@withpotter/lib 0.13.0-next.101

package/dist/api/bookings.js

@@ -0,0 +1,284 @@
+import { apiFetch, getAccountId, getApiUrl, getCsrfToken } from "./core";
+const bookingsApi = {
+  /**
+   * Create a new booking
+   */
+  create: (tenantSlug, data) => apiFetch("/bookings", {
+    method: "POST",
+    tenantSlug,
+    body: JSON.stringify(data)
+  }),
+  /**
+   * Create a walk-in booking (staff-created, auto-confirmed)
+   */
+  createWalkIn: (tenantSlug, data) => apiFetch("/bookings/walk-in", {
+    method: "POST",
+    tenantSlug,
+    body: JSON.stringify(data)
+  }),
+  createTestPurchase: (tenantSlug, data) => apiFetch(
+    "/bookings/test-purchase",
+    {
+      method: "POST",
+      tenantSlug,
+      body: JSON.stringify(data)
+    }
+  ),
+  eligibleResources: (tenantSlug, params) => {
+    const search = new URLSearchParams({
+      contentId: params.contentId,
+      date: params.date
+    });
+    if (params.startTime) search.set("startTime", params.startTime);
+    if (params.endTime) search.set("endTime", params.endTime);
+    return apiFetch(
+      `/bookings/eligible-resources?${search.toString()}`,
+      { tenantSlug }
+    );
+  },
+  /**
+   * List all bookings
+   */
+  list: (tenantSlug, params) => {
+    const searchParams = new URLSearchParams();
+    if (params?.status) {
+      const statuses = Array.isArray(params.status) ? params.status : [params.status];
+      statuses.forEach((s) => searchParams.append("status", s));
+    }
+    if (params?.type) {
+      const types = Array.isArray(params.type) ? params.type : [params.type];
+      types.forEach((t) => searchParams.append("type", t));
+    }
+    if (params?.contentId) searchParams.set("contentId", params.contentId);
+    if (params?.dateFrom) searchParams.set("dateFrom", params.dateFrom);
+    if (params?.dateTo) searchParams.set("dateTo", params.dateTo);
+    if (params?.page) searchParams.set("page", String(params.page));
+    if (params?.limit) searchParams.set("limit", String(params.limit));
+    if (params?.search) searchParams.set("search", params.search);
+    if (params?.memberId) searchParams.set("memberId", params.memberId);
+    if (params?.locationIds?.length)
+      searchParams.set("locationIds", params.locationIds.join(","));
+    if (params?.isPaid !== void 0)
+      searchParams.set("isPaid", String(params.isPaid));
+    if (params?.bookingMode) {
+      const bookingModes = Array.isArray(params.bookingMode) ? params.bookingMode : [params.bookingMode];
+      bookingModes.forEach((mode) => searchParams.append("bookingMode", mode));
+    }
+    if (params?.origin) searchParams.set("origin", params.origin);
+    if (params?.actorType) searchParams.set("actorType", params.actorType);
+    if (params?.sortBy) searchParams.set("sortBy", params.sortBy);
+    if (params?.sortOrder) searchParams.set("sortOrder", params.sortOrder);
+    const query = searchParams.toString() ? `?${searchParams.toString()}` : "";
+    return apiFetch(`/bookings${query}`, { tenantSlug });
+  },
+  /**
+   * Get a single booking by ID
+   */
+  get: (tenantSlug, id) => apiFetch(`/bookings/${id}`, { tenantSlug }),
+  initializePayment: (tenantSlug, id, data) => apiFetch(`/bookings/${id}/pay`, {
+    method: "POST",
+    tenantSlug,
+    body: JSON.stringify(data)
+  }),
+  /**
+   * Update a booking
+   */
+  update: (tenantSlug, id, data) => apiFetch(`/bookings/${id}`, {
+    method: "PUT",
+    tenantSlug,
+    body: JSON.stringify(data)
+  }),
+  /**
+   * Get booking stats
+   */
+  stats: (tenantSlug, dateFrom, dateTo, filters) => {
+    const searchParams = new URLSearchParams();
+    if (dateFrom) searchParams.set("dateFrom", dateFrom);
+    if (dateTo) searchParams.set("dateTo", dateTo);
+    if (filters?.type) {
+      const types = Array.isArray(filters.type) ? filters.type : [filters.type];
+      types.forEach((type) => searchParams.append("type", type));
+    }
+    if (filters?.bookingMode) {
+      const bookingModes = Array.isArray(filters.bookingMode) ? filters.bookingMode : [filters.bookingMode];
+      bookingModes.forEach((mode) => searchParams.append("bookingMode", mode));
+    }
+    const query = searchParams.toString() ? `?${searchParams.toString()}` : "";
+    return apiFetch(`/bookings/stats${query}`, { tenantSlug });
+  },
+  /**
+   * Confirm a booking
+   */
+  confirm: (tenantSlug, id) => apiFetch(`/bookings/${id}/confirm`, {
+    method: "PATCH",
+    tenantSlug,
+    body: JSON.stringify({})
+  }),
+  /**
+   * Complete a booking
+   */
+  complete: (tenantSlug, id) => apiFetch(`/bookings/${id}/complete`, {
+    method: "PATCH",
+    tenantSlug,
+    body: JSON.stringify({})
+  }),
+  /**
+   * Cancel a booking (updates status to cancelled)
+   */
+  cancel: (tenantSlug, id, reason) => apiFetch(`/bookings/${id}/cancel`, {
+    method: "PATCH",
+    tenantSlug,
+    body: JSON.stringify({ reason })
+  }),
+  /**
+   * Reschedule a booking
+   */
+  reschedule: (tenantSlug, id, data) => apiFetch(`/bookings/${id}/reschedule`, {
+    method: "PATCH",
+    tenantSlug,
+    body: JSON.stringify(data)
+  }),
+  /**
+   * Record a manual payment (cash / bank transfer / card) taken at the desk.
+   */
+  recordPayment: (tenantSlug, id, data) => apiFetch(`/bookings/${id}/payments/manual`, {
+    method: "POST",
+    tenantSlug,
+    body: JSON.stringify(data)
+  }),
+  recordManualPayment: (tenantSlug, id, data) => apiFetch(`/bookings/${id}/payments/manual`, {
+    method: "POST",
+    tenantSlug,
+    body: JSON.stringify(data)
+  }),
+  /**
+   * The booking's money picture (payments + refunds, totals).
+   */
+  getFinance: (tenantSlug, id) => apiFetch(`/bookings/${id}/finance`, { tenantSlug }),
+  /**
+   * Give the security deposit back at checkout, or keep it against damage.
+   * A release is a real refund through whichever payments collected it.
+   */
+  settleDeposit: (tenantSlug, id, data) => apiFetch(`/bookings/${id}/deposit/settle`, {
+    method: "POST",
+    tenantSlug,
+    body: JSON.stringify(data)
+  }),
+  /**
+   * The group/split state of a booking (participants + who has paid).
+   */
+  getSplit: (tenantSlug, id) => apiFetch(`/bookings/${id}/split`, { tenantSlug }),
+  /**
+   * Refund a specific payment transaction on the booking.
+   */
+  refund: (tenantSlug, id, data) => apiFetch(`/bookings/${id}/refunds`, {
+    method: "POST",
+    tenantSlug,
+    body: JSON.stringify(data)
+  }),
+  refundPayment: (tenantSlug, id, data) => apiFetch(`/bookings/${id}/refunds`, {
+    method: "POST",
+    tenantSlug,
+    body: JSON.stringify(data)
+  }),
+  /**
+   * Check-in a booking
+   */
+  checkIn: (tenantSlug, id) => apiFetch(`/bookings/${id}/check-in`, {
+    method: "PATCH",
+    tenantSlug
+  }),
+  /**
+   * Mark booking as no-show
+   */
+  noShow: (tenantSlug, id) => apiFetch(`/bookings/${id}/no-show`, {
+    method: "PATCH",
+    tenantSlug
+  }),
+  /**
+   * Free slots for one resource across a date range.
+   *
+   * The engine already refuses overlapping bookings with a 409
+   * (create-booking.usecase checks `hasConflict`), so a form that asks for a
+   * time as free text is a form that finds out by being rejected. This is the
+   * lookup that lets staff pick from what is actually open.
