@proveanything/smartlinks 2.0.69 → 2.0.71

package/dist/api/asset.d.ts

@@ -101,6 +101,11 @@ export declare namespace asset {
      * Restore a soft-deleted asset (clears `deletedAt`).
      */
     function restoreAdmin(collectionId: string, assetId: string): Promise<Asset>;
+    /**
+     * Give an existing asset its own address (`assetUrl`). New and replaced assets get one automatically;
+     * this is for assets made before asset addresses existed. Safe to call again. → the asset, with `assetUrl`.
+     */
+    function ensureAssetUrl(collectionId: string, assetId: string): Promise<Asset>;
     /**
      * Soft-delete multiple assets in one request.
      */

package/dist/api/asset.js

@@ -424,6 +424,15 @@ export var asset;
         return post(path, {});
     }
     asset.restoreAdmin = restoreAdmin;
+    /**
+     * Give an existing asset its own address (`assetUrl`). New and replaced assets get one automatically;
+     * this is for assets made before asset addresses existed. Safe to call again. → the asset, with `assetUrl`.
+     */
+    async function ensureAssetUrl(collectionId, assetId) {
+        const path = `/admin/collection/${encodeURIComponent(collectionId)}/asset/${encodeURIComponent(assetId)}/asset-url`;
+        return post(path, {});
+    }
+    asset.ensureAssetUrl = ensureAssetUrl;
     /**
      * Soft-delete multiple assets in one request.
      */
@@ -673,6 +682,8 @@ export var asset;
             startBody.productId = scope.productId;
         if (scope.type === 'proof')
             startBody.proofId = scope.proofId;
+        if (options.replaceAssetId)
+            startBody.replaceAssetId = options.replaceAssetId;
         const started = await post(base, startBody, token ? { 'X-Upload-Token': token } : undefined);
         const finalizePath = `${base}/${encodeURIComponent(started.uploadId)}/complete`;
         const finalizeBody = {};

