@businessdash/sdk 0.9.80 → 0.9.90

package/src/reserved-paths.ts

@@ -1,6 +1,6 @@
 /**
- * Page paths reserved by the BIAB platform. These routes are served by
- * BIAB on every verified org hostname (`pay.acme.com/quotes/accept/<token>`,
+ * Page paths reserved by the BD platform. These routes are served by
+ * BD on every verified org hostname (`pay.acme.com/quotes/accept/<token>`,
  * `acme.com/contracts/sign/<token>`, etc.), so a marketing page declared at
  * one of these paths would collide and silently break customer-facing
  * accept / sign / pay flows.
@@ -56,7 +56,7 @@ export function isReservedPagePath(input: string): boolean {
  */
 export function reservedPagePathErrorMessage(input: string): string {
 	return [
-		`"${input}" is reserved by the BIAB platform.`,
+		`"${input}" is reserved by the BD platform.`,
 		`Reserved paths: ${RESERVED_PAGE_PATHS.join(", ")}.`,
 		`These routes are served on every verified org hostname for quote / contract / invoice flows;`,
 		`shipping a marketing page at the same path would break customer-facing accept / sign / pay links.`,

package/src/revalidate-verify.ts

@@ -1,5 +1,5 @@
 /**
- * Framework-agnostic HMAC verification for BIAB revalidation
+ * Framework-agnostic HMAC verification for BD revalidation
  * webhooks. Lives in its own file so adapters (Cloudflare, KV
  * purge, static rebuild trigger, …) can pull it in without
  * transitively bringing the Next-only `next-revalidate.ts` into
@@ -14,7 +14,7 @@ import { createHmac, timingSafeEqual } from "node:crypto";
 
 const REPLAY_WINDOW_SECONDS = 5 * 60;
 
-export interface BiabPublishPayload {
+export interface BdPublishPayload {
 	event: "content.published";
 	orgId: string;
 	tags: string[];
@@ -30,7 +30,7 @@ export interface VerifyOptions {
 
 export interface VerifyResult {
 	ok: boolean;
-	payload?: BiabPublishPayload;
+	payload?: BdPublishPayload;
 	reason?: string;
 }
 
@@ -81,9 +81,9 @@ export function verifyAndExtractTags(opts: VerifyOptions): VerifyResult {
 		return { ok: false, reason: "signature_mismatch" };
 	}
 
-	let payload: BiabPublishPayload;
+	let payload: BdPublishPayload;
 	try {
-		payload = JSON.parse(opts.rawBody) as BiabPublishPayload;
+		payload = JSON.parse(opts.rawBody) as BdPublishPayload;
 	} catch {
 		return { ok: false, reason: "body_not_json" };
 	}

package/src/sdk.ts

@@ -5,42 +5,44 @@
  * and that's it. Auth, caching, revalidation, tagging, retries — all
  * handled inside this module so the consumer code reads as:
  *
- *   const items = await biab.gallery.list({
+ *   const items = await bd.gallery.list({
  *     limit: 12,
  *     fields: ["src", "title", "category", "blurDataURL"],
  *   });
  *
  * Auto-applied per request:
  *   • `Authorization: Bearer <apiKey>`
- *   • `next: { tags: ["biab:<resource>", "biab:site:<orgId-when-known>"],
+ *   • `next: { tags: ["bd:<resource>", "bd:site:<orgId-when-known>"],
  *              revalidate: <longBackstop> }`  — invisible on non-Next
  *     runtimes that ignore the `next` key
  *   • Field selection forwarded as `?fields=…` so the platform
  *     SELECTs only what's needed.
  *
  * The companion `@businessdash/sdk/next/revalidate` route export closes
- * the loop: when BIAB POSTs `content.published`, the route handler
+ * the loop: when BD POSTs `content.published`, the route handler
  * verifies the HMAC and calls `revalidateTag(...)` to bust the local
  * Next cache. End-to-end, the consumer wrote ~5 lines.
  */
 