+   *
+   * `resourceId` is required by GetAvailabilityDto, so callers with no resource
+   * selected have nothing to ask about and should fall back to manual entry.
+   */
+  availability: (tenantSlug, params) => {
+    const searchParams = new URLSearchParams({
+      resourceId: params.resourceId,
+      dateFrom: params.dateFrom,
+      dateTo: params.dateTo
+    });
+    if (params.serviceId) searchParams.set("serviceId", params.serviceId);
+    if (params.duration) searchParams.set("duration", String(params.duration));
+    if (params.partySize)
+      searchParams.set("partySize", String(params.partySize));
+    return apiFetch(
+      `/bookings/availability?${searchParams.toString()}`,
+      { tenantSlug }
+    );
+  },
+  /**
+   * Export bookings as CSV
+   */
+  exportCsv: (tenantSlug, params) => {
+    const searchParams = new URLSearchParams();
+    if (params?.contentId) searchParams.set("contentId", params.contentId);
+    if (params?.type) searchParams.set("type", params.type);
+    if (params?.status) searchParams.set("status", params.status);
+    if (params?.dateFrom) searchParams.set("dateFrom", params.dateFrom);
+    if (params?.dateTo) searchParams.set("dateTo", params.dateTo);
+    const query = searchParams.toString() ? `?${searchParams.toString()}` : "";
+    return apiFetch(`/bookings/export${query}`, {
+      tenantSlug,
+      headers: { Accept: "text/csv" }
+    });
+  },
+  scanTicket: (tenantSlug, ticketCode) => apiFetch("/bookings/scan", {
+    method: "POST",
+    tenantSlug,
+    body: JSON.stringify({ ticketCode })
+  }),
+  lookupByTicketCode: (tenantSlug, ticketCode) => apiFetch(
+    `/bookings/by-code/${encodeURIComponent(ticketCode)}`,
+    {
+      tenantSlug
+    }
+  ),
+  getTickets: (tenantSlug, bookingId) => apiFetch(`/bookings/${bookingId}/tickets`, {
+    tenantSlug
+  }),
+  getTicketsPdfUrl: (tenantSlug, bookingId) => `/api/${tenantSlug}/bookings/${bookingId}/tickets/pdf`,
+  downloadTicketsPdf: async (tenantSlug, bookingId) => downloadTicketPdf(`/bookings/${bookingId}/tickets/pdf`, tenantSlug),
+  getSingleTicketPdfUrl: (tenantSlug, bookingId, ticketId) => `/api/${tenantSlug}/bookings/${bookingId}/tickets/${ticketId}/pdf`,
+  downloadSingleTicketPdf: async (tenantSlug, bookingId, ticketId) => downloadTicketPdf(
+    `/bookings/${bookingId}/tickets/${ticketId}/pdf`,
+    tenantSlug
+  )
+};
+async function downloadTicketPdf(endpoint, tenantSlug) {
+  const headers = {};
+  if (tenantSlug) headers["X-Tenant-Slug"] = tenantSlug;
+  const accountId = getAccountId();
+  if (accountId) headers["x-account-id"] = accountId;
+  const csrfToken = getCsrfToken();
+  if (csrfToken) headers["X-CSRF-Token"] = csrfToken;
+  const response = await fetch(`${getApiUrl()}${endpoint}`, {
+    headers,
+    credentials: "include"
+  });
+  if (!response.ok) {
+    const errorBody = await response.json().catch(() => null);
+    throw new Error(
+      errorBody?.message || `Failed to download ticket PDF (${response.status})`
+    );
+  }
+  return response.blob();
+}
+export {
+  bookingsApi
+};
+//# sourceMappingURL=bookings.js.map

package/dist/api/bookings.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/bookings.ts"],"sourcesContent":["import { apiFetch, getAccountId, getApiUrl, getCsrfToken } from './core';\nimport type {\n  BookingItem,\n  BookingListResponse,\n  TicketItem,\n  CreateBookingInput,\n  BookingFinanceEntry,\n  BookingFinance,\n  SplitBooking,\n  AvailabilityResponse,\n  BookingResourceRequirement,\n  TicketScanResponse,\n} from './types';\n\nexport const bookingsApi = {\n  /**\n   * Create a new booking\n   */\n  create: (tenantSlug: string, data: CreateBookingInput) =>\n    apiFetch<BookingItem>('/bookings', {\n      method: 'POST',\n      tenantSlug,\n      body: JSON.stringify(data),\n    }),\n\n  /**\n   * Create a walk-in booking (staff-created, auto-confirmed)\n   */\n  createWalkIn: (tenantSlug: string, data: CreateBookingInput) =>\n    apiFetch<BookingItem>('/bookings/walk-in', {\n      method: 'POST',\n      tenantSlug,\n      body: JSON.stringify(data),\n    }),\n\n  createTestPurchase: (tenantSlug: string, data: CreateBookingInput) =>\n    apiFetch<{ booking: BookingItem; finance: BookingFinance }>(\n      '/bookings/test-purchase',\n      {\n        method: 'POST',\n        tenantSlug,\n        body: JSON.stringify(data),\n      },\n    ),\n\n  eligibleResources: (\n    tenantSlug: string,\n    params: {\n      contentId: string;\n      date: string;\n      startTime?: string;\n      endTime?: string;\n    },\n  ) => {\n    const search = new URLSearchParams({\n      contentId: params.contentId,\n      date: params.date,\n    });\n    if (params.startTime) search.set('startTime', params.startTime);\n    if (params.endTime) search.set('endTime', params.endTime);\n    return apiFetch<BookingResourceRequirement[]>(\n      `/bookings/eligible-resources?${search.toString()}`,\n      { tenantSlug },\n    );\n  },\n\n  /**\n   * List all bookings\n   */\n  list: (\n    tenantSlug: string,\n    params?: {\n      status?: string | string[];\n      type?: string | string[];\n      contentId?: string;\n      dateFrom?: string;\n      dateTo?: string;\n      page?: number;\n      limit?: number;\n      search?: string;\n      memberId?: string;\n      isPaid?: boolean;\n      bookingMode?: string | string[];\n      origin?: string;\n      actorType?: string;\n      /** Which column to order by. The API defaults to the booking's date. */\n      sortBy?: string;\n      /**\n       * Which way to read the list. The API defaults to `DESC` — newest first,\n       * right for a list of what has happened. A list of what is coming reads\n       * the other way: the next appointment belongs at the top.\n       */\n      sortOrder?: 'ASC' | 'DESC';\n      /**\n       * Which branches. Matched through the resource's location, since a\n       * booking has no branch of its own. Omit for every branch.