@businessdash/sdk 0.9.60

package/dist/mcp.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Serve your business's MCP connector from YOUR domain.
+ *
+ * The platform's host-resolved `/api/mcp` only exists on sites the platform
+ * serves. If you host your own app with the SDK, mount these two handlers
+ * and your domain gains the same connector surface — so the URL an org
+ * hands to Claude / ChatGPT / Gemini is their own site, exactly like the
+ * docs promise:
+ *
+ * ```ts
+ * // app/api/mcp/route.ts
+ * import { mcpHandler } from '@businessdash/sdk/mcp'
+ * export const { POST, GET } = mcpHandler({
+ *   siteId: process.env.BIAB_SITE_ID!,
+ *   baseUrl: process.env.NEXT_PUBLIC_BIAB_APP_URL!, // https://www.biab.app
+ * })
+ *
+ * // app/.well-known/mcp.json/route.ts
+ * import { mcpManifestHandler } from '@businessdash/sdk/mcp'
+ * export const GET = mcpManifestHandler({
+ *   siteId: process.env.BIAB_SITE_ID!,
+ *   baseUrl: process.env.NEXT_PUBLIC_BIAB_APP_URL!,
+ * })
+ * ```
+ *
+ * Thin by design: the body is forwarded verbatim and the platform still
+ * enforces the org's MCP opt-in and per-tool write gates — a proxy can't
+ * widen anything.
+ */
+export type McpProxyOptions = {
+    siteId: string;
+    /** Platform origin, e.g. "https://www.biab.app". */
+    baseUrl: string;
+};
+/** POST proxies JSON-RPC to the platform; GET mirrors the spec's 405. */
+export declare function mcpHandler(options: McpProxyOptions): {
+    POST: (request: Request) => Promise<Response>;
+    GET: () => Promise<Response>;
+};
+/** Serves `.well-known/mcp.json` with the endpoint URL pointing at YOUR domain. */
+export declare function mcpManifestHandler(options: McpProxyOptions): (request: Request) => Promise<Response>;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,MAAM,eAAe,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;CAChB,CAAC;AAQF,yEAAyE;AACzE,wBAAgB,UAAU,CAAC,OAAO,EAAE,eAAe,GAAG;IACrD,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,GAAG,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7B,CAoCA;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,eAAe,GACtB,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAoBzC"}

package/dist/mcp.js

@@ -0,0 +1,87 @@
+/**
+ * Serve your business's MCP connector from YOUR domain.
+ *
+ * The platform's host-resolved `/api/mcp` only exists on sites the platform
+ * serves. If you host your own app with the SDK, mount these two handlers
+ * and your domain gains the same connector surface — so the URL an org
+ * hands to Claude / ChatGPT / Gemini is their own site, exactly like the
+ * docs promise:
+ *
+ * ```ts
+ * // app/api/mcp/route.ts
+ * import { mcpHandler } from '@businessdash/sdk/mcp'
+ * export const { POST, GET } = mcpHandler({
+ *   siteId: process.env.BIAB_SITE_ID!,
+ *   baseUrl: process.env.NEXT_PUBLIC_BIAB_APP_URL!, // https://www.biab.app
+ * })
+ *
+ * // app/.well-known/mcp.json/route.ts
+ * import { mcpManifestHandler } from '@businessdash/sdk/mcp'
+ * export const GET = mcpManifestHandler({
+ *   siteId: process.env.BIAB_SITE_ID!,
+ *   baseUrl: process.env.NEXT_PUBLIC_BIAB_APP_URL!,
+ * })
+ * ```
+ *
+ * Thin by design: the body is forwarded verbatim and the platform still
+ * enforces the org's MCP opt-in and per-tool write gates — a proxy can't
+ * widen anything.
+ */
+function upstream(options) {
+    return `${options.baseUrl.replace(/\/$/, "")}/api/public/mcp/${encodeURIComponent(options.siteId)}`;
+}
+/** POST proxies JSON-RPC to the platform; GET mirrors the spec's 405. */
+export function mcpHandler(options) {
+    const target = upstream(options);
+    return {
+        POST: async (request) => {
+            try {
+                const res = await fetch(target, {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        Accept: request.headers.get("accept") ?? "application/json",
+                    },
+                    body: await request.text(),
+                });
+                const text = await res.text();
+                return new Response(text.length > 0 ? text : null, {
+                    status: res.status,
+                    headers: {
+                        "Content-Type": res.headers.get("content-type") ?? "application/json",
+                        "Cache-Control": "no-store",
+                    },
+                });
+            }
+            catch {
+                return Response.json({
+                    jsonrpc: "2.0",
+                    id: null,
+                    error: { code: -32603, message: "Upstream unavailable" },
+                }, { status: 502 });
+            }
+        },
+        GET: async () => new Response(null, { status: 405, headers: { Allow: "POST" } }),
+    };
+}
+/** Serves `.well-known/mcp.json` with the endpoint URL pointing at YOUR domain. */
+export function mcpManifestHandler(options) {
+    const target = `${upstream(options)}/manifest`;
+    return async (request) => {
+        try {
+            const origin = new URL(request.url).origin;
+            const res = await fetch(`${target}?origin=${encodeURIComponent(origin)}`, { next: { revalidate: 300 } });
+            return new Response(await res.text(), {
+                status: res.status,
+                headers: {
+                    "Content-Type": "application/json",
+                    "Cache-Control": "public, max-age=300",
+                },
+            });
+        }
+        catch {
+            return Response.json({ error: "upstream_unavailable" }, { status: 502 });
+        }
+    };
+}
+//# sourceMappingURL=mcp.js.map