 import {
-	BiabDevAddressClient,
-	BiabDevBlogClient,
-	BiabDevCartClient,
-	BiabDevCheckoutClient,
-	BiabDevClient,
-	BiabDevCouponsClient,
-	BiabDevCustomerPortalClient,
-	BiabDevFollowersClient,
-	BiabDevMarketingClient,
-	BiabDevMarketingPagesClient,
-	BiabDevNotificationsClient,
-	BiabDevParallelPagesClient,
-	BiabDevReviewsClient,
-	BiabDevShippingClient,
-	BiabDevStorefrontClient,
-	BiabDevSubscriptionsClient,
+	BdAddressClient,
+	BdApiClient,
+	BdBlogClient,
+	BdCartClient,
+	BdCheckoutClient,
+	BdCouponsClient,
+	BdCustomerPortalClient,
+	BdFollowersClient,
+	BdLegalClient,
+	BdMarketingClient,
+	BdMarketingPagesClient,
+	BdNotificationsClient,
+	BdParallelPagesClient,
+	BdReviewsClient,
+	BdShippingClient,
+	type BdSiteClient,
+	BdStorefrontClient,
+	BdSubscriptionsClient,
 } from "./client.js";
 import {
 	getEmailDomain,
@@ -54,7 +56,7 @@ import type { BundleGalleryItem } from "./gallery-types.js";
 const DEFAULT_BASE_URL = "https://biab.app/api/package/v1";
 const DEFAULT_REVALIDATE_SECONDS = 60 * 60 * 24; // 24h backstop
 
-export interface CreateBiabClientOptions {
+export interface CreateBdClientOptions {
 	apiKey: string;
 	siteId: string;
 	baseUrl?: string;
@@ -111,7 +113,7 @@ async function jsonGet<T>(
 	if (!res.ok) {
 		const text = await res.text().catch(() => "");
 		throw new Error(
-			`BIAB SDK ${res.status} ${res.statusText} on ${pathWithQuery}: ${text.slice(0, 200)}`,
+			`BD SDK ${res.status} ${res.statusText} on ${pathWithQuery}: ${text.slice(0, 200)}`,
 		);
 	}
 	return (await res.json()) as T;
@@ -150,7 +152,7 @@ function createGalleryResource(state: InternalState): GalleryResource {
 			}
 			const qs = query.toString();
 			const path = `sites/${encodeURIComponent(state.siteId)}/gallery${qs ? `?${qs}` : ""}`;
-			const tags = ["biab:gallery", `biab:site:${state.siteId}`];
+			const tags = ["bd:gallery", `bd:site:${state.siteId}`];
 			// The server projects to exactly the requested `fields`, so the row
 			// shape is `GalleryItemFor<F>` — a fact only the wire can vouch for.
 			// Stating it as the fetch's type argument confines the assumption to
@@ -327,14 +329,14 @@ function createSchedulingResource(state: InternalState): SchedulingResource {
 		if (!res.ok) {
 			const text = await res.text().catch(() => "");
 			throw new Error(
-				`BIAB SDK ${res.status} ${res.statusText} on ${path}: ${text.slice(0, 200)}`,
+				`BD SDK ${res.status} ${res.statusText} on ${path}: ${text.slice(0, 200)}`,
 			);
 		}
 		return (await res.json()) as T;
 	}
 	return {
 		async listEventTypes() {
-			const tags = ["biab:scheduling", `biab:site:${state.siteId}`];
+			const tags = ["bd:scheduling", `bd:site:${state.siteId}`];
 			const result = await jsonGet<{ items: SchedulingEventType[] }>(
 				state,
 				`${sitePath}/event-types`,
@@ -344,9 +346,9 @@ function createSchedulingResource(state: InternalState): SchedulingResource {
 		},
 		async getEventType(slug) {
 			const tags = [
-				"biab:scheduling",
-				`biab:scheduling:event:${slug}`,
-				`biab:site:${state.siteId}`,
+				"bd:scheduling",
+				`bd:scheduling:event:${slug}`,
+				`bd:site:${state.siteId}`,
 			];
 			return await jsonGet(
 				state,
@@ -373,7 +375,7 @@ function createSchedulingResource(state: InternalState): SchedulingResource {
 			if (!res.ok) {
 				const text = await res.text().catch(() => "");
 				throw new Error(
-					`BIAB SDK ${res.status} ${res.statusText} on ${path}: ${text.slice(0, 200)}`,
+					`BD SDK ${res.status} ${res.statusText} on ${path}: ${text.slice(0, 200)}`,
 				);
 			}
 			const data = (await res.json()) as { slots: SchedulingSlot[] };
@@ -405,7 +407,7 @@ function createSchedulingResource(state: InternalState): SchedulingResource {
 			if (!res.ok) {
 				const text = await res.text().catch(() => "");
 				throw new Error(
-					`BIAB SDK ${res.status} ${res.statusText}: ${text.slice(0, 200)}`,
+					`BD SDK ${res.status} ${res.statusText}: ${text.slice(0, 200)}`,
 				);
 			}
 			return (await res.json()) as SchedulingBookingView;
@@ -439,7 +441,7 @@ function createSchedulingResource(state: InternalState): SchedulingResource {
 // ---------------------------------------------------------------------------
 