package/dist/api/authKit.d.ts

@@ -1,4 +1,4 @@
-import type { AuthLoginResponse, AppleLoginOptions, RefreshResponse, LogoutResponse, PhoneSendCodeResponse, PhoneVerifyResponse, PasswordResetRequestResponse, VerifyResetTokenResponse, PasswordResetCompleteResponse, EmailVerificationActionResponse, EmailVerifyTokenResponse, AuthKitConfig, AuthKitConfigInput, AuthKitSetIdentityResponse, MagicLinkSendResponse, MagicLinkVerifyResponse, UserProfile, UpdateProfileResponse, ProfileUpdateData, SuccessResponse, SendWhatsAppRequest, SendWhatsAppResponse, ExchangeWhatsAppSessionResponse, VerifyWhatsAppResponse, WhatsAppStatusResponse, SendSmsVerifyRequest, SendSmsVerifyResponse, VerifySmsResponse, UpsertContactRequest, UpsertContactResponse, MfaChallengeSendResponse, MfaFinalizeResponse, MfaEnrollSendResponse, MfaEnrolledResponse, MfaFactorsResponse, TrustedDevice } from "../types/authKit.js";
+import type { AuthLoginResponse, AppleLoginOptions, RefreshResponse, LogoutResponse, PhoneSendCodeResponse, PhoneVerifyResponse, PasswordResetRequestResponse, VerifyResetTokenResponse, PasswordResetCompleteResponse, EmailVerificationActionResponse, EmailVerifyTokenResponse, AuthKitConfig, AuthKitConfigInput, AuthKitSetIdentityResponse, AuthKitInviteRequest, AuthKitInviteResponse, MagicLinkSendResponse, MagicLinkVerifyResponse, UserProfile, UpdateProfileResponse, ProfileUpdateData, SuccessResponse, SendWhatsAppRequest, SendWhatsAppResponse, ExchangeWhatsAppSessionResponse, VerifyWhatsAppResponse, WhatsAppStatusResponse, SendSmsVerifyRequest, SendSmsVerifyResponse, VerifySmsResponse, UpsertContactRequest, UpsertContactResponse, MfaChallengeSendResponse, MfaFinalizeResponse, MfaEnrollSendResponse, MfaTotpEnrollResponse, MfaEnrolledResponse, MfaFactor, MfaFactorsResponse, TrustedDevice } from "../types/authKit.js";
 /**
  * Namespace containing helper functions for the new AuthKit API.
  * Legacy collection-based authKit helpers retained (marked as *Legacy*).
@@ -208,8 +208,11 @@ export declare namespace authKit {
     function verifyEmailChange(clientId: string, token: string): Promise<SuccessResponse>;
     function updatePhone(clientId: string, phoneNumber: string, verificationCode: string): Promise<SuccessResponse>;
     function deleteAccount(clientId: string, password: string, confirmText: string): Promise<SuccessResponse>;
-    /** Send (or resend) an MFA challenge code to the given factor (public). */
-    function mfaChallengeSend(clientId: string, mfaSessionToken: string, factor: 'email' | 'sms'): Promise<MfaChallengeSendResponse>;
+    /**
+     * Send (or resend) an MFA challenge code to the given factor (public). For `totp` nothing is sent —
+     * it tells the server the code will come from their authenticator app; then {@link mfaChallengeVerify}.
+     */
+    function mfaChallengeSend(clientId: string, mfaSessionToken: string, factor: MfaFactor): Promise<MfaChallengeSendResponse>;
     /**
      * Verify an MFA challenge code and finalize the login (public). On success this behaves
      * like {@link login} — the bearer token is adopted and the cache invalidated.
