@seatlayer/js 0.48.1 → 0.49.0

package/README.md

@@ -57,7 +57,9 @@ Svelte → `onMount` / `onDestroy`. Angular → `ngAfterViewInit` / `ngOnDestroy
 `SeatManager` gives first-party dashboards and external platforms the same
 realtime organizer cockpit. Mint a short-lived, event-scoped `mse_` token from
 your backend, bound to the browser's exact origin and only the capabilities it
-needs. The shared surface owns Monitor, Inspect, Block/unblock, fullscreen,
+needs. `SeatManager.token` accepts only that browser grant; passing a tenant
+`sk_` secret to browser code is unsupported. Keep the grant in memory—never in
+a URL, browser storage, or logs. The shared surface owns Monitor, Inspect, Block/unblock, fullscreen,
 presence, exact configured booked value, booking velocity, and a clearly explained
 **Booking momentum** overlay.
 Block mode exposes explicit multi-select category state and a searchable,
@@ -65,7 +67,7 @@ section-filtered blocked-inventory list, so an organizer can put specific seats
 back on sale without resetting the entire event.
 
 ```js
-import { SeatManager } from '@seatlayer/js';
+import { SeatManager } from '@seatlayer/js/manager';
 
 const manager = new SeatManager({
   container: '#control-room',
@@ -78,6 +80,16 @@ const manager = new SeatManager({
 await manager.render();
 ```
 
+The package root is the buyer runtime entry. Organizer JavaScript values—
+`SeatManager`, `ChannelsMode`, channel planning helpers, and `ManageApi`—come
+from `@seatlayer/js/manager`, keeping buyer imports free of control-room code.
+Type-only organizer imports from the root remain supported for TypeScript
+source compatibility, but new code should use the manager subpath consistently.
+
+`SeatManager` does not expose a browser-side box-office booking method. Create
+managed sales from trusted server code through the inventory booking API; the
+cockpit's public methods are limited to operations it can actually complete.
+
 Switching tools and rotating tokens happen in place: the renderer, camera,
 selection, WebSocket, and DOM are not remounted. Give the container a height;
 the cockpit responds to its container rather than the browser viewport.
@@ -95,6 +107,8 @@ const detail = await inventory.retrieveBooking('ev_9f3a', page.bookings[0].booki
 
 These records contain labels, lifecycle activity and configured-value snapshots.
 They do not contain buyer, payment, ticket, email or refund data.
+`ManageApi` retains `sk_` compatibility only for trusted server runtimes; browser
+callers must use an event-scoped `mse_` grant.
 
 ## Embed the chart Designer
 

package/dist/{channelsMode-NCH5GYHN.js → channelsMode-S4GEWCWS.js}

@@ -2,12 +2,11 @@ import {
   CHANNELS_CSS,
   ChannelsMode,
   bucketRowsHtml
-} from "./chunk-KNMZQZXR.js";
-import "./chunk-H4OJF6LE.js";
+} from "./chunk-5URCWBHM.js";
 import "./chunk-HMLY7DHA.js";
 export {
   CHANNELS_CSS,
   ChannelsMode,
   bucketRowsHtml
 };
-//# sourceMappingURL=channelsMode-NCH5GYHN.js.map
+//# sourceMappingURL=channelsMode-S4GEWCWS.js.map

package/dist/{chunk-KNMZQZXR.js → chunk-5URCWBHM.js}

@@ -1,7 +1,3 @@
-import {
-  ManageApiError
-} from "./chunk-H4OJF6LE.js";
-
 // src/channelPlan.ts
 var PUBLIC_CHANNEL_ID = "public";
 var PUBLIC_CHANNEL_NAME = "Public sale";
@@ -355,6 +351,493 @@ function stateBadge(state) {
   return state === "builtin" ? "Built-in" : state === "active" ? "Active" : state === "paused" ? "Paused" : "Archived";
 }
 