 /**
- * Public-facing description of one form field. Mirrors BIAB's
+ * Public-facing description of one form field. Mirrors BD's
  * `FormField` type so the consumer can type their submission payload
  * against the schema fetched at runtime.
  */
@@ -608,7 +610,7 @@ export interface FormFieldDef {
 		sensitive?: boolean;
 	};
 	/**
-	 * `credit_card` element — collect a card via Stripe Elements (`<BiabForm/>`
+	 * `credit_card` element — collect a card via Stripe Elements (`<BdForm/>`
 	 * only). `card_on_file` saves the card (SetupIntent); `deposit` charges
 	 * `amountCents` now (PaymentIntent). The card is created on the org's Stripe
 	 * connected account via `forms.paymentIntent(slug, fieldId)`; the submission
@@ -624,7 +626,7 @@ export interface FormFieldDef {
 	/**
 	 * `schedule` element (availability v1). The visitor states when they're free;
 	 * the submitted value is `{ asap?, days?: string[], times?: string[], notes? }`.
-	 * `<BiabForm/>` renders day + time-window chips, an ASAP toggle, and notes.
+	 * `<BdForm/>` renders day + time-window chips, an ASAP toggle, and notes.
 	 * Added in 0.9.9.
 	 */
 	scheduleConfig?: {
@@ -657,7 +659,7 @@ export interface FormRenderSettings {
 	showProgress?: boolean;
 	progressStyle?: "bar" | "steps";
 	/**
-	 * Warn before the visitor abandons a dirty, unsubmitted form. `<BiabForm/>`
+	 * Warn before the visitor abandons a dirty, unsubmitted form. `<BdForm/>`
 	 * attaches a `beforeunload` guard when `enabled` (the browser shows a generic
 	 * prompt); `message` is provided so you can show it in your own modal too.
 	 */
@@ -696,7 +698,7 @@ export interface FormActionPreview {
 	} | null;
 	/**
 	 * `grant_coupon` only: the display-safe coupon notice to show before submit
-	 * (e.g. "{code} will be applied to this inquiry"). `<BiabForm/>` renders it
+	 * (e.g. "{code} will be applied to this inquiry"). `<BdForm/>` renders it
 	 * above the submit button. The coupon id / field mapping never leave the
 	 * server. Added in 0.9.9.
 	 */
@@ -771,18 +773,18 @@ export interface FormValidationResult {
  * Runtime validate a submission against the fetched form schema.
  * Returns `ok: true` only when every required field is present and
  * every supplied value passes its type / min / max / regex /
- * options check. Designed to mirror what BIAB's server enforces so
+ * options check. Designed to mirror what BD's server enforces so
  * the consumer can show inline errors before round-tripping.
  *
- * For build-time type safety, the future `biab-dev codegen forms`
+ * For build-time type safety, the future `bd codegen forms`
  * CLI emits a `.d.ts` per form so TypeScript can also enforce
  * shape at compile time. Until that ships, this runtime check is
  * the safety net.
  */
 
