@withpotter/lib 0.13.0-next.101

package/dist/api/capabilities.js

@@ -0,0 +1,16 @@
+import { apiFetch } from "./core";
+const capabilitiesApi = {
+  /**
+   * Which optional endpoints this deployment serves.
+   *
+   * `tenantSlug` is optional because this describes the BUILD, not the account,
+   * and the screen that needs it most has no session and no workspace: the
+   * login page decides whether to offer a passkey from this answer. Requiring a
+   * slug meant the request never fired there.
+   */
+  getFeatures: (tenantSlug) => apiFetch("/capabilities/api", { tenantSlug })
+};
+export {
+  capabilitiesApi
+};
+//# sourceMappingURL=capabilities.js.map

package/dist/api/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/capabilities.ts"],"sourcesContent":["import { apiFetch } from './core';\nimport type { ApiFeatures } from './types';\n\nexport const capabilitiesApi = {\n  /**\n   * Which optional endpoints this deployment serves.\n   *\n   * `tenantSlug` is optional because this describes the BUILD, not the account,\n   * and the screen that needs it most has no session and no workspace: the\n   * login page decides whether to offer a passkey from this answer. Requiring a\n   * slug meant the request never fired there.\n   */\n  getFeatures: (tenantSlug?: string) =>\n    apiFetch<ApiFeatures>('/capabilities/api', { tenantSlug }),\n};\n"],"mappings":"AAAA,SAAS,gBAAgB;AAGlB,MAAM,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS7B,aAAa,CAAC,eACZ,SAAsB,qBAAqB,EAAE,WAAW,CAAC;AAC7D;","names":[]}

package/dist/api/commerce.d.ts

@@ -0,0 +1,19 @@
+import type { CommitmentSource, CommitmentPaymentState, CommitmentsResponse } from './types';
+export declare const commerceApi: {
+    /**
+     * Orders, bookings and invoices in one date-ordered list.
+     *
+     * `countsBySource` ignores the `source` filter on purpose, so a tab can keep
+     * showing its own count while the merchant is looking at another rail.
+     */
+    listCommitments: (tenantSlug: string, params?: {
+        source?: CommitmentSource[];
+        paymentState?: CommitmentPaymentState;
+        search?: string;
+        memberId?: string;
+        startDate?: string;
+        endDate?: string;
+        page?: number;
+        limit?: number;
+    }) => Promise<CommitmentsResponse>;
+};

package/dist/api/commerce.js

@@ -0,0 +1,31 @@
+import { apiFetch } from "./core";
+const commerceApi = {
+  /**
+   * Orders, bookings and invoices in one date-ordered list.
+   *
+   * `countsBySource` ignores the `source` filter on purpose, so a tab can keep
+   * showing its own count while the merchant is looking at another rail.
+   */
+  listCommitments: (tenantSlug, params) => {
+    const searchParams = new URLSearchParams();
+    if (params?.source?.length)
+      searchParams.set("source", params.source.join(","));
+    if (params?.paymentState)
+      searchParams.set("paymentState", params.paymentState);
+    if (params?.search) searchParams.set("search", params.search);
+    if (params?.memberId) searchParams.set("memberId", params.memberId);
+    if (params?.startDate) searchParams.set("startDate", params.startDate);
+    if (params?.endDate) searchParams.set("endDate", params.endDate);
+    if (params?.page) searchParams.set("page", String(params.page));
+    if (params?.limit) searchParams.set("limit", String(params.limit));
+    const qs = searchParams.toString();
+    return apiFetch(
+      `/commerce/commitments${qs ? `?${qs}` : ""}`,
+      { tenantSlug }
+    );
+  }
+};
+export {
+  commerceApi
+};
+//# sourceMappingURL=commerce.js.map

