResponseSchema, blogTagListResponseSchema, cartAddItemInputSchema, cartCouponInputSchema, cartSessionResponseSchema, cartSnapshotSchema, cartUpdateItemInputSchema, chatbotAppendMessageInputSchema, chatbotAvailabilitySchema, chatbotChatInputSchema, chatbotChatResponseSchema, chatbotConfigSchema, chatbotConfigUpdateInputSchema, chatbotFormDefinitionSchema, chatbotFormSubmitInputSchema, chatbotFormSubmitResponseSchema, chatbotMessagesResponseSchema, chatbotPersistedSessionInputSchema, chatbotPersistedSessionResponseSchema, chatbotRequestHumanInputSchema, chatbotRequestHumanResponseSchema, chatbotSessionResponseSchema, chatbotUploadUrlResponseSchema, checkoutSessionInputSchema, checkoutSessionResponseSchema, checkoutStartInputSchema, checkoutStartResponseSchema, checkoutStatusResponseSchema, confirmVerificationInputSchema, confirmVerificationResponseSchema, couponValidateInputSchema, couponValidateResponseSchema, createCollectionInputSchema, createCollectionResponseSchema, createEmailTemplateInputSchema, createEmailTemplateResponseSchema, createEmailTemplateVersionInputSchema, createEmailTemplateVersionResponseSchema, customerContactCompanyInputSchema, customerContactCompanyResponseSchema, customerContractDetailSchema, customerContractSignResponseSchema, customerDownloadsResponseSchema, customerInvoiceDetailSchema, customerInvoicePayInputSchema, customerInvoicePayResponseSchema, customerInvoicePdfSchema, customerJobActivityResponseSchema, customerJobCommentPostInputSchema, customerJobCommentSchema, customerJobCommentsListResponseSchema, customerJobDetailSchema, customerJobEtaResponseSchema, customerNotificationPreferencesResponseSchema, customerNotificationPreferencesUpdateInputSchema, customerNotificationPreferencesUpdateResponseSchema, customerOrderDetailSchema, customerOrderListResponseSchema, customerPaymentHistoryResponseSchema, customerPortalContextResponseSchema, customerPortalOtherOrgsResponseSchema, customerPortalProfileSchema, customerPortalUpdateProfileInputSchema, customerPortalUpdateProfileResponseSchema, customerQuoteActionResponseSchema, customerQuoteDetailSchema, customerReferralHistoryResponseSchema, customerReferralPayoutsResponseSchema, customerReferralStatsSchema, customerReturnRequestCreatedSchema, customerReturnRequestInputSchema, customerReviewListResponseSchema, customerReviewSubmitInputSchema, customerReviewSubmitResponseSchema, customerShipmentTrackingSchema, customerWorkBundleSchema, dashboardSessionResponseSchema, executeActionInputSchema, executeActionResponseSchema, followerEditInputSchema, followerEditResponseSchema, followerJoinInputSchema, followerJoinResponseSchema, followerLeaveInputSchema, followerLeaveResponseSchema, followerMeInputSchema, followerMeResponseSchema, getCollectionResponseSchema, getEmailTemplateResponseSchema, getMarketingLocalesResponseSchema, getMarketingPageBundleResponseSchema, getPublishedMarketingSchemaResponseSchema, getSiteMarketingPageResponseSchema, jobCategoryListResponseSchema, jobPostingListResponseSchema, jobPostingSchema, listCollectionsResponseSchema, listDataModelRecordsInputSchema, listDataModelRecordsResponseSchema, listEmailTemplatesInputSchema, listEmailTemplatesResponseSchema, listRowsInputSchema, listRowsResponseSchema, listSiteMarketingPagesResponseSchema, notificationPreferencesResponseSchema, notificationPreferencesUpdateInputSchema, pageViewsInputSchema, pageViewsResponseSchema, publishMarketingSectionsInputSchema, publishMarketingSectionsResponseSchema, queryRowsInputSchema, queryRowsResponseSchema, reviewWallListResponseSchema, shippingRatesInputSchema, shippingRatesResponseSchema, shippingSettingsResponseSchema, shippingTrackResponseSchema, siteAssetInputSchema, siteBrandingSchema, startVerificationInputSchema, startVerificationResponseSchema, storefrontAddonsResponseSchema, storefrontCategoriesResponseSchema, storefrontListProductsResponseSchema, storefrontProductDetailSchema, storefrontProductReviewsResponseSchema, storefrontProductsWithMetaResponseSchema, storefrontRelatedProductsResponseSchema, storefrontSessionInputSchema, storefrontSessionResponseSchema, subscriptionCheckoutInputSchema, subscriptionCheckoutResponseSchema, subscriptionOfferingSchema, subscriptionOfferingsListResponseSchema, tenantAuthExchangeInputSchema, tenantAuthExchangeResponseSchema, tenantAuthMeResponseSchema, tenantAuthPasswordResetInputSchema, tenantAuthPasswordResetResponseSchema, tenantAuthSignOutResponseSchema, tenantAuthStartInputSchema, tenantAuthStartResponseSchema, uploadSiteAssetResponseSchema, upsertDraftMarketingSchemaInputSchema, upsertDraftMarketingSchemaResponseSchema, upsertRowInputSchema, upsertRowResponseSchema, } from "./contracts.js";
+import { addressDetailsResponseSchema, addressFormValuesSchema, addressSearchInputSchema, addressSearchResponseSchema, addressVerifyResponseSchema, aiVisibilityInputSchema, aiVisibilityResponseSchema, attributionHeartbeatInputSchema, attributionHeartbeatResponseSchema, attributionPolicySchema, authIntrospectResponseSchema, blogCategoryListResponseSchema, blogCommentListResponseSchema, blogCommentPostInputSchema, blogCommentPostResponseSchema, blogLikeResponseSchema, blogListPostsResponseSchema, blogPostBySlugResponseSchema, blogSessionInputSchema, blogSessionResponseSchema, blogTagListResponseSchema, cartAddItemInputSchema, cartCouponInputSchema, cartSessionResponseSchema, cartSnapshotSchema, cartUpdateItemInputSchema, chatbotAppendMessageInputSchema, chatbotAvailabilitySchema, chatbotChatInputSchema, chatbotChatResponseSchema, chatbotConfigSchema, chatbotConfigUpdateInputSchema, chatbotFormDefinitionSchema, chatbotFormSubmitInputSchema, chatbotFormSubmitResponseSchema, chatbotMessagesResponseSchema, chatbotPersistedSessionInputSchema, chatbotPersistedSessionResponseSchema, chatbotRequestHumanInputSchema, chatbotRequestHumanResponseSchema, chatbotSessionResponseSchema, chatbotUploadUrlResponseSchema, checkoutSessionInputSchema, checkoutSessionResponseSchema, checkoutStartInputSchema, checkoutStartResponseSchema, checkoutStatusResponseSchema, confirmVerificationInputSchema, confirmVerificationResponseSchema, couponCreateInputSchema, couponCreateResponseSchema, couponListResponseSchema, couponValidateInputSchema, couponValidateResponseSchema, createCollectionInputSchema, createCollectionResponseSchema, createEmailTemplateInputSchema, createEmailTemplateResponseSchema, createEmailTemplateVersionInputSchema, createEmailTemplateVersionResponseSchema, customerContactCompanyInputSchema, customerContactCompanyResponseSchema, customerContractDetailSchema, customerContractListResponseSchema, customerContractSignResponseSchema, customerDownloadsResponseSchema, customerInviteResendResponseSchema, customerInvoiceDetailSchema, customerInvoiceListResponseSchema, customerInvoicePayInputSchema, customerInvoicePayResponseSchema, customerInvoicePdfSchema, customerJobActivityResponseSchema, customerJobCommentPostInputSchema, customerJobCommentSchema, customerJobCommentsListResponseSchema, customerJobDetailSchema, customerJobEtaResponseSchema, customerNotificationPreferencesResponseSchema, customerNotificationPreferencesUpdateInputSchema, customerNotificationPreferencesUpdateResponseSchema, customerNotReceivedResultSchema, customerOrderDetailSchema, customerOrderListResponseSchema, customerPaymentHistoryResponseSchema, customerPortalContextResponseSchema, customerPortalMessageListResponseSchema, customerPortalMessageSchema, customerPortalMessagesMarkReadResponseSchema, customerPortalOtherOrgsResponseSchema, customerPortalProfileSchema, customerPortalQuizResultsResponseSchema, customerPortalUpdateProfileInputSchema, customerPortalUpdateProfileResponseSchema, customerProductReviewCreatedSchema, customerProductReviewListSchema, customerPushConfigSchema, customerQuoteActionResponseSchema, customerQuoteDetailSchema, customerQuoteListResponseSchema, customerReferralHistoryResponseSchema, customerReferralPayoutsResponseSchema, customerReferralStatsSchema, customerReturnRequestCreatedSchema, customerReturnRequestInputSchema, customerReturnRequestListResponseSchema, customerReviewListResponseSchema, customerReviewSubmitInputSchema, customerReviewSubmitResponseSchema, customerShipmentListResponseSchema, customerShipmentTrackingSchema, customerSubscriberContentResponseSchema, customerSubscriptionCancelResponseSchema, customerSubscriptionResponseSchema, customerWorkBundleSchema, dashboardSessionResponseSchema, executeActionInputSchema, executeActionResponseSchema, followerEditInputSchema, followerEditResponseSchema, followerJoinInputSchema, followerJoinResponseSchema, followerLeaveInputSchema, followerLeaveResponseSchema, followerMeInputSchema, followerMeResponseSchema, getCollectionResponseSchema, getEmailTemplateResponseSchema, getMarketingLocalesResponseSchema, getMarketingPageBundleResponseSchema, getPublishedMarketingSchemaResponseSchema, getSiteMarketingPageResponseSchema, jobCategoryListResponseSchema, jobPostingListResponseSchema, jobPostingSchema, legalDocumentSchema, legalListResponseSchema, listCollectionsResponseSchema, listDataModelRecordsInputSchema, listDataModelRecordsResponseSchema, listEmailTemplatesInputSchema, listEmailTemplatesResponseSchema, listRowsInputSchema, listRowsResponseSchema, listSiteMarketingPagesResponseSchema, notificationPreferencesResponseSchema, notificationPreferencesUpdateInputSchema, pageViewsInputSchema, pageViewsResponseSchema, publishMarketingSectionsInputSchema, publishMarketingSectionsResponseSchema, queryRowsInputSchema, queryRowsResponseSchema, reviewWallListResponseSchema, schedulingBookingResultSchema, schedulingBookingViewSchema, schedulingCancelResultSchema, schedulingEventTypeDetailSchema, schedulingEventTypeListSchema, schedulingRescheduleResultSchema, schedulingSlotsResponseSchema, shippingRatesInputSchema, shippingRatesResponseSchema, shippingSettingsResponseSchema, shippingTrackResponseSchema, siteAssetInputSchema, siteBrandingSchema, startVerificationInputSchema, startVerificationResponseSchema, storefrontAddonsResponseSchema, storefrontCategoriesResponseSchema, storefrontListProductsResponseSchema, storefrontProductDetailSchema, storefrontProductReviewsResponseSchema, storefrontProductsWithMetaResponseSchema, storefrontRelatedProductsResponseSchema, storefrontSessionInputSchema, storefrontSessionResponseSchema, storefrontSyncToStripeResponseSchema, subscriptionCheckoutInputSchema, subscriptionCheckoutResponseSchema, subscriptionOfferingSchema, subscriptionOfferingsListResponseSchema, tenantAuthExchangeInputSchema, tenantAuthExchangeResponseSchema, tenantAuthMeResponseSchema, tenantAuthPasswordResetInputSchema, tenantAuthPasswordResetResponseSchema, tenantAuthSignOutResponseSchema, tenantAuthStartInputSchema, tenantAuthStartResponseSchema, uploadSiteAssetResponseSchema, upsertDraftMarketingSchemaInputSchema, upsertDraftMarketingSchemaResponseSchema, upsertRowInputSchema, upsertRowResponseSchema, } from "./contracts.js";
 import { accessRejectionFromBody, BiabApiError, isBiabPlanGateBody, } from "./errors.js";
 function buildUrl(baseUrl, path, query) {
     /**
@@ -122,6 +122,10 @@ export class BiabDevClient {
     get shipping() {
         return new BiabDevShippingClient(this);
     }
+    /** Customer-portal invitations — currently resend. */
+    get customerInvites() {
+        return new BiabDevCustomerInvitesClient(this);
+    }
     get notifications() {
         return new BiabDevNotificationsClient(this);
     }
@@ -134,10 +138,29 @@ export class BiabDevClient {
     get reviews() {
         return new BiabDevReviewsClient(this);
     }
+    /**
+     * Tracking consent for this org's site.