\n       */\n      locationIds?: string[];\n    },\n  ) => {\n    const searchParams = new URLSearchParams();\n    if (params?.status) {\n      const statuses = Array.isArray(params.status)\n        ? params.status\n        : [params.status];\n      statuses.forEach((s) => searchParams.append('status', s));\n    }\n    if (params?.type) {\n      const types = Array.isArray(params.type) ? params.type : [params.type];\n      types.forEach((t) => searchParams.append('type', t));\n    }\n    if (params?.contentId) searchParams.set('contentId', params.contentId);\n    if (params?.dateFrom) searchParams.set('dateFrom', params.dateFrom);\n    if (params?.dateTo) searchParams.set('dateTo', params.dateTo);\n    if (params?.page) searchParams.set('page', String(params.page));\n    if (params?.limit) searchParams.set('limit', String(params.limit));\n    if (params?.search) searchParams.set('search', params.search);\n    if (params?.memberId) searchParams.set('memberId', params.memberId);\n    if (params?.locationIds?.length)\n      searchParams.set('locationIds', params.locationIds.join(','));\n    if (params?.isPaid !== undefined)\n      searchParams.set('isPaid', String(params.isPaid));\n    if (params?.bookingMode) {\n      const bookingModes = Array.isArray(params.bookingMode)\n        ? params.bookingMode\n        : [params.bookingMode];\n      bookingModes.forEach((mode) => searchParams.append('bookingMode', mode));\n    }\n    if (params?.origin) searchParams.set('origin', params.origin);\n    if (params?.actorType) searchParams.set('actorType', params.actorType);\n    if (params?.sortBy) searchParams.set('sortBy', params.sortBy);\n    if (params?.sortOrder) searchParams.set('sortOrder', params.sortOrder);\n    const query = searchParams.toString() ? `?${searchParams.toString()}` : '';\n    return apiFetch<BookingListResponse>(`/bookings${query}`, { tenantSlug });\n  },\n\n  /**\n   * Get a single booking by ID\n   */\n  get: (tenantSlug: string, id: string) =>\n    apiFetch<BookingItem>(`/bookings/${id}`, { tenantSlug }),\n\n  initializePayment: (\n    tenantSlug: string,\n    id: string,\n    data: { email: string; amount: number; callbackUrl?: string },\n  ) =>\n    apiFetch<{\n      authorizationUrl: string;\n      accessCode: string;\n      reference: string;\n    }>(`/bookings/${id}/pay`, {\n      method: 'POST',\n      tenantSlug,\n      body: JSON.stringify(data),\n    }),\n  /**\n   * Update a booking\n   */\n  update: (tenantSlug: string, id: string, data: Partial<BookingItem>) =>\n    apiFetch<BookingItem>(`/bookings/${id}`, {\n      method: 'PUT',\n      tenantSlug,\n      body: JSON.stringify(data),\n    }),\n\n  /**\n   * Get booking stats\n   */\n  stats: (\n    tenantSlug: string,\n    dateFrom?: string,\n    dateTo?: string,\n    filters?: {\n      type?: string | string[];\n      bookingMode?: string | string[];\n    },\n  ) => {\n    const searchParams = new URLSearchParams();\n    if (dateFrom) searchParams.set('dateFrom', dateFrom);\n    if (dateTo) searchParams.set('dateTo', dateTo);\n    if (filters?.type) {\n      const types = Array.isArray(filters.type) ? filters.type : [filters.type];\n      types.forEach((type) => searchParams.append('type', type));\n    }\n    if (filters?.bookingMode) {\n      const bookingModes = Array.isArray(filters.bookingMode)\n        ? filters.bookingMode\n        : [filters.bookingMode];\n      bookingModes.forEach((mode) => searchParams.append('bookingMode', mode));\n    }\n    const query = searchParams.toString() ? `?${searchParams.toString()}` : '';\n    return apiFetch<{\n      total: number;\n      today: number;\n      revenue: number;\n      byStatus: Record<string, number>;\n      byType: Record<string, number>;\n    }>(`/bookings/stats${query}`, { tenantSlug });\n  },\n\n  /**\n   * Confirm a booking\n   */\n  confirm: (tenantSlug: string, id: string) =>\n    apiFetch<BookingItem>(`/bookings/${id}/confirm`, {\n      method: 'PATCH',\n      tenantSlug,\n      body: JSON.stringify({}),\n    }),\n\n  /**\n   * Complete a booking\n   */\n  complete: (tenantSlug: string, id: string) =>\n    apiFetch<BookingItem>(`/bookings/${id}/complete`, {\n      method: 'PATCH',\n      tenantSlug,\n      body: JSON.stringify({}),\n    }),\n\n  /**\n   * Cancel a booking (updates status to cancelled)\n   */\n  cancel: (tenantSlug: string, id: string, reason?: string) =>\n    apiFetch<BookingItem>(`/bookings/${id}/cancel`, {\n      method: 'PATCH',\n      tenantSlug,\n      body: JSON.stringify({ reason }),\n    }),\n\n  /**\n   * Reschedule a booking\n   */\n  reschedule: (\n    tenantSlug: string,\n    id: string,\n    data: {\n      date: string;\n      contentId?: string;\n      startTime: string;\n      endTime?: string;\n      resourceId?: string;\n      reason?: string;\n      overrideCapacity?: boolean;\n    },\n  ) =>\n    apiFetch<BookingItem>(`/bookings/${id}/reschedule`, {\n      method: 'PATCH',\n      tenantSlug,\n      body: JSON.stringify(data),\n    }),\n\n  /**\n   * Record a manual payment (cash / bank transfer / card) taken at the desk.\n   */\n  recordPayment: (\n    tenantSlug: string,\n    id: string,\n    data: {\n      amount: number;\n      /**\n       * `loyalty` is points settling a bill. Not a method the customer chose\n       * so much as money they had already earned, but it clears a balance\n       * exactly like one — and without it a redemption could not be recorded\n       * against the thing it discounted.\n       */\n      channel: 'cash' | 'card' | 'bank_transfer' | 'loyalty';\n      note?: string;\n    },\n  ) =>\n    apiFetch<BookingItem>(`/bookings/${id}/payments/manual`, {\n      method: 'POST',\n      tenantSlug,\n      body: JSON.stringify(data),\n    }),\n\n  recordManualPayment: (\n    tenantSlug: string,\n    id: string,\n    data: {\n      amount: number;\n      channel: 'cash' | 'card' | 'bank_transfer' | 'loyalty';\n      note?: string;\n    },\n  ) =>\n    apiFetch<BookingFinanceEntry>(`/bookings/${id}/payments/manual`, {\n      method: 'POST',\n      tenantSlug,\n      body: JSON.stringify(data),\n    }),\n\n  /**\n   * The booking's money picture (payments + refunds, totals).\n   */\n  getFinance: (tenantSlug: string, id: string) =>\n    apiFetch<BookingFinance>(`/bookings/${id}/finance`, { tenantSlug }),\n\n  /**\n   * Give the security deposit back at checkout, or keep it against damage.\n   * A release is a real refund through whichever payments collected it.\n   */\n  settleDeposit: (\n    tenantSlug: string,\n    id: string,\n    data: { action: 'release' | 'forfeit'; amount?: number; reason?: string },\n  ) =>\n    apiFetch<BookingFinance>(`/bookings/${id}/deposit/settle`, {\n      method: 'POST',\n      tenantSlug,\n      body: JSON.stringify(data),\n    }),\n\n  /**\n   * The group/split state of a booking (participants + who has paid).