package/dist/api/commerce.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/commerce.ts"],"sourcesContent":["import { apiFetch } from './core';\nimport type {\n  CommitmentSource,\n  CommitmentPaymentState,\n  CommitmentsResponse,\n} from './types';\n\nexport const commerceApi = {\n  /**\n   * Orders, bookings and invoices in one date-ordered list.\n   *\n   * `countsBySource` ignores the `source` filter on purpose, so a tab can keep\n   * showing its own count while the merchant is looking at another rail.\n   */\n  listCommitments: (\n    tenantSlug: string,\n    params?: {\n      source?: CommitmentSource[];\n      paymentState?: CommitmentPaymentState;\n      search?: string;\n      memberId?: string;\n      startDate?: string;\n      endDate?: string;\n      page?: number;\n      limit?: number;\n    },\n  ) => {\n    const searchParams = new URLSearchParams();\n    if (params?.source?.length)\n      searchParams.set('source', params.source.join(','));\n    if (params?.paymentState)\n      searchParams.set('paymentState', params.paymentState);\n    if (params?.search) searchParams.set('search', params.search);\n    if (params?.memberId) searchParams.set('memberId', params.memberId);\n    if (params?.startDate) searchParams.set('startDate', params.startDate);\n    if (params?.endDate) searchParams.set('endDate', params.endDate);\n    if (params?.page) searchParams.set('page', String(params.page));\n    if (params?.limit) searchParams.set('limit', String(params.limit));\n\n    const qs = searchParams.toString();\n    return apiFetch<CommitmentsResponse>(\n      `/commerce/commitments${qs ? `?${qs}` : ''}`,\n      { tenantSlug },\n    );\n  },\n};\n"],"mappings":"AAAA,SAAS,gBAAgB;AAOlB,MAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOzB,iBAAiB,CACf,YACA,WAUG;AACH,UAAM,eAAe,IAAI,gBAAgB;AACzC,QAAI,QAAQ,QAAQ;AAClB,mBAAa,IAAI,UAAU,OAAO,OAAO,KAAK,GAAG,CAAC;AACpD,QAAI,QAAQ;AACV,mBAAa,IAAI,gBAAgB,OAAO,YAAY;AACtD,QAAI,QAAQ,OAAQ,cAAa,IAAI,UAAU,OAAO,MAAM;AAC5D,QAAI,QAAQ,SAAU,cAAa,IAAI,YAAY,OAAO,QAAQ;AAClE,QAAI,QAAQ,UAAW,cAAa,IAAI,aAAa,OAAO,SAAS;AACrE,QAAI,QAAQ,QAAS,cAAa,IAAI,WAAW,OAAO,OAAO;AAC/D,QAAI,QAAQ,KAAM,cAAa,IAAI,QAAQ,OAAO,OAAO,IAAI,CAAC;AAC9D,QAAI,QAAQ,MAAO,cAAa,IAAI,SAAS,OAAO,OAAO,KAAK,CAAC;AAEjE,UAAM,KAAK,aAAa,SAAS;AACjC,WAAO;AAAA,MACL,wBAAwB,KAAK,IAAI,EAAE,KAAK,EAAE;AAAA,MAC1C,EAAE,WAAW;AAAA,IACf;AAAA,EACF;AACF;","names":[]}

package/dist/api/communications.d.ts

@@ -0,0 +1,166 @@
+import type { BulkEmailResult, NotificationLogPage, NotificationPreferences, NotificationStats, SendMessageResult } from './types';
+export declare const communicationsApi: {
+    listOrderMessages: (tenantSlug: string, orderId: string) => Promise<import("./types").NotificationLogItem[]>;
+    listTransactionMessages: (tenantSlug: string, transactionId: string) => Promise<import("./types").NotificationLogItem[]>;
+    retryLog: (tenantSlug: string, id: string) => Promise<{
+        queued: boolean;
+        notificationId: string;
+    }>;
+    /**
+     * What Box has sent, and whether it arrived.
+     *
+     * `GET /communications/logs` has existed in potter-api since the messaging
+     * spine was built and no dashboard surface has ever called it, so a merchant
+     * asking "did my customer get the confirmation" had nowhere to look.
+     */
+    listLogs: (tenantSlug: string, params?: {
+        memberId?: string;
+        channel?: string;
+        status?: string;
+        /**
+         * Everything sent about one record: an order number, a booking id, an
+         * invoice id. Matches the merchant's and assignee's copies too, because
+         * one event fans out to three audiences and they are one answer.