+     *
+     * Pair with `@businessdash/sdk/consent`, which handles the visitor cookie
+     * and gives you a gate to check before starting analytics.
+     */
+    get consent() {
+        return new BiabDevConsentClient(this);
+    }
     /** Public job postings — build a careers page on your own domain. */
     get hiring() {
         return new BiabDevHiringClient(this);
     }
+    /**
+     * The org's published legal pages — privacy, terms, refund policy, whatever
+     * they authored in the dashboard.
+     *
+     * Pair with `@businessdash/sdk/legal` to render them without writing a page
+     * per document.
+     */
+    get legal() {
+        return new BiabDevLegalClient(this);
+    }
     get chatbot() {
         return new BiabDevChatbotClient(this);
     }
@@ -240,10 +263,19 @@ export class BiabDevSiteClient {
      */
     marketing;
     parallelPages;
+    /**
+     * Booking and conference calls.
+     *
+     * Previously reachable only through `sdk.ts`'s separate scheduling
+     * resource, which is why the OpenAPI generator — which reads this file —
+     * never saw it, and why no non-JS starter had scheduling at all.
+     */
+    scheduling;
     constructor(client, siteId) {
         this.client = client;
         this.siteId = siteId;
         this.collections = new BiabDevCollectionsClient(client, siteId);
+        this.scheduling = new BiabDevSchedulingClient(client, siteId);
         this.rows = new BiabDevRowsClient(client, siteId);
         this.dataModel = new BiabDevDataModelClient(client, siteId);
         this.analytics = new BiabDevAnalyticsClient(client, siteId);
@@ -266,6 +298,25 @@ export class BiabDevSiteClient {
      * <img src={b.logoUrl ?? b.orgIcon ?? ""} alt={b.orgName ?? ""} />
      * ```
      */
+    /**
+     * Every URL the PLATFORM owns the shape of, as JSON.
+     *
+     * Published site-builder pages, published legal documents, and every
+     * materialised programmatic-page URL. Blog posts and products are not here
+     * — the platform does not know where your site renders them. Merge those in
+     * with `@businessdash/sdk/sitemap`, which handles the whole job.
+     *
+     * Paths are relative, so you join them against your own origin rather than
+     * the org's primary verified domain.
+     */
+    async sitemapEntries() {
+        return this.client.request({
+            path: `sites/${encodeURIComponent(this.siteId)}/sitemap-entries`,
+            responseSchema: z.object({
+                entries: z.array(z.object({ loc: z.string(), lastmod: z.string().optional() })),
+            }),
+        });
+    }
     async branding() {
         return this.client.request({
             path: `sites/${encodeURIComponent(this.siteId)}/branding`,
@@ -1054,6 +1105,42 @@ export class BiabDevStorefrontClient {
             responseSchema: storefrontSessionResponseSchema,
         });
     }
+    /**
+     * Push your catalog into YOUR OWN Stripe account.
+     *
+     * Products and their variant combinations become Stripe Products and
+     * Prices on the Stripe account connected to your workspace, so you can
+     * manage the catalog here and let Stripe be the system of record for
+     * money. Safe to re-run: an unchanged product is left alone, and a new
+     * Price is minted only when the amount actually changed (Stripe Prices
+     * are immutable on amount).
+     *
+     * Requires a SECRET key holding `storefront:write` — never a publishable
+     * token, because this spends against Stripe on your behalf.
+     *
+     * Pass `productId` to sync one product. Omit it to sync everything not yet
+     * pushed, in bounded batches: check `remaining` and call again until it
+     * reaches 0.
+     *
+     * ```ts
+     * let remaining = 1;
+     * while (remaining > 0) {
+     *   const res = await biab.storefront.syncToStripe();
+     *   remaining = res.remaining;
+     * }
+     * ```
+     *
+     * Per-product failures are returned in `failed` rather than throwing, so
+     * one bad product doesn't abandon the batch.
+     */
+    async syncToStripe(input) {
+        return this.client.request({
+            method: "POST",
+            path: "storefront/products/sync-to-stripe",
+            body: input?.productId ? { productId: input.productId } : {},
+            responseSchema: storefrontSyncToStripeResponseSchema,
+        });
+    }
     /**
      * Paginated list of live products for the calling org's storefront.
      * Cursor is an opaque integer offset — pass back the response's
@@ -1117,6 +1204,38 @@ export class BiabDevStorefrontClient {
      * via `BiabApiError` if the product isn't live or doesn't belong
      * to the org bound to the API key.
      */
+    /**
+     * The CAD file for a product — STEP, IGES, or a native part file.
+     *
+     * ## Call this from YOUR server, then proxy it
+     *
+     * The API key is a server secret, so a browser cannot reach this directly.
+     * Expose your own route (`/api/products/:id/cad`), call this behind it, and
+     * redirect the visitor to the URL it returns.
+     *
+     * The platform withholds the raw URL from every product payload on purpose:
+     * CAD files are the largest thing it serves and are the org's intellectual
+     * property, so a catalog of naked URLs is a design library published to
+     * anyone willing to write a loop. This endpoint requires a `biab_cad` cookie
+     * on the incoming request, rate-limits per IP, and re-checks the
+     * `ecommerce.product_3d` entitlement before answering.