@@ -233,6 +236,15 @@ export declare namespace authKit {
     function enrollSmsMfa(clientId: string, phoneNumber: string): Promise<MfaEnrollSendResponse>;
     /** Confirm SMS-factor enrollment with the code sent by {@link enrollSmsMfa} (authenticated). */
     function confirmSmsMfa(clientId: string, mfaSessionToken: string, code: string): Promise<MfaEnrolledResponse>;
+    /**
+     * Begin authenticator-app enrollment (authenticated): a new secret for Google Authenticator,
+     * Microsoft Authenticator, 1Password and the like. Show `otpauthUri` as a QR code (and `secret` for
+     * typing in), then {@link confirmTotpMfa} with the code the app shows. Nothing is kept until then;
+     * setting up again replaces the previous app once confirmed.
+     */
+    function enrollTotpMfa(clientId: string): Promise<MfaTotpEnrollResponse>;
+    /** Confirm authenticator-app enrollment with the 6-digit code the app shows (authenticated). */
+    function confirmTotpMfa(clientId: string, mfaSessionToken: string, code: string): Promise<MfaEnrolledResponse>;
     /**
      * Generate a fresh set of recovery codes, invalidating any previous set (authenticated).
      * Returned **in plaintext, exactly once** — nothing else in the API ever returns them
@@ -242,7 +254,7 @@ export declare namespace authKit {
         recoveryCodes: string[];
     }>;
     /** Remove an enrolled MFA factor (authenticated). Server route is DELETE with a body. */
-    function removeMfaFactor(clientId: string, factor: 'email' | 'sms', password: string): Promise<SuccessResponse>;
+    function removeMfaFactor(clientId: string, factor: MfaFactor, password: string): Promise<SuccessResponse>;
     /** List devices trusted to skip MFA challenges for the current user (authenticated). */
     function listTrustedDevices(clientId: string): Promise<{
         devices: TrustedDevice[];
@@ -281,5 +293,17 @@ export declare namespace authKit {
     function setIdentity(collectionId: string, authKitId: string, body: {
         mode: 'own';
     }): Promise<AuthKitSetIdentityResponse>;
+    /**
+     * Invite someone to be a member of a site with its own logins (admin). Makes their account if they have
+     * none (the only way in when the site is invitation only — `signUp: 'invite'`), finds or creates their
+     * contact in this collection with the `customFields` you pass (their level), links the two, and emails
+     * them a sign-in link to the site (`redirectUrl`, default the kit's) that works once for 7 days. The page
+     * it opens handles it like any magic link: `mode=magicLink&token=…` → {@link verifyMagicLink}.
+     * Inviting someone again sends a fresh link.
+     *
+     * Errors: `OWN_LOGINS_REQUIRED` (409), `INVALID_EMAIL` (400), `INVALID_REDIRECT_URL` (400, not one of
+     * this site's addresses), `TOO_MANY_INVITES` (429, 5 an hour per address).
+     */
+    function invite(collectionId: string, authKitId: string, body: AuthKitInviteRequest): Promise<AuthKitInviteResponse>;
     function remove(collectionId: string, authKitId: string): Promise<void>;
 }