package/dist/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAQH,SAAS,QAAQ,CAAC,OAAwB;IACzC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,kBAAkB,CAChF,OAAO,CAAC,MAAM,CACd,EAAE,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,UAAU,CAAC,OAAwB;IAIlD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO;QACN,IAAI,EAAE,KAAK,EAAE,OAAgB,EAAE,EAAE;YAChC,IAAI,CAAC;gBACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;oBAC/B,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACR,cAAc,EAAE,kBAAkB;wBAClC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,kBAAkB;qBAC3D;oBACD,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE;iBAC1B,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;oBAClD,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE;wBACR,cAAc,EACb,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,kBAAkB;wBACtD,eAAe,EAAE,UAAU;qBAC3B;iBACD,CAAC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,QAAQ,CAAC,IAAI,CACnB;oBACC,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE;iBACxD,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;YACH,CAAC;QACF,CAAC;QACD,GAAG,EAAE,KAAK,IAAI,EAAE,CACf,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC;KAChE,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CACjC,OAAwB;IAExB,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;IAC/C,OAAO,KAAK,EAAE,OAAgB,EAAE,EAAE;QACjC,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,KAAK,CACtB,GAAG,MAAM,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAChD,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,EAAiB,CAC5C,CAAC;YACF,OAAO,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE;gBACrC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE;oBACR,cAAc,EAAE,kBAAkB;oBAClC,eAAe,EAAE,qBAAqB;iBACtC;aACD,CAAC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;IACF,CAAC,CAAC;AACH,CAAC"}