+     *
+     * `cacheSeconds` is what to put on your own response — CAD at a content URL
+     * does not change, so caching hard is where the bandwidth saving comes from.
+     *
+     * Rejects 404 when the product is a draft, has no CAD file, or the org lacks
+     * the add-on. Those are deliberately one answer.
+     */
+    async getCadDownload(productId) {
+        return this.client.request({
+            path: `storefront/products/${encodeURIComponent(productId)}/cad`,
+            responseSchema: z.object({
+                url: z.string(),
+                fileName: z.string().nullable(),
+                cacheSeconds: z.number(),
+            }),
+        });
+    }
     async getProduct(productId) {
         return this.client.request({
             path: `storefront/products/${encodeURIComponent(productId)}`,
@@ -1509,6 +1628,47 @@ export class BiabDevCouponsClient {
      * else toast.error(result.message);
      * ```
      */
+    /**
+     * Create a coupon and make it live in YOUR OWN Stripe account in one call —
+     * a Stripe Coupon plus a Promotion Code, so the same string works on your
+     * storefront and on Stripe-hosted Checkout.
+     *
+     * Creation and the Stripe sync are one operation deliberately: a coupon
+     * that exists locally but not in Stripe is the failure worth designing out,
+     * where a customer types a code your storefront accepts and Stripe rejects.
+     * If the sync fails the coupon is still created and `stripeSynced` comes
+     * back `false` with the reason, rather than pretending it is live.
+     *
+     * Requires a SECRET key holding `storefront:write`.
+     *
+     * ```ts
+     * const { coupon, stripeSynced } = await biab.coupons.create({
+     *   code: 'WELCOME10',
+     *   discountType: 'percent',
+     *   value: 10,
+     * })
+     * ```
+     *
+     * Buy-X-get-Y and bundle-gift coupons aren't available here — Stripe has no
+     * native BXGY, so those run through our own cart math and need the offer
+     * rows the dashboard collects.
+     */
+    async create(input) {
+        const body = couponCreateInputSchema.parse(input);
+        return this.client.request({
+            method: "POST",
+            path: "coupons",
+            body,
+            responseSchema: couponCreateResponseSchema,
+        });
+    }
+    /** Every coupon on the workspace, newest first. Requires `storefront:write`. */
+    async list() {
+        return this.client.request({
+            path: "coupons",
+            responseSchema: couponListResponseSchema,
+        });
+    }
     async validate(code) {
         const body = couponValidateInputSchema.parse({ code });
         return this.client.request({
@@ -1944,6 +2104,105 @@ export class BiabDevHiringClient {
         });
     }
 }
+/**
+ * The org's published legal pages.
+ *
+ * Everything here is content the org deliberately put on the public internet;
+ * drafts are filtered server-side and unreachable. Requires `legal:read`, which
+ * is publishable — a browser token is the expected caller.
+ *
+ * @example
+ * ```ts
+ * const { items, presentation } = await client.legal.list();
+ * const privacy = await client.legal.get("privacy");
+ * ```
+ */
+export class BiabDevLegalClient {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * Every published document, plus the header/footer presentation.
+     *
+     * Both in one response because the common use — a footer link list — needs
+     * the titles and the presentation together, and a second round trip for the
+     * latter is one a site either makes on every page or skips entirely.
+     */
+    async list() {
+        return this.client.request({
+            path: "legal",
+            responseSchema: legalListResponseSchema,
+        });
+    }
+    /**
+     * One document by slug, body included.
+     *
+     * Rejects with a 404 when the slug is unpublished or absent — the two are
+     * deliberately indistinguishable, since "exists but hidden" would leak that
+     * an org is drafting a policy and is not something a caller can act on.
+     */
+    async get(slug) {
+        return this.client.request({
+            path: `legal/${encodeURIComponent(slug)}`,
+            responseSchema: legalDocumentSchema,
+        });
+    }
+}
+const consentStateSchema = z.object({
+    /** Categories this org uses at all — one banner row each. */
+    categories: z.array(z.string()),
+    noticeText: z.string().nullable(),
+    noticeVersion: z.number(),
+    /** What may be used right now. */
+    allowed: z.array(z.string()),
+    mustAsk: z.boolean(),
+    reason: z.string(),
+});
+/**
+ * Tracking consent, scoped to the calling org.
+ *
+ * Every call is answered for the org whose key made it. There is no shape here
+ * that could read or write another org's consent — consent is given to a
+ * controller, and one controller's record is not another's to act on.
+ *
+ * The visitor is identified by an `x-biab-visitor` header carrying an opaque id
+ * from the caller's own first-party cookie. `@businessdash/sdk/consent` manages
+ * that for you; these methods are the transport underneath it.
+ */
+export class BiabDevConsentClient {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /** The notice to show, and what this visitor currently allows. */
+    async get(visitorKey) {
+        return this.client.request({
+            path: "consent",
+            responseSchema: consentStateSchema,
+            ...(visitorKey ? { headers: { "x-biab-visitor": visitorKey } } : {}),
+        });
+    }
+    /**
+     * Record the visitor's answer.
+     *
+     * `granted: []` is a real answer — "asked, refused everything" — and is
+     * stored as one, so the banner does not reappear on the next page.
+     */
+    async record(input) {
+        return this.client.request({
+            method: "POST",
+            path: "consent",
+            body: {
+                granted: input.granted,
+                noticeVersion: input.noticeVersion,
+                source: input.source ?? "banner",
+            },
+            headers: { "x-biab-visitor": input.visitorKey },
+            responseSchema: z.object({ ok: z.boolean() }),
+        });
+    }
+}
 export class BiabDevChatbotClient {
     client;
     constructor(client) {
@@ -2267,6 +2526,24 @@ export class BiabDevCustomerPortalClient {
             headers: this.headers(),
         });
     }
+    /**
+     * The signed-in customer's quiz results at this org — the SDK side of
+     * the account-gated reveal: an invitation completed with "create an
+     * account to see how you did" surfaces its result here (and only to
+     * the invited email). Interview-mode quizzes come back with
+     * `scoreWithheld: true` and no verdict, by the org's own setting.
