@fullgrainsoftware/portal 0.9.0

package/dist/cms-client.js

@@ -0,0 +1,38 @@
+const DEFAULT_BASE_URL = "https://www.abdevpanel.com";
+export async function fetchPublicSiteData(websiteId, opts) {
+    const base = (opts?.baseUrl ?? process.env.AB_CMS_URL ?? DEFAULT_BASE_URL).replace(/\/$/, "");
+    const timeoutMs = opts?.timeoutMs ?? 10_000;
+    const controller = new AbortController();
+    const onAbort = () => controller.abort();
+    if (opts?.signal) {
+        if (opts.signal.aborted)
+            controller.abort();
+        else
+            opts.signal.addEventListener("abort", onAbort, { once: true });
+    }
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetch(`${base}/api/public-site-data`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ website_id: websiteId }),
+            cache: "no-store",
+            signal: controller.signal,
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            throw new Error(`Failed to fetch CMS data: ${response.status} - ${errorText}`);
+        }
+        return (await response.json());
+    }
+    catch (err) {
+        if (controller.signal.aborted && !opts?.signal?.aborted) {
+            throw new Error(`CMS request timed out after ${timeoutMs}ms (${base})`);
+        }
+        throw err;
+    }
+    finally {
+        clearTimeout(timer);
+        opts?.signal?.removeEventListener("abort", onAbort);
+    }
+}

package/dist/cms-types.d.ts

@@ -0,0 +1,99 @@
+export type CMSStaticRendition = {
+    name: string | null;
+    url: string | null;
+    width: number | null;
+    height: number | null;
+    bitrate: number | null;
+};
+export type CMSVideo = {
+    id: string;
+    mux_asset_id: string;
+    mux_playback_id: string;
+    playback_policy: string;
+    status: string;
+    duration_sec: number | null;
+    width: number | null;
+    height: number | null;
+    aspect_ratio: string | null;
+    mp4_support: boolean | null;
+    passthrough: string | null;
+    created_at: string | null;
+    /** Best static MP4 (≤1080p) for direct <video src>. */
+    playback_url: string | null;
+    /** HLS manifest for adaptive playback (`.m3u8`). */
+    hls_url: string | null;
+    /** ~720p MP4, handy for a muted autoplay background. Absent on legacy
+     *  value-only fallbacks. */
+    background_url?: string | null;
+    /** All named MP4 renditions the asset produced (absent on fallbacks). */
+    static_renditions?: CMSStaticRendition[];
+};
+export type CMSComponent = {
+    id: string;
+    page_id?: string;
+    section_id?: string;
+    section_group_id?: string;
+    type: string;
+    key: string;
+    value: string | null;
+    sort_order: number;
+    can_modify: boolean;
+    can_modify_type: boolean;
+    category: string;
+    video: CMSVideo | null;
+};
+export type CMSSectionGroup = {
+    id: string;
+    section_id: string;
+    name: string;
+    sort_order: number;
+    /** Sort tiebreaker within a section (matches the panel's own ordering). */
+    created_at?: string;
+    components: CMSComponent[];
+    subgroups?: CMSSectionGroup[];
+    parent_group_id?: string | null;
+};
+export type CMSSection = {
+    id: string;
+    page_id: string;
+    title: string;
+    can_modify: boolean;
+    sort_order: number;
+    allow_group_creation: boolean;
+    group_schema: unknown[] | null;
+    subgroup_schema?: unknown[] | null;
+    components: CMSComponent[];
+    groups: CMSSectionGroup[];
+};
+export type CMSPage = {
+    id: string;
+    website_id: string;
+    slug: string;
+    title: string;
+    can_modify: boolean;
+    sections: CMSSection[];
+};
+/** One approved review (panel reviews spec 2026-09-29 §6.1). `name` is the
+ *  display name the business chose; `rating` is 1–5 or null. */
+export type CMSReview = {
+    id: string;
+    name: string;
+    rating: number | null;
+    text: string;
+    /** ISO 8601, UTC. */
+    createdAt: string;
+};
+export type CMSWebsite = {
+    id: string;
+    user_id: string;
+    name: string;
+    domain: string;
+    alias: string;
+    created_at: string;
+    pages: CMSPage[];
+    /** Present only when the site has reviews switched on in the panel; read it with readReviews. */
+    reviews?: CMSReview[];
+};
+export type PublicSiteData = {
+    website: CMSWebsite;
+};

package/dist/cms-types.js

@@ -0,0 +1 @@
+export {};