package/dist/api/authKit.js

@@ -380,7 +380,10 @@ export var authKit;
      * challenge/send can be called again on the same token (while unexpired/unburned) to
      * switch factors or resend.
      * =================================== */
-    /** Send (or resend) an MFA challenge code to the given factor (public). */
+    /**
+     * Send (or resend) an MFA challenge code to the given factor (public). For `totp` nothing is sent —
+     * it tells the server the code will come from their authenticator app; then {@link mfaChallengeVerify}.
+     */
     async function mfaChallengeSend(clientId, mfaSessionToken, factor) {
         return post(`/authkit/${encodeURIComponent(clientId)}/mfa/challenge/send`, { mfaSessionToken, factor });
     }
@@ -442,6 +445,21 @@ export var authKit;
         return post(`/authkit/${encodeURIComponent(clientId)}/mfa/factors/sms/confirm`, { mfaSessionToken, code });
     }
     authKit.confirmSmsMfa = confirmSmsMfa;
+    /**
+     * Begin authenticator-app enrollment (authenticated): a new secret for Google Authenticator,
+     * Microsoft Authenticator, 1Password and the like. Show `otpauthUri` as a QR code (and `secret` for
+     * typing in), then {@link confirmTotpMfa} with the code the app shows. Nothing is kept until then;
+     * setting up again replaces the previous app once confirmed.
+     */
+    async function enrollTotpMfa(clientId) {
+        return post(`/authkit/${encodeURIComponent(clientId)}/mfa/factors/totp/enroll`, {});
+    }
+    authKit.enrollTotpMfa = enrollTotpMfa;
+    /** Confirm authenticator-app enrollment with the 6-digit code the app shows (authenticated). */
+    async function confirmTotpMfa(clientId, mfaSessionToken, code) {
+        return post(`/authkit/${encodeURIComponent(clientId)}/mfa/factors/totp/confirm`, { mfaSessionToken, code });
+    }
+    authKit.confirmTotpMfa = confirmTotpMfa;
     /**
      * Generate a fresh set of recovery codes, invalidating any previous set (authenticated).
      * Returned **in plaintext, exactly once** — nothing else in the API ever returns them
@@ -525,6 +543,22 @@ export var authKit;
         return post(path, body);
     }
     authKit.setIdentity = setIdentity;
+    /**
+     * Invite someone to be a member of a site with its own logins (admin). Makes their account if they have
+     * none (the only way in when the site is invitation only — `signUp: 'invite'`), finds or creates their
+     * contact in this collection with the `customFields` you pass (their level), links the two, and emails
+     * them a sign-in link to the site (`redirectUrl`, default the kit's) that works once for 7 days. The page
+     * it opens handles it like any magic link: `mode=magicLink&token=…` → {@link verifyMagicLink}.
+     * Inviting someone again sends a fresh link.
+     *
+     * Errors: `OWN_LOGINS_REQUIRED` (409), `INVALID_EMAIL` (400), `INVALID_REDIRECT_URL` (400, not one of
+     * this site's addresses), `TOO_MANY_INVITES` (429, 5 an hour per address).
+     */
+    async function invite(collectionId, authKitId, body) {
+        const path = `/admin/collection/${encodeURIComponent(collectionId)}/authKit/${encodeURIComponent(authKitId)}/invite`;
+        return post(path, body);
+    }
+    authKit.invite = invite;
     async function remove(collectionId, authKitId) {
         const path = `/admin/collection/${encodeURIComponent(collectionId)}/authKit/${encodeURIComponent(authKitId)}`;
         return del(path);