+// src/manageApi.ts
+var ManageApiError = class extends Error {
+  constructor(status, message, code, conflicts, details, serverMessage) {
+    super(message);
+    this.name = "ManageApiError";
+    this.status = status;
+    this.code = code;
+    this.conflicts = conflicts;
+    this.details = details;
+    this.serverMessage = serverMessage;
+  }
+};
+async function parse(res) {
+  const isJson = (res.headers.get("content-type") ?? "").includes("application/json");
+  const data = isJson ? await res.json().catch(() => null) : null;
+  if (!res.ok) {
+    const err = data;
+    throw new ManageApiError(
+      res.status,
+      err?.error ?? `request_failed_${res.status}`,
+      err?.code,
+      err?.conflicts,
+      err?.details,
+      typeof err?.message === "string" ? err.message : void 0
+    );
+  }
+  return data;
+}
+function record(value) {
+  return value && typeof value === "object" ? value : {};
+}
+function finite(primary, legacy, fallback = 0) {
+  if (typeof primary === "number" && Number.isFinite(primary)) return primary;
+  if (typeof legacy === "number" && Number.isFinite(legacy)) return legacy;
+  return fallback;
+}
+function nullableFinite(primary, legacy) {
+  if (primary === null) return null;
+  if (typeof primary === "number" && Number.isFinite(primary)) return primary;
+  if (primary !== void 0) return null;
+  if (typeof legacy === "number" && Number.isFinite(legacy)) return legacy;
+  return null;
+}
+function normalizeSection(value) {
+  const row = record(value);
+  const bookedValue = finite(row.bookedValue, row.bookedRevenue);
+  return { ...row, bookedValue, bookedRevenue: bookedValue };
+}
+function normalizeReportResult(value) {
+  const source = record(value);
+  const report = record(source.report);
+  const byCategory = Array.isArray(report.byCategory) ? report.byCategory.map((value2) => {
+    const row = record(value2);
+    const bookedValue = finite(row.bookedValue, row.bookedRevenue);
+    return { ...row, bookedValue, bookedRevenue: bookedValue };
+  }) : [];
+  const bySection = Array.isArray(report.bySection) ? report.bySection.map(normalizeSection) : void 0;
+  return {
+    ...source,
+    report: { ...report, byCategory, ...bySection ? { bySection } : {} }
+  };
+}
+function normalizeControlRoomSnapshot(value) {
+  const source = record(value);
+  const canonical = record(source.bookedValue);
+  const legacy = record(source.revenue);
+  const selected = Object.keys(canonical).length ? canonical : legacy;
+  const bySectionSource = Array.isArray(canonical.bySection) ? canonical.bySection : Array.isArray(legacy.bySection) ? legacy.bySection : [];
+  const bookedValue = {
+    ...selected,
+    gross: finite(canonical.gross, legacy.gross),
+    bySection: bySectionSource.map(normalizeSection)
+  };
+  const velocity = record(source.velocity);
+  const velocityRows = Array.isArray(velocity.bySection) ? velocity.bySection.map((value2) => {
+    const row = record(value2);
+    const rowValue = finite(row.bookedValue, row.grossRevenue);
+    return { ...row, bookedValue: rowValue, grossRevenue: rowValue };
+  }) : [];
+  return {
+    ...source,
+    bookedValue,
+    revenue: bookedValue,
+    velocity: { ...velocity, bySection: velocityRows }
+  };
+}
+function normalizeChannelReportResult(value) {
+  const source = record(value);
+  const report = record(source.report);
+  const includesBookedValue = typeof report.includesBookedValue === "boolean" ? report.includesBookedValue : report.includesRevenue === true;
+  const rows = Array.isArray(report.rows) ? report.rows.map((value2) => {
+    const row = record(value2);
+    const attribution = record(row.attribution);
+    const bookedValue = nullableFinite(attribution.bookedValue, attribution.revenue);
+    return {
+      ...row,
+      attribution: { ...attribution, bookedValue, revenue: bookedValue }
+    };
+  }) : [];
+  const totals = record(report.totals);
+  const totalBookedValue = nullableFinite(totals.bookedValue, totals.revenue);
+  return {
+    ...source,
+    report: {
+      ...report,
+      includesBookedValue,
+      includesRevenue: includesBookedValue,
+      rows,
+      totals: { ...totals, bookedValue: totalBookedValue, revenue: totalBookedValue }
+    }
+  };
+}
+function normalizeChannelReportLink(value) {
+  const link = record(value);
+  const includesBookedValue = typeof link.includesBookedValue === "boolean" ? link.includesBookedValue : link.includesRevenue === true;