package/dist/native.d.ts

@@ -0,0 +1,45 @@
+/**
+ * `@businessdash/sdk/native` — the entry point for React Native / Expo.
+ *
+ * ## Why this exists
+ *
+ * The root export (`.`) re-exports `createAuthHandler` and `getTenantSession`
+ * from `auth-handler.ts`, which calls `Buffer.from(state, "base64url")`.
+ * `Buffer` is a Node global that React Native does not provide, and Metro does
+ * not polyfill it. The call sits inside a function rather than at module
+ * scope, so importing the root *appears* to work — right up until a sign-in
+ * callback is decoded and it throws `ReferenceError: Buffer is not defined` in
+ * production.
+ *
+ * That whole module is server-side by design anyway: an auth handler is a
+ * thing a tenant's SERVER mounts to receive an OAuth callback and set a
+ * cookie. An app has neither. Same for `proxy.ts` (a same-origin proxy route)
+ * and `revalidate-verify.ts` (`node:crypto`).
+ *
+ * So this entry is the data layer with the server-only surface removed. It is
+ * additive — nothing here changes what `.` exports.
+ *
+ * ## What a native app does instead
+ *
+ * - **Auth** — drive the hosted flow directly: `POST auth/start`, open the URL
+ *   in a web-auth session, then `POST auth/exchange` with the `code` and
+ *   `state` from your deep-link callback. `client.auth` has all three.
+ * - **Forms** — `<biab-form>` is a DOM custom element with no native
+ *   counterpart. Read the schema and render it with your own components.
+ * - **Revalidation** — irrelevant. The webhook targets a server that holds a
+ *   cache; an app just re-fetches.
+ *
+ * ## Metro
+ *
+ * Subpath exports (`@businessdash/sdk/native`) need Metro's package-exports
+ * support. Expo SDK 51+ enables it by default; on bare React Native set
+ * `unstable_enablePackageExports = true` in `metro.config.js`. Without it the
+ * import fails to resolve at all, with an error that looks like a missing
+ * dependency.
+ */
+export type { BiabDevClientOptions, FetchLike } from "./client.js";
+export { BiabDevClient, createBiabDevClient, } from "./client.js";
+export { accessRejectionFromBody, BiabAccessRejectedError, BiabApiError, BiabFeatureNotEntitledError, BiabPaymentLapsedError, type BiabPlanGateBody, BiabServiceSuspendedError, isBiabPlanGateBody, type UnwrappedAccess, type UnwrappedEntitlement, } from "./errors.js";
+export type { BiabClient, CreateBiabClientOptions, FormFieldDef, FormRenderSettings, FormSchema, FormSubmissionData, FormSubmitResult, FormValidationIssue, GalleryResource, SchedulingBookingResult, SchedulingEventType, SchedulingResource, SchedulingSlot, } from "./sdk.js";
+export { createBiabClient } from "./sdk.js";
+//# sourceMappingURL=native.d.ts.map

package/dist/native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,YAAY,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACN,aAAa,EACb,mBAAmB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,uBAAuB,EACvB,uBAAuB,EACvB,YAAY,EACZ,2BAA2B,EAC3B,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,GACzB,MAAM,aAAa,CAAC;AACrB,YAAY,EACX,UAAU,EACV,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC"}

package/dist/native.js

@@ -0,0 +1,43 @@
+/**
+ * `@businessdash/sdk/native` — the entry point for React Native / Expo.
+ *
+ * ## Why this exists
+ *
+ * The root export (`.`) re-exports `createAuthHandler` and `getTenantSession`
+ * from `auth-handler.ts`, which calls `Buffer.from(state, "base64url")`.
+ * `Buffer` is a Node global that React Native does not provide, and Metro does
+ * not polyfill it. The call sits inside a function rather than at module
+ * scope, so importing the root *appears* to work — right up until a sign-in
+ * callback is decoded and it throws `ReferenceError: Buffer is not defined` in
+ * production.
+ *
+ * That whole module is server-side by design anyway: an auth handler is a
+ * thing a tenant's SERVER mounts to receive an OAuth callback and set a
+ * cookie. An app has neither. Same for `proxy.ts` (a same-origin proxy route)
+ * and `revalidate-verify.ts` (`node:crypto`).
+ *
+ * So this entry is the data layer with the server-only surface removed. It is
+ * additive — nothing here changes what `.` exports.
+ *
+ * ## What a native app does instead
+ *
+ * - **Auth** — drive the hosted flow directly: `POST auth/start`, open the URL
+ *   in a web-auth session, then `POST auth/exchange` with the `code` and
+ *   `state` from your deep-link callback. `client.auth` has all three.
+ * - **Forms** — `<biab-form>` is a DOM custom element with no native
+ *   counterpart. Read the schema and render it with your own components.
+ * - **Revalidation** — irrelevant. The webhook targets a server that holds a
+ *   cache; an app just re-fetches.
+ *
+ * ## Metro
+ *
+ * Subpath exports (`@businessdash/sdk/native`) need Metro's package-exports
+ * support. Expo SDK 51+ enables it by default; on bare React Native set
+ * `unstable_enablePackageExports = true` in `metro.config.js`. Without it the
+ * import fails to resolve at all, with an error that looks like a missing
+ * dependency.
+ */
+export { BiabDevClient, createBiabDevClient, } from "./client.js";
+export { accessRejectionFromBody, BiabAccessRejectedError, BiabApiError, BiabFeatureNotEntitledError, BiabPaymentLapsedError, BiabServiceSuspendedError, isBiabPlanGateBody, } from "./errors.js";
+export { createBiabClient } from "./sdk.js";
+//# sourceMappingURL=native.js.map