\n   */\n  getSplit: (tenantSlug: string, id: string) =>\n    apiFetch<SplitBooking>(`/bookings/${id}/split`, { tenantSlug }),\n\n  /**\n   * Refund a specific payment transaction on the booking.\n   */\n  refund: (\n    tenantSlug: string,\n    id: string,\n    data: { transactionId: string; amount: number; reason?: string },\n  ) =>\n    apiFetch<BookingFinanceEntry>(`/bookings/${id}/refunds`, {\n      method: 'POST',\n      tenantSlug,\n      body: JSON.stringify(data),\n    }),\n\n  refundPayment: (\n    tenantSlug: string,\n    id: string,\n    data: { transactionId: string; amount: number; reason?: string },\n  ) =>\n    apiFetch<BookingFinanceEntry>(`/bookings/${id}/refunds`, {\n      method: 'POST',\n      tenantSlug,\n      body: JSON.stringify(data),\n    }),\n\n  /**\n   * Check-in a booking\n   */\n  checkIn: (tenantSlug: string, id: string) =>\n    apiFetch<BookingItem>(`/bookings/${id}/check-in`, {\n      method: 'PATCH',\n      tenantSlug,\n    }),\n\n  /**\n   * Mark booking as no-show\n   */\n  noShow: (tenantSlug: string, id: string) =>\n    apiFetch<BookingItem>(`/bookings/${id}/no-show`, {\n      method: 'PATCH',\n      tenantSlug,\n    }),\n\n  /**\n   * Free slots for one resource across a date range.\n   *\n   * The engine already refuses overlapping bookings with a 409\n   * (create-booking.usecase checks `hasConflict`), so a form that asks for a\n   * time as free text is a form that finds out by being rejected. This is the\n   * lookup that lets staff pick from what is actually open.\n   *\n   * `resourceId` is required by GetAvailabilityDto, so callers with no resource\n   * selected have nothing to ask about and should fall back to manual entry.\n   */\n  availability: (\n    tenantSlug: string,\n    params: {\n      resourceId: string;\n      dateFrom: string;\n      dateTo: string;\n      serviceId?: string;\n      duration?: number;\n      partySize?: number;\n    },\n  ) => {\n    const searchParams = new URLSearchParams({\n      resourceId: params.resourceId,\n      dateFrom: params.dateFrom,\n      dateTo: params.dateTo,\n    });\n    if (params.serviceId) searchParams.set('serviceId', params.serviceId);\n    if (params.duration) searchParams.set('duration', String(params.duration));\n    if (params.partySize)\n      searchParams.set('partySize', String(params.partySize));\n    return apiFetch<AvailabilityResponse>(\n      `/bookings/availability?${searchParams.toString()}`,\n      { tenantSlug },\n    );\n  },\n\n  /**\n   * Export bookings as CSV\n   */\n  exportCsv: (\n    tenantSlug: string,\n    params?: {\n      contentId?: string;\n      type?: string;\n      status?: string;\n      dateFrom?: string;\n      dateTo?: string;\n    },\n  ) => {\n    const searchParams = new URLSearchParams();\n    if (params?.contentId) searchParams.set('contentId', params.contentId);\n    if (params?.type) searchParams.set('type', params.type);\n    if (params?.status) searchParams.set('status', params.status);\n    if (params?.dateFrom) searchParams.set('dateFrom', params.dateFrom);\n    if (params?.dateTo) searchParams.set('dateTo', params.dateTo);\n    const query = searchParams.toString() ? `?${searchParams.toString()}` : '';\n    return apiFetch<string>(`/bookings/export${query}`, {\n      tenantSlug,\n      headers: { Accept: 'text/csv' },\n    });\n  },\n\n  scanTicket: (tenantSlug: string, ticketCode: string) =>\n    apiFetch<TicketScanResponse>('/bookings/scan', {\n      method: 'POST',\n      tenantSlug,\n      body: JSON.stringify({ ticketCode }),\n    }),\n\n  lookupByTicketCode: (tenantSlug: string, ticketCode: string) =>\n    apiFetch<BookingItem>(\n      `/bookings/by-code/${encodeURIComponent(ticketCode)}`,\n      {\n        tenantSlug,\n      },\n    ),\n\n  getTickets: (tenantSlug: string, bookingId: string) =>\n    apiFetch<TicketItem[]>(`/bookings/${bookingId}/tickets`, {\n      tenantSlug,\n    }),\n\n  getTicketsPdfUrl: (tenantSlug: string, bookingId: string) =>\n    `/api/${tenantSlug}/bookings/${bookingId}/tickets/pdf`,\n\n  downloadTicketsPdf: async (tenantSlug: string, bookingId: string) =>\n    downloadTicketPdf(`/bookings/${bookingId}/tickets/pdf`, tenantSlug),\n\n  getSingleTicketPdfUrl: (\n    tenantSlug: string,\n    bookingId: string,\n    ticketId: string,\n  ) => `/api/${tenantSlug}/bookings/${bookingId}/tickets/${ticketId}/pdf`,\n\n  downloadSingleTicketPdf: async (\n    tenantSlug: string,\n    bookingId: string,\n    ticketId: string,\n  ) =>\n    downloadTicketPdf(\n      `/bookings/${bookingId}/tickets/${ticketId}/pdf`,\n      tenantSlug,\n    ),\n};\n\nasync function downloadTicketPdf(endpoint: string, tenantSlug: string) {\n  const headers: Record<string, string> = {};\n  if (tenantSlug) headers['X-Tenant-Slug'] = tenantSlug;\n\n  const accountId = getAccountId();\n  if (accountId) headers['x-account-id'] = accountId;\n\n  const csrfToken = getCsrfToken();\n  if (csrfToken) headers['X-CSRF-Token'] = csrfToken;\n\n  const response = await fetch(`${getApiUrl()}${endpoint}`, {\n    headers,\n    credentials: 'include',\n  });\n  if (!response.ok) {\n    const errorBody = await response.json().catch(() => null);\n    throw new Error(\n      errorBody?.message ||\n        `Failed to download ticket PDF (${response.status})`,\n    );\n  }\n  return response.blob();\n}\n\n// ============================================\n// RESOURCES API (Therapists, Rooms, etc.)