+  return {
+    ...link,
+    includesBookedValue,
+    includesRevenue: includesBookedValue
+  };
+}
+var ManageApi = class {
+  constructor(apiBase, token) {
+    this.base = apiBase.replace(/\/+$/, "");
+    this.token = token;
+  }
+  /** Swap the Bearer token in place (SeatManager re-mints on 401). */
+  setToken(token) {
+    this.token = token;
+  }
+  auth(path, init = {}) {
+    const method = init.method ?? "GET";
+    const headers = { Authorization: `Bearer ${this.token}` };
+    let body;
+    if (init.body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      body = JSON.stringify(init.body);
+    }
+    return fetch(`${this.base}${path}`, { method, headers, body, credentials: "omit" }).then((r) => parse(r));
+  }
+  async authBlob(path) {
+    const res = await fetch(`${this.base}${path}`, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${this.token}` },
+      credentials: "omit"
+    });
+    if (!res.ok) await parse(res);
+    return res.blob();
+  }
+  // ---- realtime read ----
+  /** Event-pinned organizer geometry. A manage token is never sent to `/pub`. */
+  chart(key) {
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/chart`);
+  }
+  /** Authenticated bytes for an Event-scoped organizer chart asset. */
+  asset(key, asset) {
+    if (!/^[a-zA-Z0-9._-]+$/.test(asset)) {
+      return Promise.reject(new ManageApiError(404, "not_found", "not_found"));
+    }
+    return this.authBlob(
+      `/v1/events/${encodeURIComponent(key)}/assets/${encodeURIComponent(asset)}`
+    );
+  }
+  /**
+   * The ORGANIZER's seat map: physical state, token-authed.
+   *
+   * This used to read `/pub/events/:key/objects` with no credential, which
+   * answers with the BUYER projection — every unit the caller may not buy
+   * collapses to a neutral `blocked`. An anonymous caller may buy only Public
+   * sale inventory, so the cockpit rendered every channel-allocated seat as
+   * blocked and then computed its KPIs, sell-through and (worse) its
+   * block/unblock target sets from that. `/v1/events/:key/objects` returns the
+   * unprojected snapshot the control-room read model already trusts.
+   */
+  objects(key) {
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/objects`);
+  }
+  /**
+   * Exchange the manage token for a one-use organizer socket ticket.
+   *
+   * A browser `WebSocket` cannot send an Authorization header, so the socket's
+   * scope is established here, over ordinary HTTPS. Without it the DO treats a
+   * manager socket as an anonymous public buyer and projects its deltas — so a
+   * hold inside a private allocation is structurally suppressed and the map
+   * drifts away from the truth `objects()` just established.
+   *
+   * Tickets are single-redemption and expire in ~30s: mint one per connect.
+   */
+  subscribeTicket(key) {
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/subscribe-tickets`, { method: "POST" });
+  }
+  socketUrl(key) {
+    return `${this.base.replace(/^http/, "ws")}/pub/events/${encodeURIComponent(key)}/subscribe?surface=manager`;
+  }
+  // ---- inventory writes (token) ----
+  /** Take FREE seats off sale in one batched call. Optional `releaseAt` (epoch
+   *  ms, future) auto-returns them to sale; `reason` tags the block (M3 uses it).
+   *  Throws ManageApiError 409 (conflicts) if any seat was just taken. */
+  block(key, labels, opts = {}) {
+    const body = { labels };
+    if (typeof opts.releaseAt === "number") body.releaseAt = opts.releaseAt;
+    if (opts.reason) body.reason = opts.reason;
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/block`, { method: "POST", body });
+  }
+  /** Return specific blocked seats to sale (one batched call). */
+  unblock(key, labels) {
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/unblock`, { method: "POST", body: { labels } });
+  }
+  /** Return every blocked seat to sale; resolves with the freed count. */
+  unblockAll(key) {
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/unblock-all`, { method: "POST" });
+  }
+  /** Cancel bookings — return BOOKED seats to free (credit not refunded).
+   *  Guarded by the original booking reference. */
+  unbook(key, labels, bookingRef) {
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/unbook`, { method: "POST", body: { labels, bookingRef } });
+  }