package/dist/native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,EACN,aAAa,EACb,mBAAmB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,uBAAuB,EACvB,uBAAuB,EACvB,YAAY,EACZ,2BAA2B,EAC3B,sBAAsB,EAEtB,yBAAyB,EACzB,kBAAkB,GAGlB,MAAM,aAAa,CAAC;AAgBrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC"}

package/dist/next-revalidate.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Drop-in Next.js route handler for BIAB revalidation webhooks.
+ *
+ * Consumer mounts this with literally one line:
+ *
+ *     // app/api/biab/revalidate/route.ts
+ *     export { POST } from "@businessdash/sdk/next/revalidate";
+ *
+ * That's it. The handler:
+ *
+ *   1. Reads the shared secret from `BIAB_REVALIDATION_SECRET`
+ *      (override via `createRevalidateHandler({ secret })` if env
+ *      isn't available — see below).
+ *   2. Verifies the `X-Biab-Signature: t=<unix>,v1=<hex>` header.
+ *      Constant-time hash compare, ±5 minute replay window.
+ *   3. Calls `revalidateTag(tag, { expire: 0 })` for each tag in
+ *      the payload.
+ *   4. Returns `{ ok: true, revalidated: string[] }`.
+ *
+ * For non-Next consumers, import `verifyAndExtractTags` directly
+ * from `@businessdash/sdk/adapters/revalidate` and call your framework's
+ * invalidation primitive (CDN purge, KV delete, static rebuild
+ * trigger). The verification logic is framework-agnostic and lives
+ * in a separate file so non-Next bundlers don't transitively pick
+ * up `next/cache`.
+ */
+import { type BiabPublishPayload, type VerifyOptions, type VerifyResult, verifyAndExtractTags } from "./revalidate-verify.js";
+export { type BiabPublishPayload, type VerifyOptions, type VerifyResult, verifyAndExtractTags, };
+export interface CreateRevalidateHandlerOptions {
+    /**
+     * Override the secret instead of reading from
+     * `BIAB_REVALIDATION_SECRET`. Useful in tests or when the
+     * consumer manages secrets in a non-standard place.
+     */
+    secret?: string;
+}
+export declare function createRevalidateHandler(opts?: CreateRevalidateHandlerOptions): (request: Request) => Promise<Response>;
+/**
+ * Default `POST` handler the consumer re-exports. Reads the secret
+ * from `BIAB_REVALIDATION_SECRET` env automatically.
+ */
+export declare const POST: (request: Request) => Promise<Response>;
+//# sourceMappingURL=next-revalidate.d.ts.map

package/dist/next-revalidate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-revalidate.d.ts","sourceRoot":"","sources":["../src/next-revalidate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,oBAAoB,EACpB,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,oBAAoB,GACpB,CAAC;AAMF,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAgCD,wBAAgB,uBAAuB,CACtC,IAAI,GAAE,8BAAmC,IAEd,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CA4B/D;AAED;;;GAGG;AACH,eAAO,MAAM,IAAI,YAlCoB,OAAO,KAAG,OAAO,CAAC,QAAQ,CAkClB,CAAC"}