package/dist/commerce.d.ts

@@ -0,0 +1,111 @@
+export type StoreStatus = {
+    checkoutAvailable: boolean;
+    currency: string;
+    /** Flat per-order shipping the store charges at checkout (0 = free). */
+    shippingCents: number;
+    /** 2-letter codes checkout will accept shipping addresses from. */
+    allowedCountries: string[];
+};
+export type LineIssue = {
+    variantId: string;
+    reason: "sold_out" | "inactive" | "not_found" | "quantity";
+    /** For sold_out: how many are actually available right now. */
+    available?: number;
+};
+export type ProductSummary = {
+    id: string;
+    slug: string;
+    name: string;
+    category: string | null;
+    priceRangeCents: [number, number];
+    images: string[];
+    soldOut: boolean;
+};
+export type VariantView = {
+    id: string;
+    valueIds: string[];
+    sku: string | null;
+    priceCents: number;
+    salePriceCents: number | null;
+    available: boolean;
+};
+export type ProductDetail = ProductSummary & {
+    description: string | null;
+    options: {
+        id: string;
+        name: string;
+        values: {
+            id: string;
+            value: string;
+        }[];
+    }[];
+    variants: VariantView[];
+};
+export type CheckoutInput = {
+    items: {
+        variantId: string;
+        quantity: number;
+    }[];
+    /** Absolute URL on the site's own domain. */
+    successUrl: string;
+    cancelUrl: string;
+    email?: string;
+};
+export type CheckoutResult = {
+    url: string;
+} | {
+    error: "commerce_paused" | "sold_out" | "invalid_items" | "stripe_error";
+    issues?: LineIssue[];
+};
+export type CartPreview = {
+    store: StoreStatus;
+    lines: {
+        variantId: string;
+        label: string;
+        unitAmountCents: number;
+        quantity: number;
+    }[];
+    issues: LineIssue[];
+    subtotalCents: number;
+};
+export type OrderStatus = {
+    status: "pending" | "paid" | "canceled" | "refunded";
+    fulfilled: boolean;
+    trackingCarrier: string | null;
+    trackingNumber: string | null;
+    items: {
+        name: string;
+        quantity: number;
+        priceCents: number;
+    }[];
+    totalCents: number;
+    refundedCents: number;
+    shippingName: string | null;
+};
+export interface Commerce {
+    listProducts(): Promise<{
+        store: StoreStatus;
+        products: ProductSummary[];
+    }>;
+    getProduct(slug: string): Promise<{
+        store: StoreStatus;
+        product: ProductDetail | null;
+    }>;
+    createCheckout(input: CheckoutInput): Promise<CheckoutResult>;
+    /** Authoritative prices + availability for a cart page. Reports issues,
+        never blocks, takes no inventory claims. */
+    previewCart(items: {
+        variantId: string;
+        quantity: number;
+    }[]): Promise<CartPreview>;
+    /** Success/order-page lookup by the Stripe {CHECKOUT_SESSION_ID}
+        template value. Unknown session → { order: null }. */
+    getOrderStatus(sessionId: string): Promise<{
+        store: StoreStatus;
+        order: OrderStatus | null;
+    }>;
+}
+export declare function createCommerce(opts: {
+    apiKey: string;
+    baseUrl?: string;
+}): Commerce;