+         */
+        reference?: string;
+        /**
+         * Everything sent TO one person, by the address it went to.
+         *
+         * A customer has no reference of their own — a message is about an
+         * order or a booking, and the person is who it reached.
+         */
+        recipient?: string;
+        page?: number;
+        limit?: number;
+    }) => Promise<NotificationLogPage>;
+    /**
+     * How much of what Box sent actually arrived.
+     *
+     * `GET /communications/stats` has existed as long as the log and no screen
+     * has ever called it, which is why every usage number a merchant has seen
+     * about messaging was either a credit balance or a fixture.
+     */
+    stats: (tenantSlug: string, params?: {
+        startDate?: string;
+        endDate?: string;
+    }) => Promise<NotificationStats>;
+    /**
+     * What one customer has agreed to hear about.
+     *
+     * `GET /communications/preferences/:memberId` has existed as long as the
+     * consent engine and no dashboard surface has ever called it, so the
+     * merchant enforcing these could not see them.
+     */
+    preferences: (tenantSlug: string, memberId: string) => Promise<NotificationPreferences>;
+    sendBulk: (tenantSlug: string, data: {
+        templateType: string;
+        templateId?: string;
+        recipients: Array<{
+            email: string;
+            name?: string;
+            memberId?: string;
+            variables?: Record<string, string>;
+        }>;
+        commonVariables?: Record<string, string>;
+    }) => Promise<BulkEmailResult>;
+    sendToMember: (tenantSlug: string, data: {
+        recipientEmail: string;
+        recipientName?: string;
+        memberId?: string;
+        subject: string;
+        message: string;
+    }) => Promise<SendMessageResult>;
+    sendCustomEmail: (tenantSlug: string, data: {
+        recipientEmail: string;
+        recipientName?: string;
+        subject: string;
+        htmlContent: string;
+        metadata?: Record<string, unknown>;
+    }) => Promise<SendMessageResult>;
+};
+/**
+ * One editable customer message, as the API describes it.
+ *
+ * SERVED, not re-typed here. The label, the description, our default subject
+ * and the current values all live beside the templates in potter-api; a copy
+ * on this side would be a second list to keep in step, which is how the
+ * settings rail and the mobile hub came to show two different products.
+ */
+export interface MerchantMessageSummary {
+    key: string;
+    label: string;
+    when: string;
+    /** Whether the merchant may stop it being sent at all. */
+    silenceable: boolean;
+    enabled: boolean;
+    /** Whether they have said anything about it — including switching it off. */
+    edited: boolean;
+    subject: string;
+    defaultSubject: string;
+    body: string;
+}
+export declare const merchantMessagesApi: {
+    list: (tenantSlug: string) => Promise<MerchantMessageSummary[]>;
+    /**
+     * The email as the customer would receive it. A POST because it carries the
+     * draft being typed rather than what is saved.
+     */
+    preview: (tenantSlug: string, key: string, draft: {
+        subject?: string;
+        body?: string;
+    }) => Promise<{
+        subject: string;
+        html: string;
+    }>;
+    /** Send it to yourself, through your own configured sender. */
+    sendTest: (tenantSlug: string, key: string, draft: {
+        subject?: string;
+        body?: string;
+        to?: string;
+    }) => Promise<{
+        success: boolean;
+        message: string;
+    }>;
+};
+/**
+ * Who a WhatsApp message can reach right now.
+ *
+ * WhatsApp accepts a free-form message only within 24 hours of the customer
+ * writing first, so for a campaign this is not a detail — it IS the audience.
+ * Contacts come back as digits with the country code resolved, which is how
+ * they are stored, so a caller comparing against its own list has to normalise
+ * rather than match on however a merchant typed the number.
+ *
+ * A tenant whose API predates inbound gets an empty list. That is honest —
+ * nobody is reachable if nothing has ever been received — and it is the reason
+ * callers treat the failure case separately rather than folding it into zero.