package/dist/next-revalidate.js

@@ -0,0 +1,84 @@
+/**
+ * Drop-in Next.js route handler for BIAB revalidation webhooks.
+ *
+ * Consumer mounts this with literally one line:
+ *
+ *     // app/api/biab/revalidate/route.ts
+ *     export { POST } from "@businessdash/sdk/next/revalidate";
+ *
+ * That's it. The handler:
+ *
+ *   1. Reads the shared secret from `BIAB_REVALIDATION_SECRET`
+ *      (override via `createRevalidateHandler({ secret })` if env
+ *      isn't available — see below).
+ *   2. Verifies the `X-Biab-Signature: t=<unix>,v1=<hex>` header.
+ *      Constant-time hash compare, ±5 minute replay window.
+ *   3. Calls `revalidateTag(tag, { expire: 0 })` for each tag in
+ *      the payload.
+ *   4. Returns `{ ok: true, revalidated: string[] }`.
+ *
+ * For non-Next consumers, import `verifyAndExtractTags` directly
+ * from `@businessdash/sdk/adapters/revalidate` and call your framework's
+ * invalidation primitive (CDN purge, KV delete, static rebuild
+ * trigger). The verification logic is framework-agnostic and lives
+ * in a separate file so non-Next bundlers don't transitively pick
+ * up `next/cache`.
+ */
+import { verifyAndExtractTags, } from "./revalidate-verify.js";
+// Re-export for backwards compatibility — callers that previously
+// imported these from `@businessdash/sdk/next/revalidate` still work.
+export { verifyAndExtractTags, };
+async function callRevalidateTag(tags) {
+    // Lazy-import so the SDK is usable outside Next without dragging
+    // `next/cache` into the bundle. The module name lives in a variable
+    // so TypeScript doesn't try to type-check the missing dep at build
+    // time — the import is purely runtime.
+    const modName = "next/cache";
+    const mod = await import(
+    /* @vite-ignore */ /* webpackIgnore: true */ modName).catch(() => null);
+    if (!mod || typeof mod.revalidateTag !== "function") {
+        return [];
+    }
+    const fn = mod.revalidateTag;
+    const revalidated = [];
+    for (const tag of tags) {
+        try {
+            fn(tag, { expire: 0 });
+            revalidated.push(tag);
+        }
+        catch {
+            /* outside a Next request scope — caller may retry */
+        }
+    }
+    return revalidated;
+}
+export function createRevalidateHandler(opts = {}) {
+    return async function POST(request) {
+        const secret = opts.secret ?? process.env["BIAB_REVALIDATION_SECRET"];
+        if (!secret) {
+            return Response.json({ ok: false, reason: "missing_revalidation_secret_env" }, { status: 500 });
+        }
+        const rawBody = await request.text();
+        const sig = request.headers.get("x-biab-signature");
+        const verified = verifyAndExtractTags({
+            secret,
+            rawBody,
+            signatureHeader: sig,
+        });
+        if (!verified.ok || !verified.payload) {
+            return Response.json({ ok: false, reason: verified.reason ?? "verify_failed" }, { status: 401 });
+        }
+        const revalidated = await callRevalidateTag(verified.payload.tags);
+        return Response.json({
+            ok: true,
+            revalidated,
+            orgId: verified.payload.orgId,
+        });
+    };
+}
+/**
+ * Default `POST` handler the consumer re-exports. Reads the secret
+ * from `BIAB_REVALIDATION_SECRET` env automatically.
+ */
+export const POST = createRevalidateHandler();
+//# sourceMappingURL=next-revalidate.js.map