+     */
+    async myQuizResults(options) {
+        const params = new URLSearchParams();
+        if (options?.token)
+            params.set("token", options.token);
+        const qs = params.toString();
+        return this.client.request({
+            path: `customer-portal/quiz-results${qs ? `?${qs}` : ""}`,
+            responseSchema: customerPortalQuizResultsResponseSchema,
+            headers: this.headers(),
+        });
+    }
     async updateProfile(input) {
         const body = customerPortalUpdateProfileInputSchema.parse(input);
         return this.client.request({
@@ -2541,6 +2818,135 @@ export class BiabDevCustomerPortalClient {
             headers: this.headers(),
         });
     }
+    /**
+     * The return requests on one order, newest first.
+     *
+     * `resolutionNote` carries staff's answer — when a return is denied that IS
+     * the answer, and hiding it just moves the question to email.
+     */
+    async listReturnRequests(orderId) {
+        return this.client.request({
+            path: `customer-portal/orders/${encodeURIComponent(orderId)}/return-request`,
+            responseSchema: customerReturnRequestListResponseSchema,
+            headers: this.headers(),
+        });
+    }
+    /**
+     * The customer's message thread with the org's staff, newest first.
+     *
+     * Automated rows — the review-ask and similar — are excluded server-side, so
+     * this is only what a person wrote.
+     */
+    async listMessages(opts) {
+        const params = new URLSearchParams();
+        if (typeof opts?.limit === "number")
+            params.set("limit", String(opts.limit));
+        if (opts?.jobId)
+            params.set("jobId", opts.jobId);
+        const qs = params.toString();
+        return this.client.request({
+            path: `customer-portal/messages${qs ? `?${qs}` : ""}`,
+            responseSchema: customerPortalMessageListResponseSchema,
+            headers: this.headers(),
+        });
+    }
+    /** Send a message to the org's staff. Lands in the CRM timeline. */
+    async postMessage(input) {
+        return this.client.request({
+            path: "customer-portal/messages",
+            method: "POST",
+            body: input,
+            responseSchema: customerPortalMessageSchema,
+            headers: this.headers(),
+        });
+    }
+    /**
+     * Mark the staff messages read up to now.
+     *
+     * One-way: it never clears a stamp. A portal that could un-read a message
+     * would let a customer hide from staff that they had seen something.
+     */
+    async markMessagesRead() {
+        return this.client.request({
+            path: "customer-portal/messages",
+            method: "PATCH",
+            responseSchema: customerPortalMessagesMarkReadResponseSchema,
+            headers: this.headers(),
+        });
+    }
+    /**
+     * The customer's invoices, newest first.
+     *
+     * `unpaid: true` filters on the computed BALANCE rather than on the status
+     * string, because a partially-paid invoice still owes money whatever it is
+     * called. This is the call behind "show me everything I owe" — which had no
+     * endpoint at all before 0.9.61.
+     */
+    async listInvoices(opts) {
+        const params = new URLSearchParams();
+        if (typeof opts?.limit === "number")
+            params.set("limit", String(opts.limit));
+        if (opts?.status)
+            params.set("status", opts.status);
+        if (opts?.unpaid)
+            params.set("unpaid", "1");
+        const qs = params.toString();
+        return this.client.request({
+            path: `customer-portal/invoices${qs ? `?${qs}` : ""}`,
+            responseSchema: customerInvoiceListResponseSchema,
+            headers: this.headers(),
+        });
+    }
+    /** The customer's quotes. `status: "sent"` is the set still awaiting them. */
+    async listQuotes(opts) {
+        const params = new URLSearchParams();
+        if (typeof opts?.limit === "number")
+            params.set("limit", String(opts.limit));
+        if (opts?.status)
+            params.set("status", opts.status);
+        const qs = params.toString();
+        return this.client.request({
+            path: `customer-portal/quotes${qs ? `?${qs}` : ""}`,
+            responseSchema: customerQuoteListResponseSchema,
+            headers: this.headers(),
+        });
+    }
+    /** The customer's contracts. `status: "sent"` still awaits a signature. */
+    async listContracts(opts) {
+        const params = new URLSearchParams();
+        if (typeof opts?.limit === "number")
+            params.set("limit", String(opts.limit));
+        if (opts?.status)
+            params.set("status", opts.status);
+        const qs = params.toString();
+        return this.client.request({
+            path: `customer-portal/contracts${qs ? `?${qs}` : ""}`,
+            responseSchema: customerContractListResponseSchema,
+            headers: this.headers(),
+        });
+    }
+    /**
+     * Every shipment across the customer's orders. `active: true` narrows to
+     * parcels still moving.
+     *
+     * STORED status only — no live carrier poll. `trackShipment(id)` spends a
+     * Shippo request because it is one parcel the customer opened; doing that
+     * per row here would mean a carrier call for every parcel in their history
+     * on every page load.
+     */
+    async listShipments(opts) {
+        const params = new URLSearchParams();
+        if (typeof opts?.limit === "number")
+            params.set("limit", String(opts.limit));
+        if (opts?.active)
+            params.set("active", "1");
+        const qs = params.toString();
+        return this.client.request({
+            path: `customer-portal/shipments${qs ? `?${qs}` : ""}`,
+            responseSchema: customerShipmentListResponseSchema,
+            headers: this.headers(),
+        });
+    }
     /**
      * The signed-in customer's orders (newest first), each with a shipment
      * roll-up (`overallStatus`, `anyInTransit`, `latestEstimatedDelivery`) for
@@ -2623,6 +3029,243 @@ export class BiabDevCustomerPortalClient {
             headers: this.headers(),
         });
     }
+    /**
+     * Ask for a replacement instead of a refund.
+     *
+     * Sugar over `submitReturnRequest` with `kind: "exchange"`, because an
+     * exchange reads as its own action to the person writing the UI, and burying
+     * it in an options bag is how it stays undiscovered. `variantId` is the one
+     * they want instead — omit it when that still needs a conversation.