\n// ============================================\n"],"mappings":"AAAA,SAAS,UAAU,cAAc,WAAW,oBAAoB;AAczD,MAAM,cAAc;AAAA;AAAA;AAAA;AAAA,EAIzB,QAAQ,CAAC,YAAoB,SAC3B,SAAsB,aAAa;AAAA,IACjC,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,cAAc,CAAC,YAAoB,SACjC,SAAsB,qBAAqB;AAAA,IACzC,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA,EAEH,oBAAoB,CAAC,YAAoB,SACvC;AAAA,IACE;AAAA,IACA;AAAA,MACE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B;AAAA,EACF;AAAA,EAEF,mBAAmB,CACjB,YACA,WAMG;AACH,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,OAAO;AAAA,MAClB,MAAM,OAAO;AAAA,IACf,CAAC;AACD,QAAI,OAAO,UAAW,QAAO,IAAI,aAAa,OAAO,SAAS;AAC9D,QAAI,OAAO,QAAS,QAAO,IAAI,WAAW,OAAO,OAAO;AACxD,WAAO;AAAA,MACL,gCAAgC,OAAO,SAAS,CAAC;AAAA,MACjD,EAAE,WAAW;AAAA,IACf;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,CACJ,YACA,WA4BG;AACH,UAAM,eAAe,IAAI,gBAAgB;AACzC,QAAI,QAAQ,QAAQ;AAClB,YAAM,WAAW,MAAM,QAAQ,OAAO,MAAM,IACxC,OAAO,SACP,CAAC,OAAO,MAAM;AAClB,eAAS,QAAQ,CAAC,MAAM,aAAa,OAAO,UAAU,CAAC,CAAC;AAAA,IAC1D;AACA,QAAI,QAAQ,MAAM;AAChB,YAAM,QAAQ,MAAM,QAAQ,OAAO,IAAI,IAAI,OAAO,OAAO,CAAC,OAAO,IAAI;AACrE,YAAM,QAAQ,CAAC,MAAM,aAAa,OAAO,QAAQ,CAAC,CAAC;AAAA,IACrD;AACA,QAAI,QAAQ,UAAW,cAAa,IAAI,aAAa,OAAO,SAAS;AACrE,QAAI,QAAQ,SAAU,cAAa,IAAI,YAAY,OAAO,QAAQ;AAClE,QAAI,QAAQ,OAAQ,cAAa,IAAI,UAAU,OAAO,MAAM;AAC5D,QAAI,QAAQ,KAAM,cAAa,IAAI,QAAQ,OAAO,OAAO,IAAI,CAAC;AAC9D,QAAI,QAAQ,MAAO,cAAa,IAAI,SAAS,OAAO,OAAO,KAAK,CAAC;AACjE,QAAI,QAAQ,OAAQ,cAAa,IAAI,UAAU,OAAO,MAAM;AAC5D,QAAI,QAAQ,SAAU,cAAa,IAAI,YAAY,OAAO,QAAQ;AAClE,QAAI,QAAQ,aAAa;AACvB,mBAAa,IAAI,eAAe,OAAO,YAAY,KAAK,GAAG,CAAC;AAC9D,QAAI,QAAQ,WAAW;AACrB,mBAAa,IAAI,UAAU,OAAO,OAAO,MAAM,CAAC;AAClD,QAAI,QAAQ,aAAa;AACvB,YAAM,eAAe,MAAM,QAAQ,OAAO,WAAW,IACjD,OAAO,cACP,CAAC,OAAO,WAAW;AACvB,mBAAa,QAAQ,CAAC,SAAS,aAAa,OAAO,eAAe,IAAI,CAAC;AAAA,IACzE;AACA,QAAI,QAAQ,OAAQ,cAAa,IAAI,UAAU,OAAO,MAAM;AAC5D,QAAI,QAAQ,UAAW,cAAa,IAAI,aAAa,OAAO,SAAS;AACrE,QAAI,QAAQ,OAAQ,cAAa,IAAI,UAAU,OAAO,MAAM;AAC5D,QAAI,QAAQ,UAAW,cAAa,IAAI,aAAa,OAAO,SAAS;AACrE,UAAM,QAAQ,aAAa,SAAS,IAAI,IAAI,aAAa,SAAS,CAAC,KAAK;AACxE,WAAO,SAA8B,YAAY,KAAK,IAAI,EAAE,WAAW,CAAC;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKA,KAAK,CAAC,YAAoB,OACxB,SAAsB,aAAa,EAAE,IAAI,EAAE,WAAW,CAAC;AAAA,EAEzD,mBAAmB,CACjB,YACA,IACA,SAEA,SAIG,aAAa,EAAE,QAAQ;AAAA,IACxB,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA;AAAA;AAAA;AAAA,EAIH,QAAQ,CAAC,YAAoB,IAAY,SACvC,SAAsB,aAAa,EAAE,IAAI;AAAA,IACvC,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,OAAO,CACL,YACA,UACA,QACA,YAIG;AACH,UAAM,eAAe,IAAI,gBAAgB;AACzC,QAAI,SAAU,cAAa,IAAI,YAAY,QAAQ;AACnD,QAAI,OAAQ,cAAa,IAAI,UAAU,MAAM;AAC7C,QAAI,SAAS,MAAM;AACjB,YAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,IAAI,QAAQ,OAAO,CAAC,QAAQ,IAAI;AACxE,YAAM,QAAQ,CAAC,SAAS,aAAa,OAAO,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,QAAI,SAAS,aAAa;AACxB,YAAM,eAAe,MAAM,QAAQ,QAAQ,WAAW,IAClD,QAAQ,cACR,CAAC,QAAQ,WAAW;AACxB,mBAAa,QAAQ,CAAC,SAAS,aAAa,OAAO,eAAe,IAAI,CAAC;AAAA,IACzE;AACA,UAAM,QAAQ,aAAa,SAAS,IAAI,IAAI,aAAa,SAAS,CAAC,KAAK;AACxE,WAAO,SAMJ,kBAAkB,KAAK,IAAI,EAAE,WAAW,CAAC;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAKA,SAAS,CAAC,YAAoB,OAC5B,SAAsB,aAAa,EAAE,YAAY;AAAA,IAC/C,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,CAAC,CAAC;AAAA,EACzB,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,UAAU,CAAC,YAAoB,OAC7B,SAAsB,aAAa,EAAE,aAAa;AAAA,IAChD,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,CAAC,CAAC;AAAA,EACzB,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,QAAQ,CAAC,YAAoB,IAAY,WACvC,SAAsB,aAAa,EAAE,WAAW;AAAA,IAC9C,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC;AAAA,EACjC,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,YAAY,CACV,YACA,IACA,SAUA,SAAsB,aAAa,EAAE,eAAe;AAAA,IAClD,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,eAAe,CACb,YACA,IACA,SAYA,SAAsB,aAAa,EAAE,oBAAoB;AAAA,IACvD,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA,EAEH,qBAAqB,CACnB,YACA,IACA,SAMA,SAA8B,aAAa,EAAE,oBAAoB;AAAA,IAC/D,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,YAAY,CAAC,YAAoB,OAC/B,SAAyB,aAAa,EAAE,YAAY,EAAE,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMpE,eAAe,CACb,YACA,IACA,SAEA,SAAyB,aAAa,EAAE,mBAAmB;AAAA,IACzD,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,UAAU,CAAC,YAAoB,OAC7B,SAAuB,aAAa,EAAE,UAAU,EAAE,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA,EAKhE,QAAQ,CACN,YACA,IACA,SAEA,SAA8B,aAAa,EAAE,YAAY;AAAA,IACvD,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA,EAEH,eAAe,CACb,YACA,IACA,SAEA,SAA8B,aAAa,EAAE,YAAY;AAAA,IACvD,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,SAAS,CAAC,YAAoB,OAC5B,SAAsB,aAAa,EAAE,aAAa;AAAA,IAChD,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,QAAQ,CAAC,YAAoB,OAC3B,SAAsB,aAAa,EAAE,YAAY;AAAA,IAC/C,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaH,cAAc,CACZ,YACA,WAQG;AACH,UAAM,eAAe,IAAI,gBAAgB;AAAA,MACvC,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO;AAAA,MACjB,QAAQ,OAAO;AAAA,IACjB,CAAC;AACD,QAAI,OAAO,UAAW,cAAa,IAAI,aAAa,OAAO,SAAS;AACpE,QAAI,OAAO,SAAU,cAAa,IAAI,YAAY,OAAO,OAAO,QAAQ,CAAC;AACzE,QAAI,OAAO;AACT,mBAAa,IAAI,aAAa,OAAO,OAAO,SAAS,CAAC;AACxD,WAAO;AAAA,MACL,0BAA0B,aAAa,SAAS,CAAC;AAAA,MACjD,EAAE,WAAW;AAAA,IACf;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,WAAW,CACT,YACA,WAOG;AACH,UAAM,eAAe,IAAI,gBAAgB;AACzC,QAAI,QAAQ,UAAW,cAAa,IAAI,aAAa,OAAO,SAAS;AACrE,QAAI,QAAQ,KAAM,cAAa,IAAI,QAAQ,OAAO,IAAI;AACtD,QAAI,QAAQ,OAAQ,cAAa,IAAI,UAAU,OAAO,MAAM;AAC5D,QAAI,QAAQ,SAAU,cAAa,IAAI,YAAY,OAAO,QAAQ;AAClE,QAAI,QAAQ,OAAQ,cAAa,IAAI,UAAU,OAAO,MAAM;AAC5D,UAAM,QAAQ,aAAa,SAAS,IAAI,IAAI,aAAa,SAAS,CAAC,KAAK;AACxE,WAAO,SAAiB,mBAAmB,KAAK,IAAI;AAAA,MAClD;AAAA,MACA,SAAS,EAAE,QAAQ,WAAW;AAAA,IAChC,CAAC;AAAA,EACH;AAAA,EAEA,YAAY,CAAC,YAAoB,eAC/B,SAA6B,kBAAkB;AAAA,IAC7C,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,EAAE,WAAW,CAAC;AAAA,EACrC,CAAC;AAAA,EAEH,oBAAoB,CAAC,YAAoB,eACvC;AAAA,IACE,qBAAqB,mBAAmB,UAAU,CAAC;AAAA,IACnD;AAAA,MACE;AAAA,IACF;AAAA,EACF;AAAA,EAEF,YAAY,CAAC,YAAoB,cAC/B,SAAuB,aAAa,SAAS,YAAY;AAAA,IACvD;AAAA,EACF,CAAC;AAAA,EAEH,kBAAkB,CAAC,YAAoB,cACrC,QAAQ,UAAU,aAAa,SAAS;AAAA,EAE1C,oBAAoB,OAAO,YAAoB,cAC7C,kBAAkB,aAAa,SAAS,gBAAgB,UAAU;AAAA,EAEpE,uBAAuB,CACrB,YACA,WACA,aACG,QAAQ,UAAU,aAAa,SAAS,YAAY,QAAQ;AAAA,EAEjE,yBAAyB,OACvB,YACA,WACA,aAEA;AAAA,IACE,aAAa,SAAS,YAAY,QAAQ;AAAA,IAC1C;AAAA,EACF;AACJ;AAEA,eAAe,kBAAkB,UAAkB,YAAoB;AACrE,QAAM,UAAkC,CAAC;AACzC,MAAI,WAAY,SAAQ,eAAe,IAAI;AAE3C,QAAM,YAAY,aAAa;AAC/B,MAAI,UAAW,SAAQ,cAAc,IAAI;AAEzC,QAAM,YAAY,aAAa;AAC/B,MAAI,UAAW,SAAQ,cAAc,IAAI;AAEzC,QAAM,WAAW,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,QAAQ,IAAI;AAAA,IACxD;AAAA,IACA,aAAa;AAAA,EACf,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,YAAY,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACxD,UAAM,IAAI;AAAA,MACR,WAAW,WACT,kCAAkC,SAAS,MAAM;AAAA,IACrD;AAAA,EACF;AACA,SAAO,SAAS,KAAK;AACvB;","names":[]}

package/dist/api/business-devices.d.ts

@@ -0,0 +1,108 @@
+import type { BusinessDevice, DeviceProfile, DeviceOperatorAccess, DeviceOperators, PosPermissions, BusinessDeviceKind, BusinessDeviceStatus, BusinessDeviceConfig, DeviceEnrolmentPreview, LinkedDevice } from './types';
+/**
+ * The business's own hardware.