package/dist/next-revalidate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-revalidate.js","sourceRoot":"","sources":["../src/next-revalidate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAIN,oBAAoB,GACpB,MAAM,wBAAwB,CAAC;AAEhC,kEAAkE;AAClE,sEAAsE;AACtE,OAAO,EAIN,oBAAoB,GACpB,CAAC;AAoBF,KAAK,UAAU,iBAAiB,CAAC,IAAc;IAC9C,iEAAiE;IACjE,oEAAoE;IACpE,mEAAmE;IACnE,uCAAuC;IACvC,MAAM,OAAO,GAAG,YAAY,CAAC;IAC7B,MAAM,GAAG,GAAmD,MAAM,MAAM;IACvE,kBAAkB,CAAC,yBAAyB,CAAC,OAAO,CACpD,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;QACrD,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,aAAa,CAAC;IAC7B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC;YACJ,EAAE,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YACvB,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACR,qDAAqD;QACtD,CAAC;IACF,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACtC,OAAuC,EAAE;IAEzC,OAAO,KAAK,UAAU,IAAI,CAAC,OAAgB;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC,IAAI,CACnB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,EACxD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACrC,MAAM;YACN,OAAO;YACP,eAAe,EAAE,GAAG;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACvC,OAAO,QAAQ,CAAC,IAAI,CACnB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,eAAe,EAAE,EACzD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC,IAAI,CAAC;YACpB,EAAE,EAAE,IAAI;YACR,WAAW;YACX,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK;SAC7B,CAAC,CAAC;IACJ,CAAC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE,CAAC"}

package/dist/parallel-pages.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Code-first declaration of a programmatic-SEO ("parallel") page.
+ * The consumer writes:
+ *
+ *   import { defineParallelPage } from "@businessdash/sdk";
+ *
+ *   const repairAreaPage = defineParallelPage({
+ *     key: "repair-area",
+ *     routePattern: "/repair/[service]/[area]",
+ *     variables: {
+ *       service: {
+ *         source: { section: "repairTypesCatalog" },
+ *         slugField: "type",
+ *         tokenFields: ["type", "description"],
+ *       },
+ *       area: {
+ *         source: { section: "serviceAreas", path: "areas" },
+ *         slugField: "slug",
+ *         tokenFields: ["name", "state", "slug"],
+ *       },
+ *     },
+ *     meta: {
+ *       title: "{service.type} in {area.name} | {company.shortName}",
+ *       description:
+ *         "Professional {service.type} in {area.name}, {area.state}. Call {company.phone}.",
+ *     },
+ *     templateRef: "repairAreaTemplate",
+ *   });
+ *
+ * `defineParallelPage` is a pure builder — no DB writes, no HTTP. It
+ * returns a frozen, type-checked artifact. Push to the BIAB server
+ * later via `biab-dev sync-parallel-pages` (or the SDK's
+ * `client.parallelPages.upsertDefinition()` when wired).
+ */
+export type ParallelPageVariableInput = {
+    source: {
+        section: string;
+        path?: string;
+    };
+    slugField: string;
+    tokenFields?: ReadonlyArray<string>;
+};
+export type ParallelPageMetaInput = {
+    title: string;
+    description: string;
+    canonical?: string;
+    ogImage?: string;
+};
+export type ParallelPageInput<V extends Record<string, ParallelPageVariableInput>> = {
+    key: string;
+    routePattern: string;
+    variables: V;
+    meta: ParallelPageMetaInput;
+    /**
+     * For SDK-defined pages, a schema section key naming the body
+     * template. The dashboard renders the matching section's content
+     * for the parallel-page body. Site-builder pages use a different
+     * pointer scheme (`cms:<contentId>`) — set transparently by the
+     * dashboard.
+     */
+    templateRef: string;
+    /**
+     * Per-page robots directive. Defaults to `inherit` (defer to the
+     * site-wide robots config). Set `noindex` for variants that
+     * shouldn't appear in search (e.g. dynamic catch-alls used as
+     * fallbacks).
+     */
+    crawlRule?: "inherit" | "index" | "noindex";
+};
+export type ParallelPageDefinition<V extends Record<string, ParallelPageVariableInput>> = {
+    readonly $kind: "biab.parallelPage";
+    readonly key: string;
+    readonly routePattern: string;
+    readonly variables: ReadonlyArray<{
+        readonly name: keyof V & string;
+        readonly source: {
+            readonly section: string;
+            readonly path?: string;
+        };
+        readonly slugField: string;
+        readonly tokenFields: ReadonlyArray<string>;
+    }>;
+    readonly meta: Readonly<ParallelPageMetaInput>;
+    readonly templateRef: string;
+    readonly crawlRule: "inherit" | "index" | "noindex";
+};
+/**
+ * Validate + freeze a parallel-page declaration. Throws on:
+ *   - Empty / malformed `routePattern`
+ *   - `[variable]` segments in the pattern that aren't in `variables`
+ *   - `variables` keys that don't appear in the pattern
+ *   - Duplicate variable names
+ *   - Missing `slugField` on any binding
+ */
+export declare function defineParallelPage<V extends Record<string, ParallelPageVariableInput>>(input: ParallelPageInput<V>): ParallelPageDefinition<V>;
+/**
+ * Type guard for the artifact `defineParallelPage` returns. Useful
+ * when consumers export a mixed array of marketing + parallel-page
+ * declarations from one `biab.config.ts`.
+ */
+export declare function isParallelPageDefinition(value: unknown): value is ParallelPageDefinition<Record<string, ParallelPageVariableInput>>;
+//# sourceMappingURL=parallel-pages.d.ts.map