+ */
+export declare const whatsappWindowApi: {
+    reachable: (tenantSlug: string) => Promise<{
+        windowHours: number;
+        contacts: string[];
+    }>;
+};
+/**
+ * Proving the alert number is the merchant's own.
+ *
+ * The number on the alerts screen is where orders, payments and low-stock
+ * warnings are sent, over channels that cost credits — and until this existed
+ * nothing checked it. A missing country code or one wrong digit meant every
+ * alert went to a stranger, forever, and the screen said "Saved".
+ *
+ * `sendCode` answers 429 while the previous code's minute is still running;
+ * the caller reads that status to put the countdown back rather than showing
+ * it as a failure, because it is not one.
+ */
+export declare const phoneVerificationApi: {
+    sendCode: (tenantSlug: string, phone: string, channel?: "sms" | "whatsapp") => Promise<{
+        sentTo: string;
+        channel: "sms" | "whatsapp";
+        resendInSeconds: number;
+    }>;
+    verify: (tenantSlug: string, phone: string, code: string) => Promise<{
+        phone: string;
+        verifiedAt: string;
+    }>;
+};

package/dist/api/communications.js

@@ -0,0 +1,141 @@
+import { apiFetch } from "./core";
+const communicationsApi = {
+  listOrderMessages: (tenantSlug, orderId) => apiFetch(
+    `/communications/orders/${encodeURIComponent(orderId)}/messages`,
+    { tenantSlug }
+  ),
+  listTransactionMessages: (tenantSlug, transactionId) => apiFetch(
+    `/communications/transactions/${encodeURIComponent(transactionId)}/messages`,
+    { tenantSlug }
+  ),
+  retryLog: (tenantSlug, id) => apiFetch(
+    `/communications/logs/${encodeURIComponent(id)}/retry`,
+    { tenantSlug, method: "POST" }
+  ),
+  /**
+   * What Box has sent, and whether it arrived.
+   *
+   * `GET /communications/logs` has existed in potter-api since the messaging
+   * spine was built and no dashboard surface has ever called it, so a merchant
+   * asking "did my customer get the confirmation" had nowhere to look.
+   */
+  listLogs: (tenantSlug, params = {}) => {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(params)) {
+      if (value !== void 0 && value !== "") query.set(key, String(value));
+    }
+    const suffix = query.toString();
+    return apiFetch(
+      `/communications/logs${suffix ? `?${suffix}` : ""}`,
+      { tenantSlug }
+    );
+  },
+  /**
+   * How much of what Box sent actually arrived.
+   *
+   * `GET /communications/stats` has existed as long as the log and no screen
+   * has ever called it, which is why every usage number a merchant has seen
+   * about messaging was either a credit balance or a fixture.
+   */
+  stats: (tenantSlug, params = {}) => {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(params)) {
+      if (value) query.set(key, value);
+    }
+    const suffix = query.toString();
+    return apiFetch(
+      `/communications/stats${suffix ? `?${suffix}` : ""}`,
+      { tenantSlug }
+    );
+  },
+  /**
+   * What one customer has agreed to hear about.
+   *
+   * `GET /communications/preferences/:memberId` has existed as long as the
+   * consent engine and no dashboard surface has ever called it, so the
+   * merchant enforcing these could not see them.
+   */
+  preferences: (tenantSlug, memberId) => apiFetch(
+    `/communications/preferences/${memberId}`,
+    { tenantSlug }
+  ),
+  sendBulk: (tenantSlug, data) => apiFetch("/communications/send-bulk", {
+    method: "POST",
+    body: JSON.stringify(data),
+    tenantSlug
+  }),
+  sendToMember: (tenantSlug, data) => apiFetch("/communications/send", {
+    method: "POST",
+    body: JSON.stringify({
+      templateType: "custom",
+      recipientEmail: data.recipientEmail,
+      recipientName: data.recipientName,
+      memberId: data.memberId,
+      variables: {
+        subject: data.subject,
+        htmlContent: `<p>${data.message.replace(/\n/g, "<br />")}</p>`
+      }
+    }),
+    tenantSlug
+  }),
+  sendCustomEmail: (tenantSlug, data) => apiFetch("/communications/send", {
+    method: "POST",
+    tenantSlug,
+    body: JSON.stringify({
+      templateType: "custom",
+      recipientEmail: data.recipientEmail,
+      ...data.recipientName ? { recipientName: data.recipientName } : {},
+      variables: {
+        subject: data.subject,
+        htmlContent: data.htmlContent
+      },
+      metadata: data.metadata
+    })
+  })
+};
+const merchantMessagesApi = {
+  list: (tenantSlug) => apiFetch("/communications/messages", {
+    tenantSlug
+  }),
+  /**
+   * The email as the customer would receive it. A POST because it carries the
+   * draft being typed rather than what is saved.