 /**
- * Narrow check for the shape `biab.forms.uploadFile` returns —
- * mirrors what the BIAB hiring mirror reads (storageId, url, name,
+ * Narrow check for the shape `bd.forms.uploadFile` returns —
+ * mirrors what the BD hiring mirror reads (storageId, url, name,
  * mimeType, size). Used by both `validateFormSubmission` and any
  * caller that wants to assert "this value is a successful upload."
  */
@@ -1059,7 +1061,7 @@ export function validateFormSubmission(
 						fieldId: field.id,
 						label: field.label,
 						reason: "type",
-						message: `${field.label} must be uploaded via biab.forms.uploadFile().`,
+						message: `${field.label} must be uploaded via bd.forms.uploadFile().`,
 					});
 				}
 				if (
@@ -1162,14 +1164,14 @@ export function validateFormSubmission(
  * - `forbidden` — the key lacks the scope/permission, or the request origin
  *   isn't on the key's allowed-host list (403).
  * - `plan_required` — the org's plan doesn't include forms (entitlement gate).
- * - `payment_required` — the org's BIAB billing is past due.
- * - `service_suspended` — the org's BIAB billing has lapsed 60+ days.
+ * - `payment_required` — the org's BD billing is past due.
+ * - `service_suspended` — the org's BD billing has lapsed 60+ days.
  * - `rate_limited` — too many submissions too fast (429).
  * - `not_found` — the form doesn't exist, is inactive, or isn't accepting
  *   external submissions (404).
  * - `invalid_request` — the request body was malformed (400).
- * - `server_error` — BIAB failed to process the submission (5xx).
- * - `network_error` — the request never reached BIAB (offline, DNS, CORS, …).
+ * - `server_error` — BD failed to process the submission (5xx).
+ * - `network_error` — the request never reached BD (offline, DNS, CORS, …).
  */
 export type FormSubmitFailureReason =
 	| "client_validation_failed"
@@ -1200,12 +1202,12 @@ export type FormSubmitResult =
 			slug?: string;
 			/** True when this was a `dryRun` — validated but not stored. */
 			dryRun?: boolean;
-			/** Any additional fields BIAB returned (forward-compat). */
+			/** Any additional fields BD returned (forward-compat). */
 			[key: string]: unknown;
 	  }
 	| {
 			ok: false;
-			/** HTTP status, or 0 when the request never reached BIAB. */
+			/** HTTP status, or 0 when the request never reached BD. */
 			status: number;
 			reason: FormSubmitFailureReason;
 			/** Human-readable summary, safe to surface to the consumer. */
@@ -1216,14 +1218,14 @@ export type FormSubmitResult =
 