+  /** Set (ms, clamped 1–60 min server-side) or clear (null) the hold TTL. */
+  setHoldTtl(key, holdTtlMs) {
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/hold-ttl`, { method: "POST", body: { holdTtlMs } });
+  }
+  // ---- Platform inventory booking history (token) ----
+  /** Inventory lifecycle by stable integrator bookingRef. Absent on Managed. */
+  bookings(key, query = {}) {
+    const params = new URLSearchParams();
+    if (query.q) params.set("q", query.q);
+    if (query.state) params.set("state", query.state);
+    if (query.cursor) params.set("cursor", query.cursor);
+    if (query.limit != null) params.set("limit", String(query.limit));
+    const qs = params.toString();
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/bookings${qs ? `?${qs}` : ""}`);
+  }
+  /** Exact configured-value snapshot plus book/replay/cancellation audit. */
+  booking(key, bookingRef) {
+    return this.auth(
+      `/v1/events/${encodeURIComponent(key)}/bookings/${encodeURIComponent(bookingRef)}`
+    );
+  }
+  /** Alias matching the server SDK vocabulary. */
+  listBookings(key, query = {}) {
+    return this.bookings(key, query);
+  }
+  /** Alias matching the server SDK vocabulary. */
+  retrieveBooking(key, bookingRef) {
+    return this.booking(key, bookingRef);
+  }
+  // ---- availability windows (token) ----
+  /** The organizer's current per section/zone availability windows (needs
+   *  `event:view`). Ids absent from `rules` are open / on sale. */
+  availability(key) {
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/availability`);
+  }
+  /** Replace the availability windows for a set of section/zone ids (needs
+   *  `event:block`). Ids absent from `rules` become open / on sale; a zone rule
+   *  cascades to its sections. The worker derives each id's seat labels, so
+   *  `labels` on the sent rules is best-effort. Resolves with the authoritative
+   *  effective `hidden` set (a due rule may fire at once) and the server-cleaned
+   *  `rules` map (fired timed/threshold windows dropped). */
+  setAvailability(key, rules) {
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/availability`, { method: "POST", body: { rules } });
+  }
+  // ---- sales channels (token, capability-gated) ----
+  // Reads need `event:channels:view`, mutations `event:channels:manage`.
+  // `event:block` grants NEITHER (spec §10), so a Block-only cockpit token gets
+  // a 403 here and Channels mode never renders.
+  /** Allocation list with exact per-channel counts. `includeArchived` adds the
+   *  read-only archived rows behind the rail's "Show archived" control. */
+  channels(key, opts = {}) {
+    const qs = opts.includeArchived ? "?includeArchived=1" : "";
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/channels${qs}`);
+  }
+  /** One page of the label → channel map that paints the allocation overlay.
+   *  Paged by label; follow `nextAfterLabel` until it is null. */
+  channelAllocation(key, opts = {}) {
+    const params = new URLSearchParams();
+    if (opts.afterLabel) params.set("afterLabel", opts.afterLabel);
+    if (opts.limit != null) params.set("limit", String(opts.limit));
+    const qs = params.toString();
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/channels/allocation${qs ? `?${qs}` : ""}`);
+  }
+  channelAudit(key, opts = {}) {
+    const params = new URLSearchParams();
+    if (opts.limit != null) params.set("limit", String(opts.limit));
+    if (opts.before != null) params.set("before", String(opts.before));
+    const qs = params.toString();
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/channels/audit${qs ? `?${qs}` : ""}`);
+  }
+  createChannel(key, input) {
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/channels`, { method: "POST", body: input });
+  }
+  renameChannel(key, channelId, name) {
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/channels/${encodeURIComponent(channelId)}`, {
+      method: "PATCH",
+      body: { name }
+    });
+  }
+  setChannelPaused(key, channelId, paused) {
+    const path = paused ? "pause" : "unpause";
+    return this.auth(
+      `/v1/events/${encodeURIComponent(key)}/channels/${encodeURIComponent(channelId)}/${path}`,
+      { method: "POST", body: {} }
+    );
+  }
+  /** Archive with a mandatory destination for the remaining allocation.
+   *  Throws ManageApiError 409 `channel_archive_blocked_by_holds` while any hold
+   *  is live; `err.details` carries the exact counts + retry window. */