package/dist/parallel-pages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parallel-pages.d.ts","sourceRoot":"","sources":["../src/parallel-pages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,MAAM,MAAM,yBAAyB,GAAG;IACvC,MAAM,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAC5B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,IAChD;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,CAAC,CAAC;IACb,IAAI,EAAE,qBAAqB,CAAC;IAC5B;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,sBAAsB,CACjC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,IAChD;IACH,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;QACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;QAChC,QAAQ,CAAC,MAAM,EAAE;YAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;KAC5C,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAC/C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;CACpD,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CACjC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,EAClD,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAwExD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACvC,KAAK,EAAE,OAAO,GACZ,KAAK,IAAI,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAM5E"}

package/dist/parallel-pages.js

@@ -0,0 +1,108 @@
+/**
+ * Code-first declaration of a programmatic-SEO ("parallel") page.
+ * The consumer writes:
+ *
+ *   import { defineParallelPage } from "@businessdash/sdk";
+ *
+ *   const repairAreaPage = defineParallelPage({
+ *     key: "repair-area",
+ *     routePattern: "/repair/[service]/[area]",
+ *     variables: {
+ *       service: {
+ *         source: { section: "repairTypesCatalog" },
+ *         slugField: "type",
+ *         tokenFields: ["type", "description"],
+ *       },
+ *       area: {
+ *         source: { section: "serviceAreas", path: "areas" },
+ *         slugField: "slug",
+ *         tokenFields: ["name", "state", "slug"],
+ *       },
+ *     },
+ *     meta: {
+ *       title: "{service.type} in {area.name} | {company.shortName}",
+ *       description:
+ *         "Professional {service.type} in {area.name}, {area.state}. Call {company.phone}.",
+ *     },
+ *     templateRef: "repairAreaTemplate",
+ *   });
+ *
+ * `defineParallelPage` is a pure builder — no DB writes, no HTTP. It
+ * returns a frozen, type-checked artifact. Push to the BIAB server
+ * later via `biab-dev sync-parallel-pages` (or the SDK's
+ * `client.parallelPages.upsertDefinition()` when wired).
+ */
+import { parseParallelPagePattern } from "./url-pattern.js";
+/**
+ * Validate + freeze a parallel-page declaration. Throws on:
+ *   - Empty / malformed `routePattern`
+ *   - `[variable]` segments in the pattern that aren't in `variables`
+ *   - `variables` keys that don't appear in the pattern
+ *   - Duplicate variable names
+ *   - Missing `slugField` on any binding
+ */
+export function defineParallelPage(input) {
+    if (!input.key || typeof input.key !== "string") {
+        throw new Error("defineParallelPage: `key` is required.");
+    }
+    if (!/^[a-z][a-z0-9-]*$/.test(input.key)) {
+        throw new Error(`defineParallelPage: \`key\` must be kebab-case (got "${input.key}").`);
+    }
+    const parsed = parseParallelPagePattern(input.routePattern);
+    const inputNames = new Set(Object.keys(input.variables));
+    const patternNames = new Set(parsed.variableNames);
+    for (const patternName of patternNames) {
+        if (!inputNames.has(patternName)) {
+            throw new Error(`defineParallelPage("${input.key}"): pattern uses "[${patternName}]" ` +
+                `but \`variables\` has no binding for "${patternName}".`);
+        }
+    }
+    for (const inputName of inputNames) {
+        if (!patternNames.has(inputName)) {