 export interface FormsResource {
 	/**
-	 * Fetch the form's field definitions. Cached via `biab:forms`
-	 * + `biab:forms:<slug>` tags so admin edits invalidate via the
+	 * Fetch the form's field definitions. Cached via `bd:forms`
+	 * + `bd:forms:<slug>` tags so admin edits invalidate via the
 	 * webhook layer.
 	 */
 	schema(slug: string): Promise<FormSchema>;
 	/**
 	 * Submit a form. Validates against the schema client-side (via
-	 * `validateFormSubmission`) before round-tripping, then posts to BIAB.
+	 * `validateFormSubmission`) before round-tripping, then posts to BD.
 	 *
 	 * Always resolves to a {@link FormSubmitResult} — it does NOT throw for an
 	 * expected failure. Check `result.ok`; on failure, `result.reason` says what
@@ -1253,10 +1255,10 @@ export interface FormsResource {
 	/**
 	 * Upload a single file for a file-type field on the form.
 	 *
-	 *   1. Calls the BIAB upload-url endpoint to get a presigned PUT
+	 *   1. Calls the BD upload-url endpoint to get a presigned PUT
 	 *      URL + storageId (the server validates the form, field,
 	 *      MIME type, and size cap against the org's plan).
-	 *   2. PUTs the file bytes directly to R2 — BIAB never sees the
+	 *   2. PUTs the file bytes directly to R2 — BD never sees the
 	 *      bytes, only the metadata.
 	 *   3. Returns a `FormFileValue` to drop into the form's `data`
 	 *      payload when calling `submit`.
@@ -1271,17 +1273,17 @@ export interface FormsResource {
 		opts?: { filename?: string },
 	): Promise<FormFileValue>;
 	/**
-	 * Mint a Stripe intent for a `credit_card` field so `<BiabForm/>` can mount
+	 * Mint a Stripe intent for a `credit_card` field so `<BdForm/>` can mount
 	 * Stripe Elements. `card_on_file` → a SetupIntent; `deposit` → a PaymentIntent
 	 * for the configured amount. The intent is created on the org's connected
 	 * account; initialize Stripe with `{ stripeAccount: connectedAccountId }` and
 	 * the returned `publishableKey`, then confirm with `clientSecret`. The card
-	 * never touches BIAB — only the opaque intent id flows back in the submission.
+	 * never touches BD — only the opaque intent id flows back in the submission.
 	 */
 	paymentIntent(slug: string, fieldId: string): Promise<FormPaymentIntent>;
 	/**
 	 * Open booking slots for an auto-mode `schedule` field — the form's assigned
-	 * staff's combined real availability over [from, to]. `<BiabForm/>` renders
+	 * staff's combined real availability over [from, to]. `<BdForm/>` renders
 	 * the instant-booking picker from these; the visitor picks one and the
 	 * meeting books on submit. Returns absolute UTC instants (`startAt`); host
 	 * identities stay server-side. Empty when the org lacks the scheduling
@@ -1373,7 +1375,7 @@ function mapSubmitResponse(
 function mapSubmitThrow(err: unknown): FormSubmitResult {
 	if (err instanceof Error) {
 		// `jsonGet` embeds the HTTP status in its message — recover it if present.
-		const m = err.message.match(/BIAB SDK (\d{3})/);
+		const m = err.message.match(/BD SDK (\d{3})/);
 		if (m) return mapSubmitResponse(Number(m[1]), null);
 		return {
 			ok: false,
@@ -1396,11 +1398,7 @@ function createFormsResource(state: InternalState): FormsResource {
 			// Non-chatbot form read: a form is reachable here when it is **Live**
 			// (`isActive`) — independent of `chatbotAccess`. Embedding a form on
 			// your own page no longer requires opting it into the AI chatbot.
-			const tags = [
-				"biab:forms",
-				`biab:forms:${slug}`,
-				`biab:site:${state.siteId}`,
-			];
+			const tags = ["bd:forms", `bd:forms:${slug}`, `bd:site:${state.siteId}`];
 			const path = `forms/${encodeURIComponent(slug)}`;
 			const result = await jsonGet<{
 				id: string;
@@ -1469,8 +1467,8 @@ function createFormsResource(state: InternalState): FormsResource {
 					reason: "network_error",
 					message:
 						err instanceof Error
-							? `Could not reach BIAB: ${err.message}`
-							: "Could not reach BIAB.",
+							? `Could not reach BD: ${err.message}`
+							: "Could not reach BD.",
 				};
 			}
 
@@ -1516,11 +1514,11 @@ function createFormsResource(state: InternalState): FormsResource {
 				const text = await presignRes.text().catch(() => "");
 				if (presignRes.status === 403 || presignRes.status === 402) {
 					throw new Error(
-						`BIAB SDK: file upload requires the "forms.file_uploads" entitlement on this org. ${text.slice(0, 200)}`,
+						`BD SDK: file upload requires the "forms.file_uploads" entitlement on this org. ${text.slice(0, 200)}`,
 					);
 				}
 				throw new Error(
-					`BIAB SDK ${presignRes.status} ${presignRes.statusText} on upload-url: ${text.slice(0, 200)}`,
+					`BD SDK ${presignRes.status} ${presignRes.statusText} on upload-url: ${text.slice(0, 200)}`,
 				);
 			}
 			const presign = (await presignRes.json()) as {
@@ -1539,7 +1537,7 @@ function createFormsResource(state: InternalState): FormsResource {
 			if (!putRes.ok) {
 				const text = await putRes.text().catch(() => "");
 				throw new Error(
-					`BIAB SDK upload to R2 failed: ${putRes.status} ${putRes.statusText}: ${text.slice(0, 200)}`,
+					`BD SDK upload to R2 failed: ${putRes.status} ${putRes.statusText}: ${text.slice(0, 200)}`,
 				);
 			}
 