+   */
+  preview: (tenantSlug, key, draft) => apiFetch(
+    `/communications/messages/${encodeURIComponent(key)}/preview`,
+    { method: "POST", body: JSON.stringify(draft), tenantSlug }
+  ),
+  /** Send it to yourself, through your own configured sender. */
+  sendTest: (tenantSlug, key, draft) => apiFetch(
+    `/communications/messages/${encodeURIComponent(key)}/test`,
+    { method: "POST", body: JSON.stringify(draft), tenantSlug }
+  )
+};
+const whatsappWindowApi = {
+  reachable: (tenantSlug) => apiFetch(
+    "/communications/whatsapp/window",
+    { tenantSlug }
+  )
+};
+const phoneVerificationApi = {
+  sendCode: (tenantSlug, phone, channel = "sms") => apiFetch("/communications/phone/code", {
+    method: "POST",
+    body: JSON.stringify({ phone, channel }),
+    tenantSlug
+  }),
+  verify: (tenantSlug, phone, code) => apiFetch(
+    "/communications/phone/verify",
+    {
+      method: "POST",
+      body: JSON.stringify({ phone, code }),
+      tenantSlug
+    }
+  )
+};
+export {
+  communicationsApi,
+  merchantMessagesApi,
+  phoneVerificationApi,
+  whatsappWindowApi
+};
+//# sourceMappingURL=communications.js.map

package/dist/api/communications.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/communications.ts"],"sourcesContent":["import { apiFetch } from './core';\nimport type {\n  BulkEmailResult,\n  NotificationLogPage,\n  NotificationPreferences,\n  NotificationStats,\n  SendMessageResult,\n} from './types';\n\nexport const communicationsApi = {\n  listOrderMessages: (tenantSlug: string, orderId: string) =>\n    apiFetch<import('./types').NotificationLogItem[]>(\n      `/communications/orders/${encodeURIComponent(orderId)}/messages`,\n      { tenantSlug },\n    ),\n\n  listTransactionMessages: (tenantSlug: string, transactionId: string) =>\n    apiFetch<import('./types').NotificationLogItem[]>(\n      `/communications/transactions/${encodeURIComponent(transactionId)}/messages`,\n      { tenantSlug },\n    ),\n\n  retryLog: (tenantSlug: string, id: string) =>\n    apiFetch<{ queued: boolean; notificationId: string }>(\n      `/communications/logs/${encodeURIComponent(id)}/retry`,\n      { tenantSlug, method: 'POST' },\n    ),\n\n  /**\n   * What Box has sent, and whether it arrived.\n   *\n   * `GET /communications/logs` has existed in potter-api since the messaging\n   * spine was built and no dashboard surface has ever called it, so a merchant\n   * asking \"did my customer get the confirmation\" had nowhere to look.\n   */\n  listLogs: (\n    tenantSlug: string,\n    params: {\n      memberId?: string;\n      channel?: string;\n      status?: string;\n      /**\n       * Everything sent about one record: an order number, a booking id, an\n       * invoice id. Matches the merchant's and assignee's copies too, because\n       * one event fans out to three audiences and they are one answer.\n       */\n      reference?: string;\n      /**\n       * Everything sent TO one person, by the address it went to.\n       *\n       * A customer has no reference of their own — a message is about an\n       * order or a booking, and the person is who it reached.\n       */\n      recipient?: string;\n      page?: number;\n      limit?: number;\n    } = {},\n  ) => {\n    const query = new URLSearchParams();\n\n    for (const [key, value] of Object.entries(params)) {\n      if (value !