package/dist/commerce.js

@@ -0,0 +1,91 @@
+/* Storefront commerce client (Lite Commerce). SERVER-ONLY: the API key is a
+   secret — createCommerce throws if constructed in a browser so a site can
+   never accidentally ship COMMERCE_API_KEY to the client.
+
+   Contract (frozen at 0.4.0, additive changes only): every response carries
+   a `store` block; catalog reads keep serving while a store is paused
+   (checkoutAvailable tells the site whether to offer buying); checkout
+   returns a typed error union instead of throwing for expected outcomes. */
+const DEFAULT_BASE_URL = "https://www.abdevpanel.com";
+export function createCommerce(opts) {
+    if (typeof window !== "undefined") {
+        throw new Error("createCommerce is server-only — never expose COMMERCE_API_KEY to the browser");
+    }
+    if (!opts.apiKey?.startsWith("absk_")) {
+        throw new Error("createCommerce needs a storefront API key (absk_…)");
+    }
+    const base = (opts.baseUrl ?? process.env.AB_CMS_URL ?? DEFAULT_BASE_URL).replace(/\/$/, "");
+    const request = async (path, init) => {
+        return fetch(`${base}${path}`, {
+            ...init,
+            headers: {
+                Authorization: `Bearer ${opts.apiKey}`,
+                "Content-Type": "application/json",
+                ...init?.headers,
+            },
+            cache: "no-store",
+        });
+    };
+    const failFrom = async (response, path) => {
+        const text = await response.text();
+        throw new Error(`Commerce request failed: ${response.status} ${path} - ${text}`);
+    };
+    // Parse a response we've decided to accept, but only if it's actually JSON.
+    // A wrong AB_CMS_URL, a Vercel deployment-protection page, or a CDN block can
+    // return a 200/404 whose body is HTML — res.json() would throw an opaque
+    // SyntaxError; surface the same informative failure as every other path.
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const jsonOrFail = async (response, path) => {
+        const contentType = response.headers.get("content-type") ?? "";
+        if (!contentType.includes("application/json")) {
+            const text = await response.text();
+            throw new Error(`Commerce request returned non-JSON: ${response.status} ${path} - ${text.slice(0, 200)}`);
+        }
+        return response.json();
+    };
+    return {
+        async listProducts() {
+            const res = await request("/api/storefront/products");
+            if (!res.ok)
+                return failFrom(res, "/api/storefront/products");
+            return jsonOrFail(res, "/api/storefront/products");
+        },
+        async getProduct(slug) {
+            const path = `/api/storefront/products/${encodeURIComponent(slug)}`;
+            const res = await request(path);
+            // 404 keeps the store block; it's a normal "no such product" answer.
+            if (!res.ok && res.status !== 404)
+                return failFrom(res, path);
+            return jsonOrFail(res, path);
+        },
+        async createCheckout(input) {
+            const res = await request("/api/storefront/checkout", {
+                method: "POST",
+                body: JSON.stringify(input),
+            });
+            // Typed bodies are expected outcomes, not exceptions: 400/409 carry a
+            // LineIssue error, 502 carries { error: "stripe_error" } for an outage.
+            if (res.ok || res.status === 400 || res.status === 409 || res.status === 502) {
+                return jsonOrFail(res, "/api/storefront/checkout");
+            }
+            return failFrom(res, "/api/storefront/checkout");
+        },
+        async previewCart(items) {
+            const res = await request("/api/storefront/cart-preview", {
+                method: "POST",
+                body: JSON.stringify({ items }),
+            });
+            if (!res.ok)
+                return failFrom(res, "/api/storefront/cart-preview");
+            return jsonOrFail(res, "/api/storefront/cart-preview");
+        },
+        async getOrderStatus(sessionId) {
+            const path = `/api/storefront/order-status?session_id=${encodeURIComponent(sessionId)}`;
+            const res = await request(path);
+            // 404 = unknown session, a normal answer carrying { order: null }.
+            if (!res.ok && res.status !== 404)
+                return failFrom(res, path);
+            return jsonOrFail(res, path);
+        },
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+export { defineSite, siteManifestSchema } from "./manifest.js";
+export type { FieldType, ManifestField, ManifestPage, ManifestSection, ManifestSeedItem, SiteManifest, } from "./manifest.js";
+export { readSiteContent, cmsItemProps } from "./reader.js";
+export type { SiteContent, CmsItemMeta } from "./reader.js";
+export { fetchPublicSiteData } from "./cms-client.js";
+export { readReviews } from "./reviews.js";
+export type { CMSComponent, CMSPage, CMSReview, CMSSection, CMSSectionGroup, CMSStaticRendition, CMSVideo, CMSWebsite, PublicSiteData, } from "./cms-types.js";
+export { createCommerce } from "./commerce.js";
+export type { CartPreview, CheckoutInput, CheckoutResult, Commerce, LineIssue, OrderStatus, ProductDetail, ProductSummary, StoreStatus, VariantView, } from "./commerce.js";
+export { createInquiries } from "./inquiries.js";
+export type { Inquiries, InquiryInput, InquirySubmitResult } from "./inquiries.js";
+export { initCmsPreview, parseInbound, readyMessage, sectionClickedMessage, editItemMessage, PREVIEW_PROTOCOL_VERSION, PREVIEW_QUERY_FLAG, } from "./preview.js";
+export type { CmsPreviewOptions, PreviewInbound, PreviewOutbound } from "./preview.js";
+export { createBookings } from "./bookings.js";
+export type { AvailabilityDay, AvailabilityResult, BookInput, BookResult, BookingCustomer, BookingService, BookingStatus, BookingView, Bookings, GetBookingResult, ManageResult, RequestTimeInput, RequestTimeResult, ServicesResult, } from "./bookings.js";