@@ -1566,7 +1564,7 @@ function createFormsResource(state: InternalState): FormsResource {
 			if (!res.ok) {
 				const text = await res.text().catch(() => "");
 				throw new Error(
-					`BIAB SDK ${res.status} ${res.statusText} on payment-intent: ${text.slice(0, 200)}`,
+					`BD SDK ${res.status} ${res.statusText} on payment-intent: ${text.slice(0, 200)}`,
 				);
 			}
 			return (await res.json()) as FormPaymentIntent;
@@ -1586,7 +1584,7 @@ function createFormsResource(state: InternalState): FormsResource {
 			if (!res.ok) {
 				const text = await res.text().catch(() => "");
 				throw new Error(
-					`BIAB SDK ${res.status} ${res.statusText} on schedule-slots: ${text.slice(0, 200)}`,
+					`BD SDK ${res.status} ${res.statusText} on schedule-slots: ${text.slice(0, 200)}`,
 				);
 			}
 			return (await res.json()) as { slots: Array<{ startAt: string }> };
@@ -1598,7 +1596,7 @@ function createFormsResource(state: InternalState): FormsResource {
 // Top-level client
 // ---------------------------------------------------------------------------
 
-export interface BiabClient {
+export interface BdClient {
 	gallery: GalleryResource;
 	scheduling: SchedulingResource;
 	forms: FormsResource;
@@ -1607,29 +1605,39 @@ export interface BiabClient {
 	// long-form transport for its surface; the consumer pattern is
 	// `client.<resource>.<method>(...)`. Field selection / typed
 	// narrowing lands here surface-by-surface (gallery shipped first).
-	blog: BiabDevBlogClient;
-	reviews: BiabDevReviewsClient;
-	storefront: BiabDevStorefrontClient;
-	cart: BiabDevCartClient;
-	checkout: BiabDevCheckoutClient;
-	coupons: BiabDevCouponsClient;
-	subscriptions: BiabDevSubscriptionsClient;
-	shipping: BiabDevShippingClient;
-	address: BiabDevAddressClient;
-	customerPortal: BiabDevCustomerPortalClient;
-	notifications: BiabDevNotificationsClient;
-	followers: BiabDevFollowersClient;
-	marketing: BiabDevMarketingClient;
-	marketingPages: BiabDevMarketingPagesClient;
-	parallelPages: BiabDevParallelPagesClient;
+	blog: BdBlogClient;
+	reviews: BdReviewsClient;
+	storefront: BdStorefrontClient;
+	cart: BdCartClient;
+	checkout: BdCheckoutClient;
+	coupons: BdCouponsClient;
+	subscriptions: BdSubscriptionsClient;
+	shipping: BdShippingClient;
+	address: BdAddressClient;
+	customerPortal: BdCustomerPortalClient;
+	notifications: BdNotificationsClient;
+	followers: BdFollowersClient;
+	// The org's published legal pages — what `@businessdash/sdk/legal`'s
+	// resolver expects a client to carry, so the starters' catch-all
+	// route works on THIS facade, not only on the raw BdApiClient.
+	legal: BdLegalClient;
+	// Site-scoped surfaces (collections, rows, data model, analytics,
+	// scheduling, …). A METHOD mirroring `BdApiClient.site(siteId)` —
+	// `@businessdash/sdk/sitemap`'s collector calls
+	// `client.site(siteId).sitemapEntries()`, so the starters' sitemap
+	// route needs the same shape on this facade.
+	site(siteId: string): BdSiteClient;
+	marketing: BdMarketingClient;
+	marketingPages: BdMarketingPagesClient;
+	parallelPages: BdParallelPagesClient;
 }
 