+  archiveChannel(key, channelId, destination) {
+    return this.auth(
+      `/v1/events/${encodeURIComponent(key)}/channels/${encodeURIComponent(channelId)}/archive`,
+      { method: "POST", body: { destination } }
+    );
+  }
+  /**
+   * Versioned Apply. A stale `assignmentVersion` mutates NOTHING and throws
+   * ManageApiError 409 `channel_assignment_conflict` — the caller keeps its
+   * selection and offers "Refresh and review". There is no dry-run: the review
+   * sheet previews locally, this call returns the authoritative buckets.
+   */
+  applyChannelAssignment(key, input) {
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/channels/assignments`, {
+      method: "POST",
+      body: {
+        targetChannelId: input.targetChannelId || null,
+        labels: input.labels,
+        assignmentVersion: input.assignmentVersion
+      }
+    });
+  }
+  /**
+   * Read-only buyer projection for an audience (§8.6) — the SAME scoped server
+   * view the buyer SDK receives, never a local approximation.
+   *
+   * Ships on the access-hardening branch. Older workers 404/405 here; callers
+   * MUST feature-detect and quietly say the preview needs a newer server rather
+   * than faking a projection client-side.
+   */
+  channelPreview(key, channelIds, opts = {}) {
+    const params = new URLSearchParams();
+    if (channelIds.length) params.set("channelIds", channelIds.join(","));
+    if (opts.includePublic != null) params.set("includePublic", opts.includePublic ? "1" : "0");
+    const qs = params.toString();
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/channels/preview${qs ? `?${qs}` : ""}`);
+  }
+  /**
+   * Choose which sale route this channel opens.
+   *
+   * Since the server's 2026-08-06 change this is AUTHORIZATION, not a label:
+   * exactly one of the four routes may mint buyer access for the channel and the
+   * other three refuse with 409 `channel_access_intent_forbids`. The default is
+   * `none`, which refuses all four — so a route has to be declared before any
+   * buyer-facing action on the channel can succeed.
+   *
+   * Switching the route while buyers are already inside the current one is
+   * refused with 409 `channel_intent_switch_blocked`, whose `details` name what
+   * is live (`liveAccessLinks`, `activeSessions`). Retry with
+   * `acknowledgeLiveAccess: true`: hosted links on the channel are revoked,
+   * while sessions already minted keep their holds and drain on their own.
+   * `intentSwitch` is present on the response ONLY when the switch disturbed
+   * something, so the ordinary case stays the two-key body it has always been.
+   */
+  setChannelAccessIntent(key, channelId, accessIntent, opts = {}) {
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/channels/${encodeURIComponent(channelId)}`, {
+      method: "PATCH",
+      body: {
+        accessIntent,
+        ...opts.acknowledgeLiveAccess ? { acknowledgeLiveAccess: true } : {},
+        ...opts.reason ? { reason: opts.reason } : {}
+      }
+    });
+  }
+  // ---- hosted access links (M8) ----
+  /**
+   * Mint a hosted access link. The 201 is the ONE and ONLY time `url` and
+   * `capability` exist outside the buyer's browser — SeatLayer keeps a hash, so
+   * there is no route, cache, or support escalation that can produce this string
+   * again. Callers must reveal it immediately and then let it go.
+   *
+   * Every omitted field takes the server's default: expiry = when the event
+   * starts, 100 redemptions, 4 seats per buyer, this channel's allocation only.
+   * Platform bounds are enforced server-side and reported as 422 with the rule
+   * spelled out in `ManageApiError.serverMessage`.
+   *
+   * NOT a side effect any more. This used to SET the channel's access intent to
+   * `hosted_link`; since 2026-08-06 it REQUIRES it, and a channel declaring any
+   * other route refuses with 409 `channel_access_intent_forbids`. Callers must
+   * declare the route first — `ChannelsMode` does exactly that before it
+   * creates, so a first buyer link on a fresh channel is still one gesture.
+   */
+  createAccessLink(key, channelId, input = {}) {
+    return this.auth(
+      `/v1/events/${encodeURIComponent(key)}/channels/${encodeURIComponent(channelId)}/access-links`,
+      { method: "POST", body: input }
+    );
+  }
+  /** Status only — label, expiry, redemptions, per-buyer cap, lineage, and the