+     *
+     * @example
+     * ```ts
+     * await portal.submitExchangeRequest(orderId, {
+     *   exchangeForVariantId: largeVariantId,
+     *   reason: "wrong size",
+     * });
+     * ```
+     */
+    async submitExchangeRequest(orderId, input) {
+        return this.submitReturnRequest(orderId, {
+            ...(input ?? {}),
+            kind: "exchange",
+        });
+    }
+    /**
+     * Report that a parcel never arrived.
+     *
+     * This does NOT change the shipment's carrier status, and deliberately so:
+     * when the carrier says delivered and the customer says otherwise, both
+     * facts matter — the carrier's scan is what the org files a claim against.
+     * The result carries `carrierStatus` alongside the report so a UI can show
+     * both: *"Carrier says delivered Aug 14 · You reported not received Aug 16."*
+     *
+     * `contested: true` means exactly that disagreement. Re-reporting an open
+     * claim returns it with `alreadyOpen: true` rather than erroring — a
+     * customer tapping twice is anxious, not hostile.
+     *
+     * @example
+     * ```ts
+     * const r = await portal.reportNotReceived(shipmentId, {
+     *   note: "Nothing on the porch, checked with neighbours.",
+     * });
+     * if (r.contested) showCarrierDisputeHelp();
+     * ```
+     */
+    async reportNotReceived(shipmentId, input) {
+        const body = input?.note ? { note: input.note } : {};
+        return this.client.request({
+            method: "POST",
+            path: `customer-portal/shipments/${encodeURIComponent(shipmentId)}/not-received`,
+            body,
+            responseSchema: customerNotReceivedResultSchema,
+            headers: this.headers(),
+        });
+    }
+    /**
+     * The product reviews this customer has written for this org.
+     *
+     * Distinct from `listReviews()`, which is reviews of the ORG. Both exist
+     * because "are these people good to deal with" and "is this thing any good"
+     * are different questions, stored in different tables, and shown in
+     * different places.
+     *
+     * `isApproved: false` means QUEUED, not rejected — render it as "awaiting
+     * review" or the customer will assume it was lost and write it again.
+     */
+    /**
+     * The customer's subscription with this org, and what the org offers.
+     *
+     * One subscription per org — `user_subscriptions` is unique on
+     * (user, org) — so there is no id to pass. The org's live offerings come
+     * back alongside, because a portal that reports "not subscribed" and
+     * nothing else is a dead end.
+     *
+     * **Render entitlement from `subscription.hasAccess`, not from `status`.**
+     * A lifetime purchase has no period to expire and a cancelled subscription
+     * keeps access until the period already paid for ends; `hasAccess` is
+     * computed by the same function the content gates use, so the portal and
+     * the gate cannot disagree.
+     */
+    async getSubscription() {
+        return this.client.request({
+            path: "customer-portal/subscription",
+            responseSchema: customerSubscriptionResponseSchema,
+            headers: this.headers(),
+        });
+    }
+    /**
+     * Cancel the subscription at the end of the paid period.
+     *
+     * Cancelling ends the RENEWAL, not the access: the customer has paid for
+     * the period they are in and keeps everything until `accessUntil`. Ending
+     * access on the click would take back something they already bought, which
+     * is the most common way a subscription flow feels like a trap.
+     *
+     * Read `accessUntil` back to them — "active until 14 March" is the true
+     * statement, not "cancelled".
+     */
+    async cancelSubscription() {
+        return this.client.request({
+            method: "POST",
+            path: "customer-portal/subscription/cancel",
+            body: { resume: false },
+            responseSchema: customerSubscriptionCancelResponseSchema,
+            headers: this.headers(),
+        });
+    }
+    /**
+     * Clear a pending cancellation.
+     *
+     * Between cancelling and the period ending nothing has actually been lost,
+     * so changing your mind should cost one call rather than a re-purchase.
+     * After the period ends there is nothing to resume and they subscribe again
+     * like anyone else.
+     */
+    async resumeSubscription() {
+        return this.client.request({
+            method: "POST",
+            path: "customer-portal/subscription/cancel",
+            body: { resume: true },
+            responseSchema: customerSubscriptionCancelResponseSchema,
+            headers: this.headers(),
+        });
+    }
+    /**
+     * The content this subscription entitles them to — the answer to "what am
+     * I actually getting for this?", which is the question asked right before
+     * someone cancels.
+     *
+     * When `entitled` is false these are LOCKED previews, not an empty
+     * entitlement: titles, excerpts and images, no bodies. Show them beside the
+     * offer. Rendering an empty list would hide the pitch at exactly the moment
+     * it is most relevant.
+     */
+    async getSubscriberContent(opts) {
+        const params = new URLSearchParams();
+        if (typeof opts?.limit === "number")
+            params.set("limit", String(opts.limit));
+        const qs = params.toString();
+        return this.client.request({
+            path: `customer-portal/subscription/content${qs ? `?${qs}` : ""}`,
+            responseSchema: customerSubscriberContentResponseSchema,
+            headers: this.headers(),
+        });
+    }
+    /**
+     * Push config and the browsers this customer has registered.
+     *
+     * Returns `vapidPublicKey` too, because a page cannot subscribe without it.
+     */
+    async getPushConfig() {
+        return this.client.request({
+            path: "customer-portal/push",
+            responseSchema: customerPushConfigSchema,
+            headers: this.headers(),
+        });
+    }
+    /**
+     * Register this browser.
+     *
+     * Pair with `subscribeToPush()` from `@businessdash/sdk/push-core`, which
+     * handles the service worker, the permission prompt and the key encoding
+     * and hands back exactly this payload.
+     *
+     * Upserted on the endpoint, so re-subscribing from the same browser
+     * refreshes the row rather than creating a second one.