== undefined && value !== '') query.set(key, String(value));\n    }\n\n    const suffix = query.toString();\n\n    return apiFetch<NotificationLogPage>(\n      `/communications/logs${suffix ? `?${suffix}` : ''}`,\n      { tenantSlug },\n    );\n  },\n\n  /**\n   * How much of what Box sent actually arrived.\n   *\n   * `GET /communications/stats` has existed as long as the log and no screen\n   * has ever called it, which is why every usage number a merchant has seen\n   * about messaging was either a credit balance or a fixture.\n   */\n  stats: (\n    tenantSlug: string,\n    params: { startDate?: string; endDate?: string } = {},\n  ) => {\n    const query = new URLSearchParams();\n\n    for (const [key, value] of Object.entries(params)) {\n      if (value) query.set(key, value);\n    }\n\n    const suffix = query.toString();\n\n    return apiFetch<NotificationStats>(\n      `/communications/stats${suffix ? `?${suffix}` : ''}`,\n      { tenantSlug },\n    );\n  },\n\n  /**\n   * What one customer has agreed to hear about.\n   *\n   * `GET /communications/preferences/:memberId` has existed as long as the\n   * consent engine and no dashboard surface has ever called it, so the\n   * merchant enforcing these could not see them.\n   */\n  preferences: (tenantSlug: string, memberId: string) =>\n    apiFetch<NotificationPreferences>(\n      `/communications/preferences/${memberId}`,\n      { tenantSlug },\n    ),\n\n  sendBulk: (\n    tenantSlug: string,\n    data: {\n      templateType: string;\n      templateId?: string;\n      recipients: Array<{\n        email: string;\n        name?: string;\n        memberId?: string;\n        variables?: Record<string, string>;\n      }>;\n      commonVariables?: Record<string, string>;\n    },\n  ) =>\n    apiFetch<BulkEmailResult>('/communications/send-bulk', {\n      method: 'POST',\n      body: JSON.stringify(data),\n      tenantSlug,\n    }),\n\n  sendToMember: (\n    tenantSlug: string,\n    data: {\n      recipientEmail: string;\n      recipientName?: string;\n      memberId?: string;\n      subject: string;\n      message: string;\n    },\n  ) =>\n    apiFetch<SendMessageResult>('/communications/send', {\n      method: 'POST',\n      body: JSON.stringify({\n        templateType: 'custom',\n        recipientEmail: data.recipientEmail,\n        recipientName: data.recipientName,\n        memberId: data.memberId,\n        variables: {\n          subject: data.subject,\n          htmlContent: `<p>${data.message.replace(/\\n/g, '<br />')}</p>`,\n        },\n      }),\n      tenantSlug,\n    }),\n\n  sendCustomEmail: (\n    tenantSlug: string,\n    data: {\n      recipientEmail: string;\n      recipientName?: string;\n      subject: string;\n      htmlContent: string;\n      metadata?: Record<string, unknown>;\n    },\n  ) =>\n    apiFetch<SendMessageResult>('/communications/send', {\n      method: 'POST',\n      tenantSlug,\n      body: JSON.stringify({\n        templateType: 'custom',\n        recipientEmail: data.recipientEmail,\n        ...