+ *
+ * Deliberately not `devicesApi`, which already exists and means something else
+ * entirely — which browsers an *account* has signed in from. Sharing the word
+ * would eventually put somebody's laptop in a list of card terminals.
+ */
+export declare const businessDevicesApi: {
+    list: (tenantSlug: string) => Promise<{
+        devices: BusinessDevice[];
+    }>;
+    get: (tenantSlug: string, id: string) => Promise<BusinessDevice>;
+    /**
+     * Look at the machine offering this code, before adopting it.
+     *
+     * Its own call rather than a field on the claim, because the confirmation is
+     * the point: six characters could be any machine in the building, and seeing
+     * "Card terminal, SN 8842" is how a merchant tells they read the code off the
+     * right one.
+     */
+    previewEnrolment: (tenantSlug: string, code: string) => Promise<DeviceEnrolmentPreview>;
+    /**
+     * Adopt the machine offering this code.
+     *
+     * Comes back `pending` and stays there for about two seconds — the machine is
+     * already polling for its token, and collecting it is what makes the device
+     * live. Nothing here carries a credential: the merchant never holds one.
+     */
+    claimEnrolment: (tenantSlug: string, code: string, data: {
+        deviceId: string;
+        label?: string;
+        kind?: BusinessDeviceKind;
+        locationId?: string;
+    }) => Promise<LinkedDevice>;
+    /** Rename a device, move it to another branch, or restrict who may work it. */
+    update: (tenantSlug: string, id: string, data: {
+        label?: string;
+        locationId?: string | null;
+        operatorAccess?: DeviceOperatorAccess;
+        /** Null takes it off a profile and back to the defaults. */
+        profileId?: string | null;
+    }) => Promise<BusinessDevice>;
+    /**
+     * Set how a device is allowed to behave.
+     *
+     * A patch of what changed, not a replacement — the API stores only the keys
+     * sent, so a default changed later still reaches every device nobody has
+     * overridden.
+     */
+    setConfig: (tenantSlug: string, id: string, data: Partial<BusinessDeviceConfig>) => Promise<BusinessDevice & {
+        config: BusinessDeviceConfig;
+    }>;
+    /** Revoking is one-way, and the API enforces that. */
+    setStatus: (tenantSlug: string, id: string, status: Exclude<BusinessDeviceStatus, "pending">) => Promise<BusinessDevice>;
+    /**
+     * Who may sign in at this machine, and whether the list is consulted.
+     *
+     * Both in one answer on purpose: three names mean nothing without knowing
+     * whether the machine is actually restricted to them, and a screen showing
+     * only the names would read as a restriction that is not being enforced.
+     */
+    operators: (tenantSlug: string, id: string) => Promise<DeviceOperators>;
+    addOperator: (tenantSlug: string, id: string, memberId: string) => Promise<DeviceOperators>;
+    removeOperator: (tenantSlug: string, id: string, memberId: string) => Promise<DeviceOperators>;
+    /**
+     * Set somebody's till code.
+     *
+     * Under devices rather than under team because it is hardware access: the
+     * person who decides who may open a till is the person who runs the room, not
+     * whoever administers dashboard logins.
+     */
+    setPasscode: (tenantSlug: string, memberId: string, passcode: string) => Promise<{
+        setAt: string;
+    }>;
+    clearPasscode: (tenantSlug: string, memberId: string) => Promise<{
+        cleared: boolean;
+    }>;
+    setPosPermissions: (tenantSlug: string, memberId: string, permissions: PosPermissions) => Promise<PosPermissions>;
+    /**
+     * Named configs, with how many machines follow each.
+     *
+     * `profiles/all` rather than `profiles`, because `:id` on the same controller
+     * would swallow it — a route that reads as a list and resolves as a device
+     * lookup is the kind of collision that fails at runtime and nowhere else.
+     */
+    profiles: (tenantSlug: string) => Promise<{
+        profiles: DeviceProfile[];
+    }>;
+    createProfile: (tenantSlug: string, body: {
+        name: string;
+        config?: Partial<BusinessDeviceConfig>;
+        isDefault?: boolean;
+    }) => Promise<DeviceProfile>;
+    /** A patch. Sending one field must not reset the others on six machines. */
+    updateProfile: (tenantSlug: string, id: string, body: {
+        name?: string;
+        config?: Partial<BusinessDeviceConfig>;
+        isDefault?: boolean;
+    }) => Promise<DeviceProfile>;
+    /** Refused while anything still follows it. */
+    deleteProfile: (tenantSlug: string, id: string) => Promise<{
+        deleted: boolean;
+    }>;
+    applyProfile: (tenantSlug: string, id: string, deviceIds: string[]) => Promise<{
+        applied: number;
+    }>;
+};

package/dist/api/business-devices.js

@@ -0,0 +1,139 @@
+import { apiFetch } from "./core";
+const businessDevicesApi = {
+  list: (tenantSlug) => apiFetch("/business-devices", {
+    tenantSlug
+  }),
+  get: (tenantSlug, id) => apiFetch(`/business-devices/${id}`, { tenantSlug }),
+  /**
+   * Look at the machine offering this code, before adopting it.
+   *
+   * Its own call rather than a field on the claim, because the confirmation is
+   * the point: six characters could be any machine in the building, and seeing
+   * "Card terminal, SN 8842" is how a merchant tells they read the code off the
+   * right one.
+   */
+  previewEnrolment: (tenantSlug, code) => apiFetch(
+    `/business-devices/enrolments/${encodeURIComponent(code)}`,
+    { tenantSlug }
+  ),
+  /**
+   * Adopt the machine offering this code.
+   *
+   * Comes back `pending` and stays there for about two seconds — the machine is
+   * already polling for its token, and collecting it is what makes the device
+   * live. Nothing here carries a credential: the merchant never holds one.
+   */
+  claimEnrolment: (tenantSlug, code, data) => apiFetch(
+    `/business-devices/enrolments/${encodeURIComponent(code)}/claim`,
+    { tenantSlug, method: "POST", body: JSON.stringify(data) }
+  ),
+  /*
+   * REGISTERING AND REISSUING A PAIRING CODE USED TO LIVE HERE.
+   *
+   * Both were the dashboard's half of the old direction: the merchant described
+   * a machine they had not plugged in, we minted a code, and somebody walked
+   * over and typed it into a keypad. The machine speaks first now — see
+   * `previewEnrolment` and `claimEnrolment` above — so nothing in the dashboard
+   * mints a code any more.
+   *
+   * The API still serves `POST /business-devices` and `:id/pairing-code` for a
+   * device paired the old way. They are not called from here, and a client
+   * method for a flow no screen offers is how a dead path comes back.
+   */
+  /** Rename a device, move it to another branch, or restrict who may work it. */
+  update: (tenantSlug, id, data) => apiFetch(`/business-devices/${id}`, {
+    tenantSlug,
+    method: "PATCH",
+    body: JSON.stringify(data)
+  }),
+  /**
+   * Set how a device is allowed to behave.
+   *
+   * A patch of what changed, not a replacement — the API stores only the keys
+   * sent, so a default changed later still reaches every device nobody has
+   * overridden.
+   */
+  setConfig: (tenantSlug, id, data) => apiFetch(
+    `/business-devices/${id}/config`,
+    { tenantSlug, method: "PATCH", body: JSON.stringify(data) }
+  ),
+  /** Revoking is one-way, and the API enforces that. */
+  setStatus: (tenantSlug, id, status) => apiFetch(`/business-devices/${id}/status`, {
+    tenantSlug,
+    method: "POST",
+    body: JSON.stringify({ status })
+  }),
+  /**
+   * Who may sign in at this machine, and whether the list is consulted.
+   *
+   * Both in one answer on purpose: three names mean nothing without knowing
+   * whether the machine is actually restricted to them, and a screen showing
+   * only the names would read as a restriction that is not being enforced.
+   */
+  operators: (tenantSlug, id) => apiFetch(`/business-devices/${id}/operators`, {
+    tenantSlug
+  }),
+  addOperator: (tenantSlug, id, memberId) => apiFetch(`/business-devices/${id}/operators`, {
+    tenantSlug,
+    method: "POST",
+    body: JSON.stringify({ memberId })
+  }),
+  removeOperator: (tenantSlug, id, memberId) => apiFetch(`/business-devices/${id}/operators/${memberId}`, {
+    tenantSlug,
+    method: "DELETE"
+  }),
+  /**
+   * Set somebody's till code.