-export function createBiabClient(opts: CreateBiabClientOptions): BiabClient {
+export function createBdClient(opts: CreateBdClientOptions): BdClient {
 	if (!opts.apiKey) {
-		throw new Error("createBiabClient: apiKey is required.");
+		throw new Error("createBdClient: apiKey is required.");
 	}
 	if (!opts.siteId) {
-		throw new Error("createBiabClient: siteId is required.");
+		throw new Error("createBdClient: siteId is required.");
 	}
 	const state: InternalState = {
 		apiKey: opts.apiKey,
@@ -1639,7 +1647,7 @@ export function createBiabClient(opts: CreateBiabClientOptions): BiabClient {
 		fetch: opts.fetch ?? globalThis.fetch.bind(globalThis),
 		siteOrigin: opts.siteOrigin,
 	};
-	const transport = new BiabDevClient({
+	const transport = new BdApiClient({
 		baseUrl: state.baseUrl,
 		apiKey: state.apiKey,
 		...(opts.fetch ? { fetch: opts.fetch } : {}),
@@ -1649,23 +1657,45 @@ export function createBiabClient(opts: CreateBiabClientOptions): BiabClient {
 		gallery: createGalleryResource(state),
 		scheduling: createSchedulingResource(state),
 		forms: createFormsResource(state),
-		blog: new BiabDevBlogClient(transport),
-		reviews: new BiabDevReviewsClient(transport),
-		storefront: new BiabDevStorefrontClient(transport),
-		cart: new BiabDevCartClient(transport, state.siteId),
-		checkout: new BiabDevCheckoutClient(transport, state.siteId),
-		coupons: new BiabDevCouponsClient(transport),
-		subscriptions: new BiabDevSubscriptionsClient(transport),
-		shipping: new BiabDevShippingClient(transport, state.siteId),
-		address: new BiabDevAddressClient(transport),
+		blog: new BdBlogClient(transport),
+		reviews: new BdReviewsClient(transport),
+		storefront: new BdStorefrontClient(transport),
+		cart: new BdCartClient(transport, state.siteId),
+		checkout: new BdCheckoutClient(transport, state.siteId),
+		coupons: new BdCouponsClient(transport),
+		subscriptions: new BdSubscriptionsClient(transport),
+		shipping: new BdShippingClient(transport, state.siteId),
+		address: new BdAddressClient(transport),
 		// CustomerPortal needs an org id binding; when the consumer's API
 		// key already binds an org, pass `null` here (server resolves via
 		// the key). For multi-tenant proxies, override after construction.
-		customerPortal: new BiabDevCustomerPortalClient(transport, null),
-		notifications: new BiabDevNotificationsClient(transport, state.siteId),
-		followers: new BiabDevFollowersClient(transport, state.siteId),
-		marketing: new BiabDevMarketingClient(transport, state.siteId),
-		marketingPages: new BiabDevMarketingPagesClient(transport, state.siteId),
-		parallelPages: new BiabDevParallelPagesClient(transport, state.siteId),
+		customerPortal: new BdCustomerPortalClient(transport, null),
+		notifications: new BdNotificationsClient(transport, state.siteId),
+		followers: new BdFollowersClient(transport, state.siteId),
+		legal: new BdLegalClient(transport),
+		site: (siteId: string) => transport.site(siteId),
+		marketing: new BdMarketingClient(transport, state.siteId),
+		marketingPages: new BdMarketingPagesClient(transport, state.siteId),
+		parallelPages: new BdParallelPagesClient(transport, state.siteId),
 	};
 }
+
+/* ── Facade ↔ helper-module contracts ──────────────────────────────────
+ * The standalone helpers (`/legal`, `/sitemap`) accept "any client that
+ * carries the right surface", and every file-routed starter hands them
+ * THIS facade. 0.9.80 shipped without `legal` and `site`, and three
+ * starters stopped typechecking against the published package — a drift
+ * only the template fleet could see. These aliases move that failure
+ * into `pnpm typecheck`: drop a required surface and the build breaks
+ * here, before a release. Type-only; erased from the emitted JS. */
+type MustBeTrue<T extends true> = T;
+export type FacadeServesLegalRoutes = MustBeTrue<
+	BdClient extends import("./legal-core/index.js").LegalClientLike
+		? true
+		: false
+>;
+export type FacadeServesSitemapRoutes = MustBeTrue<
+	BdClient extends import("./sitemap-core/index.js").SitemapClientLike
+		? true
+		: false
+>;