(data.recipientName ? { recipientName: data.recipientName } : {}),\n        variables: {\n          subject: data.subject,\n          htmlContent: data.htmlContent,\n        },\n        metadata: data.metadata,\n      }),\n    }),\n};\n\n// =============================================================================\n// In-App Notifications (dashboard bell)\n// ============================================================================\n\n// =============================================================================\n// Customer messages — the merchant's own words\n// =============================================================================\n\n/**\n * One editable customer message, as the API describes it.\n *\n * SERVED, not re-typed here. The label, the description, our default subject\n * and the current values all live beside the templates in potter-api; a copy\n * on this side would be a second list to keep in step, which is how the\n * settings rail and the mobile hub came to show two different products.\n */\nexport interface MerchantMessageSummary {\n  key: string;\n  label: string;\n  when: string;\n  /** Whether the merchant may stop it being sent at all. */\n  silenceable: boolean;\n  enabled: boolean;\n  /** Whether they have said anything about it — including switching it off. */\n  edited: boolean;\n  subject: string;\n  defaultSubject: string;\n  body: string;\n}\n\nexport const merchantMessagesApi = {\n  list: (tenantSlug: string) =>\n    apiFetch<MerchantMessageSummary[]>('/communications/messages', {\n      tenantSlug,\n    }),\n\n  /**\n   * The email as the customer would receive it. A POST because it carries the\n   * draft being typed rather than what is saved.\n   */\n  preview: (\n    tenantSlug: string,\n    key: string,\n    draft: { subject?: string; body?: string },\n  ) =>\n    apiFetch<{ subject: string; html: string }>(\n      `/communications/messages/${encodeURIComponent(key)}/preview`,\n      { method: 'POST', body: JSON.stringify(draft), tenantSlug },\n    ),\n\n  /** Send it to yourself, through your own configured sender. */\n  sendTest: (\n    tenantSlug: string,\n    key: string,\n    draft: { subject?: string; body?: string; to?: string },\n  ) =>\n    apiFetch<{ success: boolean; message: string }>(\n      `/communications/messages/${encodeURIComponent(key)}/test`,\n      { method: 'POST', body: JSON.stringify(draft), tenantSlug },\n    ),\n};\n\n/**\n * Who a WhatsApp message can reach right now.\n *\n * WhatsApp accepts a free-form message only within 24 hours of the customer\n * writing first, so for a campaign this is not a detail — it IS the audience.\n * Contacts come back as digits with the country code resolved, which is how\n * they are stored, so a caller comparing against its own list has to normalise\n * rather than match on however a merchant typed the number.\n *\n * A tenant whose API predates inbound gets an empty list. That is honest —\n * nobody is reachable if nothing has ever been received — and it is the reason\n * callers treat the failure case separately rather than folding it into zero.\n */\nexport const whatsappWindowApi = {\n  reachable: (tenantSlug: string) =>\n    apiFetch<{ windowHours: number; contacts: string[] }>(\n      '/communications/whatsapp/window',\n      { tenantSlug },\n    ),\n};\n\n/**\n * Proving the alert number is the merchant's own.\n *\n * The number on the alerts screen is where orders, payments and low-stock\n * warnings are sent, over channels that cost credits — and until this existed\n * nothing checked it. A missing country code or one wrong digit meant every\n * alert went to a stranger, forever, and the screen said \"Saved\".