+   *
+   * Under devices rather than under team because it is hardware access: the
+   * person who decides who may open a till is the person who runs the room, not
+   * whoever administers dashboard logins.
+   */
+  setPasscode: (tenantSlug, memberId, passcode) => apiFetch(
+    `/business-devices/operators/${memberId}/passcode`,
+    { tenantSlug, method: "PUT", body: JSON.stringify({ passcode }) }
+  ),
+  clearPasscode: (tenantSlug, memberId) => apiFetch(
+    `/business-devices/operators/${memberId}/passcode`,
+    { tenantSlug, method: "DELETE" }
+  ),
+  setPosPermissions: (tenantSlug, memberId, permissions) => apiFetch(
+    `/business-devices/operators/${memberId}/permissions`,
+    { tenantSlug, method: "PUT", body: JSON.stringify(permissions) }
+  ),
+  /**
+   * Named configs, with how many machines follow each.
+   *
+   * `profiles/all` rather than `profiles`, because `:id` on the same controller
+   * would swallow it — a route that reads as a list and resolves as a device
+   * lookup is the kind of collision that fails at runtime and nowhere else.
+   */
+  profiles: (tenantSlug) => apiFetch("/business-devices/profiles/all", {
+    tenantSlug
+  }),
+  createProfile: (tenantSlug, body) => apiFetch("/business-devices/profiles", {
+    tenantSlug,
+    method: "POST",
+    body: JSON.stringify(body)
+  }),
+  /** A patch. Sending one field must not reset the others on six machines. */
+  updateProfile: (tenantSlug, id, body) => apiFetch(`/business-devices/profiles/${id}`, {
+    tenantSlug,
+    method: "PATCH",
+    body: JSON.stringify(body)
+  }),
+  /** Refused while anything still follows it. */
+  deleteProfile: (tenantSlug, id) => apiFetch(`/business-devices/profiles/${id}`, {
+    tenantSlug,
+    method: "DELETE"
+  }),
+  applyProfile: (tenantSlug, id, deviceIds) => apiFetch(`/business-devices/profiles/${id}/apply`, {
+    tenantSlug,
+    method: "POST",
+    body: JSON.stringify({ deviceIds })
+  })
+};
+export {
+  businessDevicesApi
+};
+//# sourceMappingURL=business-devices.js.map

package/dist/api/business-devices.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/business-devices.ts"],"sourcesContent":["import { apiFetch } from './core';\nimport type {\n  BusinessDevice,\n  DeviceProfile,\n  DeviceOperatorAccess,\n  DeviceOperators,\n  PosPermissions,\n  BusinessDeviceKind,\n  BusinessDeviceStatus,\n  BusinessDeviceConfig,\n  DeviceEnrolmentPreview,\n  LinkedDevice,\n} from './types';\n\n/**\n * The business's own hardware.\n *\n * Deliberately not `devicesApi`, which already exists and means something else\n * entirely — which browsers an *account* has signed in from. Sharing the word\n * would eventually put somebody's laptop in a list of card terminals.\n */\nexport const businessDevicesApi = {\n  list: (tenantSlug: string) =>\n    apiFetch<{ devices: BusinessDevice[] }>('/business-devices', {\n      tenantSlug,\n    }),\n\n  get: (tenantSlug: string, id: string) =>\n    apiFetch<BusinessDevice>(`/business-devices/${id}`, { tenantSlug }),\n\n  /**\n   * Look at the machine offering this code, before adopting it.\n   *\n   * Its own call rather than a field on the claim, because the confirmation is\n   * the point: six characters could be any machine in the building, and seeing\n   * \"Card terminal, SN 8842\" is how a merchant tells they read the code off the\n   * right one.\n   */\n  previewEnrolment: (tenantSlug: string, code: string) =>\n    apiFetch<DeviceEnrolmentPreview>(\n      `/business-devices/enrolments/${encodeURIComponent(code)}`,\n      { tenantSlug },\n    ),\n\n  /**\n   * Adopt the machine offering this code.\n   *\n   * Comes back `pending` and stays there for about two seconds — the machine is\n   * already polling for its token, and collecting it is what makes the device\n   * live. Nothing here carries a credential: the merchant never holds one.\n   */\n  claimEnrolment: (\n    tenantSlug: string,\n    code: string,\n    data: {\n      deviceId: string;\n      label?: string;\n      kind?: BusinessDeviceKind;\n      locationId?: string;\n    },\n  ) =>\n    apiFetch<LinkedDevice>(\n      `/business-devices/enrolments/${encodeURIComponent(code)}/claim`,\n      { tenantSlug, method: 'POST', body: JSON.stringify(data) },\n    ),\n\n  /*\n   * REGISTERING AND REISSUING A PAIRING CODE USED TO LIVE HERE.\n   *\n   * Both were the dashboard's half of the old direction: the merchant described\n   * a machine they had not plugged in, we minted a code, and somebody walked\n   * over and typed it into a keypad. The machine speaks first now — see\n   * `previewEnrolment` and `claimEnrolment` above — so nothing in the dashboard\n   * mints a code any more.\n   *\n   * The API still serves `POST /business-devices` and `:id/pairing-code` for a\n   * device paired the old way. They are not called from here, and a client\n   * method for a flow no screen offers is how a dead path comes back.\n   */\n\n  /** Rename a device, move it to another branch, or restrict who may work it. */\n  update: (\n    tenantSlug: string,\n    id: string,\n    data: {\n      label?: string;\n      locationId?: string | null;\n      operatorAccess?: DeviceOperatorAccess;\n      /** Null takes it off a profile and back to the defaults. */\n      profileId?: string | null;\n    },\n  ) =>\n    apiFetch<BusinessDevice>(`/business-devices/${id}`, {\n      tenantSlug,\n      method: 'PATCH',\n      body: JSON.stringify(data),\n    }),\n\n  /**\n   * Set how a device is allowed to behave.\n   *\n   * A patch of what changed, not a replacement — the API stores only the keys\n   * sent, so a default changed later still reaches every device nobody has\n   * overridden.\n   */\n  setConfig: (\n    tenantSlug: string,\n    id: string,\n    data: Partial<BusinessDeviceConfig>,\n  ) =>\n    apiFetch<BusinessDevice & { config: BusinessDeviceConfig }>(\n      `/business-devices/${id}/config`,\n      { tenantSlug, method: 'PATCH', body: JSON.stringify(data) },\n    ),\n\n  /** Revoking is one-way, and the API enforces that. */\n  setStatus: (\n    tenantSlug: string,\n    id: string,\n    status: Exclude<BusinessDeviceStatus, 'pending'>,\n  ) =>\n    apiFetch<BusinessDevice>(`/business-devices/${id}/status`, {\n      tenantSlug,\n      method: 'POST',\n      body: JSON.stringify({ status }),\n    }),\n\n  /**\n   * Who may sign in at this machine, and whether the list is consulted.\n   *\n   * Both in one answer on purpose: three names mean nothing without knowing\n   * whether the machine is actually restricted to them, and a screen showing\n   * only the names would read as a restriction that is not being enforced.