+            throw new Error(`defineParallelPage("${input.key}"): \`variables\` declares "${inputName}" ` +
+                `but the pattern "${input.routePattern}" has no "[${inputName}]" segment.`);
+        }
+    }
+    const variables = parsed.variableNames.map((name) => {
+        const raw = input.variables[name];
+        if (!raw.source?.section) {
+            throw new Error(`defineParallelPage("${input.key}"): variable "${name}" is missing \`source.section\`.`);
+        }
+        if (!raw.slugField) {
+            throw new Error(`defineParallelPage("${input.key}"): variable "${name}" is missing \`slugField\`.`);
+        }
+        const tokenFields = raw.tokenFields ?? [raw.slugField];
+        return Object.freeze({
+            name: name,
+            source: Object.freeze({
+                section: raw.source.section,
+                ...(raw.source.path !== undefined ? { path: raw.source.path } : {}),
+            }),
+            slugField: raw.slugField,
+            tokenFields: Object.freeze([...tokenFields]),
+        });
+    });
+    if (!input.meta?.title || !input.meta?.description) {
+        throw new Error(`defineParallelPage("${input.key}"): \`meta.title\` and \`meta.description\` are required.`);
+    }
+    return Object.freeze({
+        $kind: "biab.parallelPage",
+        key: input.key,
+        routePattern: input.routePattern,
+        variables: Object.freeze(variables),
+        meta: Object.freeze({ ...input.meta }),
+        templateRef: input.templateRef,
+        crawlRule: input.crawlRule ?? "inherit",
+    });
+}
+/**
+ * Type guard for the artifact `defineParallelPage` returns. Useful
+ * when consumers export a mixed array of marketing + parallel-page
+ * declarations from one `biab.config.ts`.
+ */
+export function isParallelPageDefinition(value) {
+    return (!!value &&
+        typeof value === "object" &&
+        value.$kind === "biab.parallelPage");
+}
+//# sourceMappingURL=parallel-pages.js.map

package/dist/parallel-pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parallel-pages.js","sourceRoot":"","sources":["../src/parallel-pages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AA2D5D;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAEhC,KAA2B;IAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACd,wDAAwD,KAAK,CAAC,GAAG,KAAK,CACtE,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAEnD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACd,uBAAuB,KAAK,CAAC,GAAG,sBAAsB,WAAW,KAAK;gBACrE,yCAAyC,WAAW,IAAI,CACzD,CAAC;QACH,CAAC;IACF,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACd,uBAAuB,KAAK,CAAC,GAAG,+BAA+B,SAAS,IAAI;gBAC3E,oBAAoB,KAAK,CAAC,YAAY,cAAc,SAAS,aAAa,CAC3E,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,SAAS,GACd,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACd,uBAAuB,KAAK,CAAC,GAAG,iBAAiB,IAAI,kCAAkC,CACvF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACd,uBAAuB,KAAK,CAAC,GAAG,iBAAiB,IAAI,6BAA6B,CAClF,CAAC;QACH,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,IAAwB;YAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;gBACrB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO;gBAC3B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE,CAAC;YACF,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;SAC5C,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEJ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACd,uBAAuB,KAAK,CAAC,GAAG,2DAA2D,CAC3F,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,KAAK,EAAE,mBAAmB;QAC1B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACnC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS;KACvC,CAA8B,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACvC,KAAc;IAEd,OAAO,CACN,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,KAAK,QAAQ;QACxB,KAA6B,CAAC,KAAK,KAAK,mBAAmB,CAC5D,CAAC;AACH,CAAC"}