+     */
+    async subscribePush(input) {
+        return this.client.request({
+            method: "POST",
+            path: "customer-portal/push",
+            body: input,
+            responseSchema: z.object({ id: z.string(), created: z.boolean() }),
+            headers: this.headers(),
+        });
+    }
+    /**
+     * Rename a device, or narrow what it receives.
+     *
+     * `categories: []` means "nothing for now" and keeps the subscription
+     * warm — browsers make re-granting a revoked permission deliberately
+     * awkward, so an "off" that discards the subscription is hard to undo.
+     */
+    async updatePushDevice(input) {
+        return this.client.request({
+            method: "PATCH",
+            path: "customer-portal/push",
+            body: input,
+            responseSchema: z.object({ ok: z.boolean() }),
+            headers: this.headers(),
+        });
+    }
+    /**
+     * Forget a device. Takes an id or the endpoint.
+     *
+     * A browser tearing its own subscription down knows its endpoint, not our
+     * row id — so pass what `unsubscribeFromPush()` returns.
+     */
+    async unsubscribePush(input) {
+        return this.client.request({
+            method: "DELETE",
+            path: "customer-portal/push",
+            body: input,
+            responseSchema: z.object({
+                ok: z.boolean(),
+                deletedId: z.string().nullable(),
+            }),
+            headers: this.headers(),
+        });
+    }
+    async listProductReviews() {
+        return this.client.request({
+            path: "customer-portal/product-reviews",
+            responseSchema: customerProductReviewListSchema,
+            headers: this.headers(),
+        });
+    }
+    /**
+     * Review a product this customer BOUGHT.
+     *
+     * The portal requires a matching order — it is standing inside the
+     * customer's purchase history, which is the one thing the public storefront
+     * does not know. That makes these verified-buyer reviews, and it stops a
+     * competitor one-starring a catalogue they never bought.
+     *
+     * Rejects with `not_purchased` (403) when no order matches, and
+     * `already_reviewed` (409) on a second review of the same product.
+     * Moderation follows the ORG's policy, so the result may be
+     * `awaitingModeration`.
+     */
+    async submitProductReview(input) {
+        return this.client.request({
+            method: "POST",
+            path: "customer-portal/product-reviews",
+            body: input,
+            responseSchema: customerProductReviewCreatedSchema,
+            headers: this.headers(),
+        });
+    }
     /**
      * List the digital downloads the customer is entitled to for a paid order
      * (P10d). Each item is a ready-to-use URL — a short-lived presigned link for
@@ -2718,6 +3361,22 @@ export class BiabDevCustomerPortalClient {
      * dispatch travel-time recompute layer ships, at which point the
      * `eta` field switches sources without breaking this shape.
      */
+    /**
+     * Where the job and its technicians are in the dispatch lifecycle.
+     *
+     * Named for ETA historically; it is the DISPATCH STATUS surface, which is
+     * why `getDispatchStatus` below is the same call under the name people
+     * look for.
+     *
+     * Read `dispatchStatus` (job-level) for "is anyone on the way" and
+     * `assignments[].dispatchStatus` for per-technician detail. They differ on
+     * purpose: the job is `completed` only once the LAST assignee finishes.
+     *
+     * Nothing about the dispatch CASCADE is exposed — who was offered the job,
+     * who declined, how many people were asked before someone accepted. That
+     * is staff-internal, and a customer learning they were the fourth choice
+     * helps nobody.
+     */
     async getJobEta(jobId) {
         return this.client.request({
             path: `customer-portal/jobs/${encodeURIComponent(jobId)}/eta`,
@@ -2725,6 +3384,16 @@ export class BiabDevCustomerPortalClient {
             headers: this.headers(),
         });
     }
+    /**
+     * Dispatch status for a job — the same call as `getJobEta`, under the name
+     * developers actually search for.
+     *
+     * An alias rather than a second route: two endpoints returning the same
+     * thing is how they drift.
+     */
+    async getDispatchStatus(jobId) {
+        return this.getJobEta(jobId);
+    }
     /**
      * Unified job activity feed: structured events (status changes,
      * dispatch lifecycle, media uploads, quote/contract/invoice
@@ -2842,4 +3511,222 @@ export class BiabDevAuthClient {
         });
     }
 }
+/**
+ * Booking, rescheduling, cancelling — and the conference call attached to it.
+ *
+ * ## Both sides of every flow
+ *
+ * An invitee acts with a signed TOKEN from their confirmation email; staff act
+ * with the API key. Both reach the same service, so the same notifications fire
+ * to the invitee AND every host either way, and the booking records which of
+ * them made the change.
+ *
+ * ## Three tokens, not one
+ *
+ * A confirmed booking yields `manageToken`, `rescheduleToken` and `cancelToken`
+ * separately. A cancel link in an email must not also be able to reschedule,
+ * and neither should be able to read the whole booking. One token for all three
+ * would make every emailed link as powerful as the strongest thing it enables.
+ *
+ * ## The conference link is re-minted on reschedule
+ *
+ * Moving a booking can issue a new meeting URL. Read `conferenceLink` back from
+ * the reschedule result rather than reusing the one from confirmation —
+ * otherwise the calendar invite you send points at a dead room.
+ */
+/**
+ * Customer-portal invitations.
+ *
+ * For an org running its own admin tooling rather than the dashboard.
+ */
+export class BiabDevCustomerInvitesClient {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * Hand an invite link out again.
+     *
+     * **Rotates the token** — the previous link stops working. That is the
+     * point rather than a side effect: if the reason for resending was "it went
+     * to the wrong address", rotating IS the fix, and reusing the token would
+     * leave the wrong recipient holding a working invitation. The cost is that
+     * someone who finds the original email later gets a dead link, which is a
+     * support message rather than an account.
+     *
+     * Rate limited to one send a minute per invitation, answering **429** with
+     * a retry hint. Resend mails an address the caller chose, so an unbounded
+     * one is a mail-bombing tool. Staff clicking the button in the dashboard
+     * skip the wait; an API key does not, because an API key is the automated
+     * caller the limit exists for.
+     *
+     * Refuses a **revoked** invitation (resending would quietly un-revoke it)
+     * and a **fully-redeemed** one (it did its job; a new invitation should be
+     * created as one, so the list keeps showing what happened).