\n   */\n  operators: (tenantSlug: string, id: string) =>\n    apiFetch<DeviceOperators>(`/business-devices/${id}/operators`, {\n      tenantSlug,\n    }),\n\n  addOperator: (tenantSlug: string, id: string, memberId: string) =>\n    apiFetch<DeviceOperators>(`/business-devices/${id}/operators`, {\n      tenantSlug,\n      method: 'POST',\n      body: JSON.stringify({ memberId }),\n    }),\n\n  removeOperator: (tenantSlug: string, id: string, memberId: string) =>\n    apiFetch<DeviceOperators>(`/business-devices/${id}/operators/${memberId}`, {\n      tenantSlug,\n      method: 'DELETE',\n    }),\n\n  /**\n   * Set somebody's till code.\n   *\n   * Under devices rather than under team because it is hardware access: the\n   * person who decides who may open a till is the person who runs the room, not\n   * whoever administers dashboard logins.\n   */\n  setPasscode: (tenantSlug: string, memberId: string, passcode: string) =>\n    apiFetch<{ setAt: string }>(\n      `/business-devices/operators/${memberId}/passcode`,\n      { tenantSlug, method: 'PUT', body: JSON.stringify({ passcode }) },\n    ),\n\n  clearPasscode: (tenantSlug: string, memberId: string) =>\n    apiFetch<{ cleared: boolean }>(\n      `/business-devices/operators/${memberId}/passcode`,\n      { tenantSlug, method: 'DELETE' },\n    ),\n\n  setPosPermissions: (\n    tenantSlug: string,\n    memberId: string,\n    permissions: PosPermissions,\n  ) =>\n    apiFetch<PosPermissions>(\n      `/business-devices/operators/${memberId}/permissions`,\n      { tenantSlug, method: 'PUT', body: JSON.stringify(permissions) },\n    ),\n\n  /**\n   * Named configs, with how many machines follow each.\n   *\n   * `profiles/all` rather than `profiles`, because `:id` on the same controller\n   * would swallow it — a route that reads as a list and resolves as a device\n   * lookup is the kind of collision that fails at runtime and nowhere else.\n   */\n  profiles: (tenantSlug: string) =>\n    apiFetch<{ profiles: DeviceProfile[] }>('/business-devices/profiles/all', {\n      tenantSlug,\n    }),\n\n  createProfile: (\n    tenantSlug: string,\n    body: {\n      name: string;\n      config?: Partial<BusinessDeviceConfig>;\n      isDefault?: boolean;\n    },\n  ) =>\n    apiFetch<DeviceProfile>('/business-devices/profiles', {\n      tenantSlug,\n      method: 'POST',\n      body: JSON.stringify(body),\n    }),\n\n  /** A patch. Sending one field must not reset the others on six machines. */\n  updateProfile: (\n    tenantSlug: string,\n    id: string,\n    body: {\n      name?: string;\n      config?: Partial<BusinessDeviceConfig>;\n      isDefault?: boolean;\n    },\n  ) =>\n    apiFetch<DeviceProfile>(`/business-devices/profiles/${id}`, {\n      tenantSlug,\n      method: 'PATCH',\n      body: JSON.stringify(body),\n    }),\n\n  /** Refused while anything still follows it. */\n  deleteProfile: (tenantSlug: string, id: string) =>\n    apiFetch<{ deleted: boolean }>(`/business-devices/profiles/${id}`, {\n      tenantSlug,\n      method: 'DELETE',\n    }),\n\n  applyProfile: (tenantSlug: string, id: string, deviceIds: string[]) =>\n    apiFetch<{ applied: number }>(`/business-devices/profiles/${id}/apply`, {\n      tenantSlug,\n      method: 'POST',\n      body: JSON.stringify({ deviceIds }),\n    }),\n};\n"],"mappings":"AAAA,SAAS,gBAAgB;AAqBlB,MAAM,qBAAqB;AAAA,EAChC,MAAM,CAAC,eACL,SAAwC,qBAAqB;AAAA,IAC3D;AAAA,EACF,CAAC;AAAA,EAEH,KAAK,CAAC,YAAoB,OACxB,SAAyB,qBAAqB,EAAE,IAAI,EAAE,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUpE,kBAAkB,CAAC,YAAoB,SACrC;AAAA,IACE,gCAAgC,mBAAmB,IAAI,CAAC;AAAA,IACxD,EAAE,WAAW;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASF,gBAAgB,CACd,YACA,MACA,SAOA;AAAA,IACE,gCAAgC,mBAAmB,IAAI,CAAC;AAAA,IACxD,EAAE,YAAY,QAAQ,QAAQ,MAAM,KAAK,UAAU,IAAI,EAAE;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBF,QAAQ,CACN,YACA,IACA,SAQA,SAAyB,qBAAqB,EAAE,IAAI;AAAA,IAClD;AAAA,IACA,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,WAAW,CACT,YACA,IACA,SAEA;AAAA,IACE,qBAAqB,EAAE;AAAA,IACvB,EAAE,YAAY,QAAQ,SAAS,MAAM,KAAK,UAAU,IAAI,EAAE;AAAA,EAC5D;AAAA;AAAA,EAGF,WAAW,CACT,YACA,IACA,WAEA,SAAyB,qBAAqB,EAAE,WAAW;AAAA,IACzD;AAAA,IACA,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC;AAAA,EACjC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,WAAW,CAAC,YAAoB,OAC9B,SAA0B,qBAAqB,EAAE,cAAc;AAAA,IAC7D;AAAA,EACF,CAAC;AAAA,EAEH,aAAa,CAAC,YAAoB,IAAY,aAC5C,SAA0B,qBAAqB,EAAE,cAAc;AAAA,IAC7D;AAAA,IACA,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,EACnC,CAAC;AAAA,EAEH,gBAAgB,CAAC,YAAoB,IAAY,aAC/C,SAA0B,qBAAqB,EAAE,cAAc,QAAQ,IAAI;AAAA,IACzE;AAAA,IACA,QAAQ;AAAA,EACV,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,aAAa,CAAC,YAAoB,UAAkB,aAClD;AAAA,IACE,+BAA+B,QAAQ;AAAA,IACvC,EAAE,YAAY,QAAQ,OAAO,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC,EAAE;AAAA,EAClE;AAAA,EAEF,eAAe,CAAC,YAAoB,aAClC;AAAA,IACE,+BAA+B,QAAQ;AAAA,IACvC,EAAE,YAAY,QAAQ,SAAS;AAAA,EACjC;AAAA,EAEF,mBAAmB,CACjB,YACA,UACA,gBAEA;AAAA,IACE,+BAA+B,QAAQ;AAAA,IACvC,EAAE,YAAY,QAAQ,OAAO,MAAM,KAAK,UAAU,WAAW,EAAE;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASF,UAAU,CAAC,eACT,SAAwC,kCAAkC;AAAA,IACxE;AAAA,EACF,CAAC;AAAA,EAEH,eAAe,CACb,YACA,SAMA,SAAwB,8BAA8B;AAAA,IACpD;AAAA,IACA,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA;AAAA,EAGH,eAAe,CACb,YACA,IACA,SAMA,SAAwB,8BAA8B,EAAE,IAAI;AAAA,IAC1D;AAAA,IACA,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA;AAAA,EAGH,eAAe,CAAC,YAAoB,OAClC,SAA+B,8BAA8B,EAAE,IAAI;AAAA,IACjE;AAAA,IACA,QAAQ;AAAA,EACV,CAAC;AAAA,EAEH,cAAc,CAAC,YAAoB,IAAY,cAC7C,SAA8B,8BAA8B,EAAE,UAAU;AAAA,IACtE;AAAA,IACA,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,EAAE,UAAU,CAAC;AAAA,EACpC,CAAC;AACL;","names":[]}

package/dist/api/business-locations.d.ts

@@ -0,0 +1,26 @@
+import type { BusinessLocation, CreateBusinessLocationData, UpdateBusinessLocationData, LocationPerformance } from './types';
+/**
+ * Physical places the business operates from.
+ *
+ * Not to be confused with `locationsApi`, which is the served-cities
+ * footprint behind Settings → Service areas.
+ */
+export declare const businessLocationsApi: {
+    list: (tenantSlug: string, opts?: {
+        includeArchived?: boolean;
+    }) => Promise<BusinessLocation[]>;
+    create: (tenantSlug: string, data: CreateBusinessLocationData) => Promise<BusinessLocation>;
+    update: (tenantSlug: string, id: string, data: UpdateBusinessLocationData) => Promise<BusinessLocation>;
+    /**
+     * Orders and revenue per branch over the last `days`, or all-time when
+     * omitted. Order-sourced rather than analytics-sourced on purpose: analytics
+     * is session-keyed and would miss every in-person sale, which on a business
+     * with a counter is most of them.
+     *
+     * Locations that sold nothing come back with `orders: 0` — a quiet branch is
+     * the finding, so it must not be filtered out server-side.
+     */
+    performance: (tenantSlug: string, days?: number) => Promise<LocationPerformance[]>;
+    /** Closes the location. Archived, not deleted — its history has to survive. */
+    archive: (tenantSlug: string, id: string) => Promise<void>;
+};