package/dist/api/bookings.d.ts

@@ -0,0 +1,89 @@
+import type { Booking, BookingSlot, BookingAllocation, CreateBookingInput, UpdateBookingInput, MoveBookingInput, BookingListQueryParams, CreateSlotInput, UpdateSlotInput, SlotListQueryParams, CreateBlockInput, BlockListQueryParams, FreeBusyQuery, FreeBusyResponse, BookingAccessOptions } from '../types/bookings.js';
+import type { PaginatedResponse } from '../types/appObjects.js';
+export declare namespace bookings {
+    /**
+     * Book. All claims succeed together or nothing is written; a clash fails with 409
+     * (`SLOT_FULL`, `RESOURCE_TAKEN`, `PER_CONTACT_LIMIT`, …). Pass `idempotencyKey` so a retry never
+     * books twice.
+     *
+     * Public (admin = false): the app's `publicCreate.bookings` rules decide the status and limits; an
+     * anonymous guest may get `editToken` back (once) to manage the booking later.
+     *
+     * POST /bookings
+     */
+    function create(collectionId: string, appId: string, input: CreateBookingInput, admin?: boolean): Promise<Booking>;
+    /** List bookings (admin). GET /bookings */
+    function list(collectionId: string, appId: string, params?: BookingListQueryParams, admin?: boolean): Promise<PaginatedResponse<Booking>>;
+    /** The signed-in caller's own bookings (public). GET /bookings/mine */
+    function mine(collectionId: string, appId: string, params?: BookingListQueryParams): Promise<PaginatedResponse<Booking>>;
+    /**
+     * Get one booking. Public: the signed-in booker, or a guest passing `{ editToken }`.
+     * GET /bookings/:bookingId
+     */
+    function get(collectionId: string, appId: string, bookingId: string, admin?: boolean, opts?: BookingAccessOptions): Promise<Booking>;
+    /** Update zones and descriptive fields (admin). PATCH /bookings/:bookingId */
+    function update(collectionId: string, appId: string, bookingId: string, input: UpdateBookingInput, admin?: boolean): Promise<Booking>;
+    /**
+     * held / pending / waitlisted → confirmed (idempotent). A held booking whose hold has run out fails
+     * with HOLD_EXPIRED. Public: only the booker's own hold, when `ownerActions.bookings.confirm` allows.
+     * POST /bookings/:bookingId/confirm
+     */
+    function confirm(collectionId: string, appId: string, bookingId: string, admin?: boolean, opts?: BookingAccessOptions): Promise<Booking>;
+    /**
+     * Cancel and give the places back (idempotent). Public: per `ownerActions.bookings.cancel` and its
+     * cutoff. `reason` is admin-only (public cancels record 'owner').
+     * POST /bookings/:bookingId/cancel
+     */
+    function cancel(collectionId: string, appId: string, bookingId: string, admin?: boolean, opts?: BookingAccessOptions & {
+        reason?: string;
+    }): Promise<Booking>;
+    /**
+     * Move to a new slot / time, all-or-nothing (a failed move leaves the booking as it was).
+     * Public: per `ownerActions.bookings.move`; the create rules are re-checked for the new time.
+     * POST /bookings/:bookingId/move
+     */
+    function move(collectionId: string, appId: string, bookingId: string, input: MoveBookingInput, admin?: boolean, opts?: BookingAccessOptions): Promise<Booking>;
+    /** Extend a hold by `holdMinutes` from now (admin; capped at 24h after the booking was made). */
+    function extendHold(collectionId: string, appId: string, bookingId: string, holdMinutes: number): Promise<Booking>;
+    /** confirmed → completed (admin). */
+    function complete(collectionId: string, appId: string, bookingId: string): Promise<Booking>;
+    /** confirmed → no_show (admin). */
+    function noShow(collectionId: string, appId: string, bookingId: string): Promise<Booking>;
+    /**
+     * Busy intervals per resource (bookings, blocks, slots' own blocks) — never booking details.
+     * Public only when the app sets `publicRead.bookings.freebusy: true`.
+     * GET /bookings/freebusy
+     */
+    function freebusy(collectionId: string, appId: string, q: FreeBusyQuery, admin?: boolean): Promise<FreeBusyResponse>;
+    namespace slots {
+        /** Create a slot (admin). POST /bookings/slots */
+        function create(collectionId: string, appId: string, input: CreateSlotInput): Promise<BookingSlot>;
+        /** Create many slots at once — a series — all-or-nothing (admin, max 500). POST /bookings/slots/batch */
+        function createMany(collectionId: string, appId: string, slots: CreateSlotInput[], opts?: {
+            seriesId?: string;
+        }): Promise<{
+            data: BookingSlot[];
+        }>;
+        /** List slots. Public: open, public slots only, each with `remaining`. GET /bookings/slots */
+        function list(collectionId: string, appId: string, params?: SlotListQueryParams, admin?: boolean): Promise<PaginatedResponse<BookingSlot>>;
+        /** GET /bookings/slots/:slotId */
+        function get(collectionId: string, appId: string, slotId: string, admin?: boolean): Promise<BookingSlot>;
+        /**
+         * Update a slot (admin). Capacity can't drop below what's booked (SLOT_OVERBOOKED); times can't
+         * change once anything is booked (SLOT_HAS_BOOKINGS).
+         */
+        function update(collectionId: string, appId: string, slotId: string, input: UpdateSlotInput): Promise<BookingSlot>;
+        /** Delete a slot (admin; refused while places are booked). */
+        function remove(collectionId: string, appId: string, slotId: string): Promise<{
+            success: boolean;
+        }>;
+    }
+    /** Blocked time on a resource with no booking — time off, a closure, maintenance (admin). */
+    namespace blocks {
+        function create(collectionId: string, appId: string, input: CreateBlockInput): Promise<BookingAllocation>;
+        function list(collectionId: string, appId: string, params?: BlockListQueryParams): Promise<PaginatedResponse<BookingAllocation>>;
+        function remove(collectionId: string, appId: string, blockId: string): Promise<{
+            success: boolean;
+        }>;
+    }
+}