+   *  live session count. Never the url, never the capability. Needs `:view`. */
+  accessLinks(key, channelId) {
+    return this.auth(
+      `/v1/events/${encodeURIComponent(key)}/channels/${encodeURIComponent(channelId)}/access-links`
+    );
+  }
+  /**
+   * Rotate — the ONLY recovery for a link nobody kept. The old URL stops opening
+   * immediately and the response is a fresh one-time reveal.
+   *
+   * `endActiveSessions` is REQUIRED, not defaulted: the organizer must say
+   * whether buyers already inside finish their checkout or lose access now. The
+   * server answers 422 `end_active_sessions_required` if it is omitted, and that
+   * refusal is correct — a UI must not pick either branch on their behalf.
+   */
+  rotateAccessLink(key, channelId, linkId, endActiveSessions) {
+    return this.auth(
+      `/v1/events/${encodeURIComponent(key)}/channels/${encodeURIComponent(channelId)}/access-links/${encodeURIComponent(linkId)}/rotate`,
+      { method: "POST", body: { endActiveSessions } }
+    );
+  }
+  /** Revoke. The link stops opening immediately; `endActiveSessions` decides
+   *  whether the buyers already inside keep their sessions. */
+  revokeAccessLink(key, channelId, linkId, endActiveSessions = false) {
+    const qs = endActiveSessions ? "?endActiveSessions=1" : "";
+    return this.auth(
+      `/v1/events/${encodeURIComponent(key)}/channels/${encodeURIComponent(channelId)}/access-links/${encodeURIComponent(linkId)}${qs}`,
+      { method: "DELETE" }
+    );
+  }
+  // ---- reports (token) ----
+  report(key) {
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/report`).then(normalizeReportResult);
+  }
+  controlRoom(key, windowMinutes = 15) {
+    return this.auth(
+      `/v1/events/${encodeURIComponent(key)}/control-room?window=${windowMinutes}`
+    ).then(normalizeControlRoomSnapshot);
+  }
+  /** Allocation beside immutable booking-time channel attribution. */
+  channelReport(key) {
+    return this.auth(
+      `/v1/events/${encodeURIComponent(key)}/channels/report`
+    ).then(normalizeChannelReportResult);
+  }
+  createChannelReportLink(key, channelId, input = {}) {
+    return this.auth(
+      `/v1/events/${encodeURIComponent(key)}/channels/${encodeURIComponent(channelId)}/report-links`,
+      { method: "POST", body: input }
+    ).then((value) => {
+      const reveal = record(value);
+      return { ...reveal, link: normalizeChannelReportLink(reveal.link) };
+    });
+  }
+  channelReportLinks(key, channelId) {
+    return this.auth(
+      `/v1/events/${encodeURIComponent(key)}/channels/${encodeURIComponent(channelId)}/report-links`
+    ).then((value) => {
+      const result = record(value);
+      return {
+        links: Array.isArray(result.links) ? result.links.map(normalizeChannelReportLink) : []
+      };
+    });
+  }
+  revokeChannelReportLink(key, channelId, linkId) {
+    return this.auth(
+      `/v1/events/${encodeURIComponent(key)}/channels/${encodeURIComponent(channelId)}/report-links/${encodeURIComponent(linkId)}`,
+      { method: "DELETE" }
+    ).then((value) => {
+      const result = record(value);
+      return { ...result, link: normalizeChannelReportLink(result.link) };
+    });
+  }
+  log(key, opts = {}) {
+    const params = new URLSearchParams();
+    if (opts.limit != null) params.set("limit", String(opts.limit));
+    if (opts.before != null) params.set("before", String(opts.before));
+    const qs = params.toString();
+    return this.auth(`/v1/events/${encodeURIComponent(key)}/log${qs ? `?${qs}` : ""}`);
+  }
+  /** CSV report as a Blob (Bearer auth can't ride a plain <a href>). Host builds
+   *  an object URL for download. */
+  async reportCsv(key) {
+    const res = await fetch(`${this.base}/v1/events/${encodeURIComponent(key)}/report.csv`, {
+      headers: { Authorization: `Bearer ${this.token}` },
+      credentials: "omit"
+    });
+    if (!res.ok) throw new ManageApiError(res.status, `request_failed_${res.status}`);
+    return res.blob();
+  }
+};
+
 // src/channelsMode.ts
 var POLL_MS = 3e4;
 var MAX_FLAGS = 8;
@@ -3167,6 +3650,8 @@ var ChannelsMode = class {
 };
 
 export {
+  ManageApiError,
+  ManageApi,
   PUBLIC_CHANNEL_ID,
   PUBLIC_CHANNEL_NAME,
   isPublicChannelId,
@@ -3195,4 +3680,4 @@ export {
   bucketRowsHtml,
   ChannelsMode
 };
-//# sourceMappingURL=chunk-KNMZQZXR.js.map
+//# sourceMappingURL=chunk-5URCWBHM.js.map