+     */
+    async resend(inviteId, opts) {
+        return this.client.request({
+            method: "POST",
+            path: `customer-invites/${encodeURIComponent(inviteId)}/resend`,
+            body: opts?.expiresInDays === undefined
+                ? {}
+                : { expiresInDays: opts.expiresInDays },
+            responseSchema: customerInviteResendResponseSchema,
+        });
+    }
+}
+export class BiabDevSchedulingClient {
+    client;
+    siteId;
+    constructor(client, siteId) {
+        this.client = client;
+        this.siteId = siteId;
+    }
+    path(suffix) {
+        return `sites/${encodeURIComponent(this.siteId)}/scheduling/${suffix}`;
+    }
+    /** What the org offers to book. */
+    async listEventTypes() {
+        return this.client.request({
+            path: this.path("event-types"),
+            responseSchema: schedulingEventTypeListSchema,
+        });
+    }
+    /** One event type, plus the questions asked when booking it. */
+    async getEventType(slug) {
+        return this.client.request({
+            path: this.path(`event-types/${encodeURIComponent(slug)}`),
+            responseSchema: schedulingEventTypeDetailSchema,
+        });
+    }
+    /**
+     * Free slots in a window.
+     *
+     * Ask for the window you are about to render, not the whole month: slot
+     * computation walks every host's calendar and busy times, so a wide range
+     * is a slow one.
+     */
+    async getAvailableSlots(slug, params) {
+        const query = new URLSearchParams({
+            from: typeof params.from === "string"
+                ? params.from
+                : params.from.toISOString(),
+            to: typeof params.to === "string" ? params.to : params.to.toISOString(),
+        });
+        return this.client.request({
+            path: this.path(`event-types/${encodeURIComponent(slug)}/slots?${query.toString()}`),
+            responseSchema: schedulingSlotsResponseSchema,
+        });
+    }
+    /**
+     * Book a slot.
+     *
+     * Returns `pending` rather than `confirmed` when the event type requires
+     * approval — say "requested" in the UI for that case, because telling
+     * someone their meeting is booked when staff still have to accept it is the
+     * kind of thing they plan a day around.
+     */
+    async confirmBooking(input) {
+        const body = {
+            ...input,
+            startAt: typeof input.startAt === "string"
+                ? input.startAt
+                : input.startAt.toISOString(),
+        };
+        return this.client.request({
+            method: "POST",
+            path: this.path("bookings"),
+            body,
+            responseSchema: schedulingBookingResultSchema,
+        });
+    }
+    /**
+     * Read a booking with one of its signed tokens.
+     *
+     * `type` must match the token you hold — a cancel token will not open the
+     * manage view. That is the point of issuing three.
+     */
+    async getBooking(token, type = "manage") {
+        return this.client.request({
+            path: this.path(`bookings/by-token/${encodeURIComponent(token)}?type=${encodeURIComponent(type)}`),
+            responseSchema: schedulingBookingViewSchema,
+        });
+    }
+    /**
+     * Move a booking — the INVITEE side, with their reschedule token.
+     *
+     * Notifies the invitee and every host, and cancels the reminder jobs queued
+     * against the old time so nobody gets "your meeting starts in 15 minutes"
+     * for a slot that moved.
+     */
+    async rescheduleBooking(input) {
+        return this.client.request({
+            method: "POST",
+            path: this.path(`bookings/by-token/${encodeURIComponent(input.token)}`),
+            body: {
+                action: "reschedule",
+                newStartAt: typeof input.newStartAt === "string"
+                    ? input.newStartAt
+                    : input.newStartAt.toISOString(),
+                ...(input.reason ? { reason: input.reason } : {}),
+            },
+            responseSchema: schedulingRescheduleResultSchema,
+        });
+    }
+    /**
+     * Move a booking as STAFF, with the API key rather than an invitee token.
+     *
+     * Same service as the token path, so the invitee AND every host are
+     * notified either way, and the reminder jobs for the old time are
+     * cancelled either way. `actorUserId` records WHO moved it, which is what
+     * lets a customer's history say "they rescheduled" rather than leaving an
+     * unexplained change.
+     */
+    async rescheduleBookingAsStaff(input) {
+        return this.client.request({
+            method: "POST",
+            path: this.path(`bookings/${encodeURIComponent(input.bookingId)}/manage`),
+            body: {
+                action: "reschedule",
+                newStartAt: typeof input.newStartAt === "string"
+                    ? input.newStartAt
+                    : input.newStartAt.toISOString(),
+                ...(input.reason ? { reason: input.reason } : {}),
+                ...(input.actorUserId ? { actorUserId: input.actorUserId } : {}),
+            },
+            responseSchema: schedulingRescheduleResultSchema,
+        });
+    }
+    /** Cancel a booking as STAFF. Notifies the invitee and every host. */
+    async cancelBookingAsStaff(input) {
+        return this.client.request({
+            method: "POST",
+            path: this.path(`bookings/${encodeURIComponent(input.bookingId)}/manage`),
+            body: {
+                action: "cancel",
+                ...(input.reason ? { reason: input.reason } : {}),
+                ...(input.actorUserId ? { actorUserId: input.actorUserId } : {}),
+            },
+            responseSchema: schedulingCancelResultSchema,
+        });
+    }
+    /**
+     * Cancel a booking — the INVITEE side, with their cancel token.
+     *
+     * `reason` is passed to the hosts. Worth collecting: "something came up" and
+     * "I booked the wrong service" lead to different follow-ups, and the second
+     * is recoverable revenue.
+     */
+    async cancelBooking(input) {
+        return this.client.request({
+            method: "POST",
+            path: this.path(`bookings/by-token/${encodeURIComponent(input.token)}`),
+            body: {
+                action: "cancel",
+                ...(input.reason ? { reason: input.reason } : {}),
+            },
+            responseSchema: schedulingCancelResultSchema,
+        });
+    }
+}
 //# sourceMappingURL=client.js.map