package/dist/api/bookings.js

@@ -0,0 +1,179 @@
+// src/api/bookings.ts
+// Generic booking objects — see docs/bookings.md.
+//
+// Every function takes `admin` last (default false), like app.cases / app.records:
+//   admin = true  → /admin/... — unconditional (Studio users, your app's own server functions)
+//   admin = false → /public/... — governed by the app's config: publicCreate.bookings (who may book,
+//                   as what status, limits, time rules), ownerActions.bookings (cancel / move /
+//                   confirm afterwards) and publicRead.bookings.freebusy.
+import { request, post, patch, del, requestWithOptions } from '../http.js';
+function basePath(collectionId, appId, admin) {
+    const zone = admin ? 'admin' : 'public';
+    return `/${zone}/collection/${encodeURIComponent(collectionId)}/app/${encodeURIComponent(appId)}/bookings`;
+}
+function query(params) {
+    if (!params)
+        return '';
+    const parts = [];
+    for (const [key, value] of Object.entries(params)) {
+        if (value === undefined || value === null)
+            continue;
+        const v = value instanceof Date ? value.toISOString() : Array.isArray(value) ? value.join(',') : String(value);
+        parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(v)}`);
+    }
+    return parts.length ? `?${parts.join('&')}` : '';
+}
+function tokenHeaders(opts) {
+    return (opts === null || opts === void 0 ? void 0 : opts.editToken) ? { 'X-Edit-Token': opts.editToken } : undefined;
+}
+function refString(r) {
+    return typeof r === 'string' ? r : `${r.type}:${r.id}`;
+}
+export var bookings;
+(function (bookings) {
+    /**
+     * Book. All claims succeed together or nothing is written; a clash fails with 409
+     * (`SLOT_FULL`, `RESOURCE_TAKEN`, `PER_CONTACT_LIMIT`, …). Pass `idempotencyKey` so a retry never
+     * books twice.
+     *
+     * Public (admin = false): the app's `publicCreate.bookings` rules decide the status and limits; an
+     * anonymous guest may get `editToken` back (once) to manage the booking later.
+     *
+     * POST /bookings
+     */
+    async function create(collectionId, appId, input, admin = false) {
+        return post(basePath(collectionId, appId, admin), input);
+    }
+    bookings.create = create;
+    /** List bookings (admin). GET /bookings */
+    async function list(collectionId, appId, params, admin = true) {
+        return request(`${basePath(collectionId, appId, admin)}${query(params)}`);
+    }
+    bookings.list = list;
+    /** The signed-in caller's own bookings (public). GET /bookings/mine */
+    async function mine(collectionId, appId, params) {
+        return request(`${basePath(collectionId, appId, false)}/mine${query(params)}`);
+    }
+    bookings.mine = mine;
+    /**
+     * Get one booking. Public: the signed-in booker, or a guest passing `{ editToken }`.
+     * GET /bookings/:bookingId
+     */
+    async function get(collectionId, appId, bookingId, admin = false, opts) {
+        const path = `${basePath(collectionId, appId, admin)}/${encodeURIComponent(bookingId)}`;
+        const headers = tokenHeaders(opts);
+        return headers ? requestWithOptions(path, { method: 'GET', headers }) : request(path);
+    }
+    bookings.get = get;
+    /** Update zones and descriptive fields (admin). PATCH /bookings/:bookingId */
+    async function update(collectionId, appId, bookingId, input, admin = true) {
+        return patch(`${basePath(collectionId, appId, admin)}/${encodeURIComponent(bookingId)}`, input);
+    }
+    bookings.update = update;
+    /**
+     * held / pending / waitlisted → confirmed (idempotent). A held booking whose hold has run out fails
+     * with HOLD_EXPIRED. Public: only the booker's own hold, when `ownerActions.bookings.confirm` allows.
+     * POST /bookings/:bookingId/confirm
+     */
+    async function confirm(collectionId, appId, bookingId, admin = false, opts) {
+        return post(`${basePath(collectionId, appId, admin)}/${encodeURIComponent(bookingId)}/confirm`, {}, tokenHeaders(opts));
+    }
+    bookings.confirm = confirm;
+    /**
+     * Cancel and give the places back (idempotent). Public: per `ownerActions.bookings.cancel` and its
+     * cutoff. `reason` is admin-only (public cancels record 'owner').
+     * POST /bookings/:bookingId/cancel
+     */
+    async function cancel(collectionId, appId, bookingId, admin = false, opts) {
+        return post(`${basePath(collectionId, appId, admin)}/${encodeURIComponent(bookingId)}/cancel`, (opts === null || opts === void 0 ? void 0 : opts.reason) ? { reason: opts.reason } : {}, tokenHeaders(opts));
+    }
+    bookings.cancel = cancel;
+    /**
+     * Move to a new slot / time, all-or-nothing (a failed move leaves the booking as it was).
+     * Public: per `ownerActions.bookings.move`; the create rules are re-checked for the new time.
+     * POST /bookings/:bookingId/move
+     */
+    async function move(collectionId, appId, bookingId, input, admin = false, opts) {
+        return post(`${basePath(collectionId, appId, admin)}/${encodeURIComponent(bookingId)}/move`, input, tokenHeaders(opts));
+    }