package/dist/index.js

@@ -0,0 +1,8 @@
+export { defineSite, siteManifestSchema } from "./manifest.js";
+export { readSiteContent, cmsItemProps } from "./reader.js";
+export { fetchPublicSiteData } from "./cms-client.js";
+export { readReviews } from "./reviews.js";
+export { createCommerce } from "./commerce.js";
+export { createInquiries } from "./inquiries.js";
+export { initCmsPreview, parseInbound, readyMessage, sectionClickedMessage, editItemMessage, PREVIEW_PROTOCOL_VERSION, PREVIEW_QUERY_FLAG, } from "./preview.js";
+export { createBookings } from "./bookings.js";

package/dist/inquiries.d.ts

@@ -0,0 +1,38 @@
+export interface InquiryInput {
+    /** lower-kebab, ≤ 40 chars; "contact" by default. */
+    form?: string;
+    name: string;
+    email?: string | null;
+    phone?: string | null;
+    message: string;
+    /** Extra site-specific fields, shown as label/value. */
+    fields?: Record<string, string>;
+    /** For `form: "review"`: a whole number 1–5. Anything else is an `invalid` result with `issues.rating`. */
+    rating?: number;
+    /** Where it was sent from, e.g. "/contact". */
+    page?: string | null;
+    /** A hidden field a human never fills; non-empty means a bot. */
+    honeypot?: string | null;
+    meta?: {
+        ip?: string | null;
+        userAgent?: string | null;
+    };
+}
+export type InquirySubmitResult = {
+    ok: true;
+    id: string;
+} | {
+    ok: false;
+    error: "invalid";
+    issues: Record<string, string>;
+} | {
+    ok: false;
+    error: "disabled" | "rate_limited" | "unavailable";
+};
+export interface Inquiries {
+    submit(input: InquiryInput): Promise<InquirySubmitResult>;
+}
+export declare function createInquiries(opts: {
+    apiKey: string;
+    baseUrl?: string;
+}): Inquiries;

package/dist/inquiries.js

@@ -0,0 +1,52 @@
+/* Inquiries (spec 2026-09-21): a site's contact form hands each submission
+   to the panel, which stores it, decides spam, and emails the site's
+   recipients. Server-only — the abik_ key is a secret — and `submit` never
+   throws for an expected outcome: it returns a typed result the site turns
+   into its own success, "try again in a few minutes", or fallback state. */
+const DEFAULT_BASE_URL = "https://www.abdevpanel.com";
+const TIMEOUT_MS = 10_000;
+export function createInquiries(opts) {
+    if (typeof window !== "undefined") {
+        throw new Error("createInquiries is server-only — never expose INQUIRY_API_KEY to the browser");
+    }
+    if (!opts.apiKey?.startsWith("abik_")) {
+        throw new Error("createInquiries needs an inquiry API key (abik_…)");
+    }
+    const base = (opts.baseUrl ?? process.env.AB_CMS_URL ?? DEFAULT_BASE_URL).replace(/\/$/, "");
+    const path = "/api/inquiries/submit";
+    const unavailable = (why) => {
+        console.error(`[fullgrain inquiries] ${why}`);
+        return { ok: false, error: "unavailable" };
+    };
+    return {
+        async submit(input) {
+            let res;
+            try {
+                res = await fetch(`${base}${path}`, {
+                    method: "POST",
+                    headers: { Authorization: `Bearer ${opts.apiKey}`, "Content-Type": "application/json" },
+                    body: JSON.stringify(input),
+                    cache: "no-store",
+                    signal: AbortSignal.timeout(TIMEOUT_MS),
+                });
+            }
+            catch (err) {
+                return unavailable(`request failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            const contentType = res.headers.get("content-type") ?? "";
+            if (!contentType.includes("application/json")) {
+                return unavailable(`non-JSON response ${res.status} from ${base}${path}`);
+            }
+            const body = (await res.json().catch(() => null));
+            if (res.status === 200 && body?.ok && typeof body.id === "string")
+                return { ok: true, id: body.id };
+            if (res.status === 400 && body?.error === "invalid")
+                return { ok: false, error: "invalid", issues: body.issues ?? {} };
+            if (res.status === 403)
+                return { ok: false, error: "disabled" };
+            if (res.status === 429)
+                return { ok: false, error: "rate_limited" };
+            return unavailable(`unexpected response ${res.status}${body?.error ? ` (${body.error})` : ""} from ${base}${path}`);
+        },
+    };
+}