package/src/seed-core/index.ts

@@ -694,22 +694,22 @@ export function seedTargetFromEnv(
 		? {}
 		: process.env,
 ): SeedTarget {
-	// BIAB_API_KEY first, because that is the name the CLI reads and the name
+	// BD_API_KEY first, because that is the name the CLI reads and the name
 	// every starter's .env.example sets. Reading a different name would mean a
 	// project whose CLI works fine still fails here, with an error naming a
 	// variable the consumer has never seen.
 	const apiKey =
-		env.BIAB_API_KEY ?? env.BUSINESSDASH_API_KEY ?? env.BIAB_PACKAGE_API_KEY;
-	const siteId = env.BIAB_SITE_ID ?? env.BUSINESSDASH_SITE_ID;
+		env.BD_API_KEY ?? env.BUSINESSDASH_API_KEY ?? env.BD_PACKAGE_API_KEY;
+	const siteId = env.BD_SITE_ID ?? env.BUSINESSDASH_SITE_ID;
 	const baseUrl =
-		env.BIAB_PACKAGE_API_BASE_URL ??
+		env.BD_PACKAGE_API_BASE_URL ??
 		env.BUSINESSDASH_API_BASE_URL ??
-		env.NEXT_PUBLIC_BIAB_PACKAGE_API_BASE_URL;
+		env.NEXT_PUBLIC_BD_PACKAGE_API_BASE_URL;
 
 	const missing = [
-		!apiKey && "BIAB_API_KEY",
-		!siteId && "BIAB_SITE_ID",
-		!baseUrl && "BIAB_PACKAGE_API_BASE_URL",
+		!apiKey && "BD_API_KEY",
+		!siteId && "BD_SITE_ID",
+		!baseUrl && "BD_PACKAGE_API_BASE_URL",
 	].filter(Boolean);
 
 	if (missing.length > 0) {

package/src/seo-core/blog.ts

@@ -54,7 +54,7 @@ export type BlogPostSeoInput = {
 	/**
 	 * CSS selector wrapping the gated body, for the paywall markup.
 	 *
-	 * Defaults to `.biab-post-body`. It only has to match the element your
+	 * Defaults to `.bd-post-body`. It only has to match the element your
 	 * template actually hides — a selector that matches nothing makes the
 	 * markup a claim you are not backing up.
 	 */
@@ -108,7 +108,7 @@ export function blogPostSeo(input: BlogPostSeoInput): SeoInput {
 		node["hasPart"] = {
 			"@type": "WebPageElement",
 			isAccessibleForFree: false,
-			cssSelector: input.paywallSelector ?? ".biab-post-body",
+			cssSelector: input.paywallSelector ?? ".bd-post-body",
 		};
 	}
 

package/src/seo-core/index.ts

@@ -557,7 +557,7 @@ export function applyToDocument(
 		: document,
 ): void {
 	if (!doc) return;
-	const OWNED = "data-biab-seo";
+	const OWNED = "data-bd-seo";
 
 	for (const existing of Array.from(doc.head.querySelectorAll(`[${OWNED}]`))) {
 		existing.remove();

package/src/seo.ts

@@ -474,7 +474,7 @@ export function renderJsonLdToHtml(nodes: JsonLdNode[]): string {
 		.join("\n");
 }
 
-export const biabSchemas = {
+export const bdSchemas = {
 	localBusiness,
 	localBusinessLocations,
 	organization,