+    bookings.move = move;
+    /** Extend a hold by `holdMinutes` from now (admin; capped at 24h after the booking was made). */
+    async function extendHold(collectionId, appId, bookingId, holdMinutes) {
+        return post(`${basePath(collectionId, appId, true)}/${encodeURIComponent(bookingId)}/extend-hold`, { holdMinutes });
+    }
+    bookings.extendHold = extendHold;
+    /** confirmed → completed (admin). */
+    async function complete(collectionId, appId, bookingId) {
+        return post(`${basePath(collectionId, appId, true)}/${encodeURIComponent(bookingId)}/complete`, {});
+    }
+    bookings.complete = complete;
+    /** confirmed → no_show (admin). */
+    async function noShow(collectionId, appId, bookingId) {
+        return post(`${basePath(collectionId, appId, true)}/${encodeURIComponent(bookingId)}/no-show`, {});
+    }
+    bookings.noShow = noShow;
+    /**
+     * Busy intervals per resource (bookings, blocks, slots' own blocks) — never booking details.
+     * Public only when the app sets `publicRead.bookings.freebusy: true`.
+     * GET /bookings/freebusy
+     */
+    async function freebusy(collectionId, appId, q, admin = false) {
+        const params = { resources: q.resources.map(refString).join(','), from: q.from, to: q.to };
+        return request(`${basePath(collectionId, appId, admin)}/freebusy${query(params)}`);
+    }
+    bookings.freebusy = freebusy;
+    // ==================== SLOTS ====================
+    let slots;
+    (function (slots_1) {
+        /** Create a slot (admin). POST /bookings/slots */
+        async function create(collectionId, appId, input) {
+            return post(`${basePath(collectionId, appId, true)}/slots`, input);
+        }
+        slots_1.create = create;
+        /** Create many slots at once — a series — all-or-nothing (admin, max 500). POST /bookings/slots/batch */
+        async function createMany(collectionId, appId, slots, opts) {
+            return post(`${basePath(collectionId, appId, true)}/slots/batch`, { slots, seriesId: opts === null || opts === void 0 ? void 0 : opts.seriesId });
+        }
+        slots_1.createMany = createMany;
+        /** List slots. Public: open, public slots only, each with `remaining`. GET /bookings/slots */
+        async function list(collectionId, appId, params, admin = false) {
+            return request(`${basePath(collectionId, appId, admin)}/slots${query(params)}`);
+        }
+        slots_1.list = list;
+        /** GET /bookings/slots/:slotId */
+        async function get(collectionId, appId, slotId, admin = false) {
+            return request(`${basePath(collectionId, appId, admin)}/slots/${encodeURIComponent(slotId)}`);
+        }
+        slots_1.get = get;
+        /**
+         * Update a slot (admin). Capacity can't drop below what's booked (SLOT_OVERBOOKED); times can't
+         * change once anything is booked (SLOT_HAS_BOOKINGS).
+         */
+        async function update(collectionId, appId, slotId, input) {
+            return patch(`${basePath(collectionId, appId, true)}/slots/${encodeURIComponent(slotId)}`, input);
+        }
+        slots_1.update = update;
+        /** Delete a slot (admin; refused while places are booked). */
+        async function remove(collectionId, appId, slotId) {
+            return del(`${basePath(collectionId, appId, true)}/slots/${encodeURIComponent(slotId)}`);
+        }
+        slots_1.remove = remove;
+    })(slots = bookings.slots || (bookings.slots = {}));
+    // ==================== BLOCKS ====================
+    /** Blocked time on a resource with no booking — time off, a closure, maintenance (admin). */
+    let blocks;
+    (function (blocks) {
+        async function create(collectionId, appId, input) {
+            return post(`${basePath(collectionId, appId, true)}/blocks`, input);
+        }
+        blocks.create = create;
+        async function list(collectionId, appId, params) {
+            return request(`${basePath(collectionId, appId, true)}/blocks${query(params)}`);
+        }
+        blocks.list = list;
+        async function remove(collectionId, appId, blockId) {
+            return del(`${basePath(collectionId, appId, true)}/blocks/${encodeURIComponent(blockId)}`);
+        }
+        blocks.remove = remove;
+    })(blocks = bookings.blocks || (bookings.blocks = {}));
+})(bookings || (bookings = {}));

package/dist/api/index.d.ts

@@ -34,6 +34,7 @@ export { adminCards } from "./adminCards.js";
 export { tags } from "./tags.js";
 export { order } from "./order.js";
 export { app } from "./appObjects.js";
+export { bookings } from "./bookings.js";
 export { attestations } from "./attestations.js";
 export { containers } from "./containers.js";
 export { lots } from "./lots.js";

package/dist/api/index.js

@@ -37,6 +37,7 @@ export { adminCards } from "./adminCards.js";
 export { tags } from "./tags.js";
 export { order } from "./order.js";
 export { app } from "./appObjects.js";
+export { bookings } from "./bookings.js";
 export { attestations } from "./attestations.js";
 export { containers } from "./containers.js";
 export { lots } from "./lots.js";