\n *\n * `sendCode` answers 429 while the previous code's minute is still running;\n * the caller reads that status to put the countdown back rather than showing\n * it as a failure, because it is not one.\n */\nexport const phoneVerificationApi = {\n  sendCode: (\n    tenantSlug: string,\n    phone: string,\n    channel: 'sms' | 'whatsapp' = 'sms',\n  ) =>\n    apiFetch<{\n      sentTo: string;\n      channel: 'sms' | 'whatsapp';\n      resendInSeconds: number;\n    }>('/communications/phone/code', {\n      method: 'POST',\n      body: JSON.stringify({ phone, channel }),\n      tenantSlug,\n    }),\n\n  verify: (tenantSlug: string, phone: string, code: string) =>\n    apiFetch<{ phone: string; verifiedAt: string }>(\n      '/communications/phone/verify',\n      {\n        method: 'POST',\n        body: JSON.stringify({ phone, code }),\n        tenantSlug,\n      },\n    ),\n};\n"],"mappings":"AAAA,SAAS,gBAAgB;AASlB,MAAM,oBAAoB;AAAA,EAC/B,mBAAmB,CAAC,YAAoB,YACtC;AAAA,IACE,0BAA0B,mBAAmB,OAAO,CAAC;AAAA,IACrD,EAAE,WAAW;AAAA,EACf;AAAA,EAEF,yBAAyB,CAAC,YAAoB,kBAC5C;AAAA,IACE,gCAAgC,mBAAmB,aAAa,CAAC;AAAA,IACjE,EAAE,WAAW;AAAA,EACf;AAAA,EAEF,UAAU,CAAC,YAAoB,OAC7B;AAAA,IACE,wBAAwB,mBAAmB,EAAE,CAAC;AAAA,IAC9C,EAAE,YAAY,QAAQ,OAAO;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASF,UAAU,CACR,YACA,SAmBI,CAAC,MACF;AACH,UAAM,QAAQ,IAAI,gBAAgB;AAElC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAI,UAAU,UAAa,UAAU,GAAI,OAAM,IAAI,KAAK,OAAO,KAAK,CAAC;AAAA,IACvE;AAEA,UAAM,SAAS,MAAM,SAAS;AAE9B,WAAO;AAAA,MACL,uBAAuB,SAAS,IAAI,MAAM,KAAK,EAAE;AAAA,MACjD,EAAE,WAAW;AAAA,IACf;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,CACL,YACA,SAAmD,CAAC,MACjD;AACH,UAAM,QAAQ,IAAI,gBAAgB;AAElC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAI,MAAO,OAAM,IAAI,KAAK,KAAK;AAAA,IACjC;AAEA,UAAM,SAAS,MAAM,SAAS;AAE9B,WAAO;AAAA,MACL,wBAAwB,SAAS,IAAI,MAAM,KAAK,EAAE;AAAA,MAClD,EAAE,WAAW;AAAA,IACf;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,aAAa,CAAC,YAAoB,aAChC;AAAA,IACE,+BAA+B,QAAQ;AAAA,IACvC,EAAE,WAAW;AAAA,EACf;AAAA,EAEF,UAAU,CACR,YACA,SAYA,SAA0B,6BAA6B;AAAA,IACrD,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,IAAI;AAAA,IACzB;AAAA,EACF,CAAC;AAAA,EAEH,cAAc,CACZ,YACA,SAQA,SAA4B,wBAAwB;AAAA,IAClD,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU;AAAA,MACnB,cAAc;AAAA,MACd,gBAAgB,KAAK;AAAA,MACrB,eAAe,KAAK;AAAA,MACpB,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,QACT,SAAS,KAAK;AAAA,QACd,aAAa,MAAM,KAAK,QAAQ,QAAQ,OAAO,QAAQ,CAAC;AAAA,MAC1D;AAAA,IACF,CAAC;AAAA,IACD;AAAA,EACF,CAAC;AAAA,EAEH,iBAAiB,CACf,YACA,SAQA,SAA4B,wBAAwB;AAAA,IAClD,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU;AAAA,MACnB,cAAc;AAAA,MACd,gBAAgB,KAAK;AAAA,MACrB,GAAI,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,MAClE,WAAW;AAAA,QACT,SAAS,KAAK;AAAA,QACd,aAAa,KAAK;AAAA,MACpB;AAAA,MACA,UAAU,KAAK;AAAA,IACjB,CAAC;AAAA,EACH,CAAC;AACL;AAgCO,MAAM,sBAAsB;AAAA,EACjC,MAAM,CAAC,eACL,SAAmC,4BAA4B;AAAA,IAC7D;AAAA,EACF,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMH,SAAS,CACP,YACA,KACA,UAEA;AAAA,IACE,4BAA4B,mBAAmB,GAAG,CAAC;AAAA,IACnD,EAAE,QAAQ,QAAQ,MAAM,KAAK,UAAU,KAAK,GAAG,WAAW;AAAA,EAC5D;AAAA;AAAA,EAGF,UAAU,CACR,YACA,KACA,UAEA;AAAA,IACE,4BAA4B,mBAAmB,GAAG,CAAC;AAAA,IACnD,EAAE,QAAQ,QAAQ,MAAM,KAAK,UAAU,KAAK,GAAG,WAAW;AAAA,EAC5D;AACJ;AAeO,MAAM,oBAAoB;AAAA,EAC/B,WAAW,CAAC,eACV;AAAA,IACE;AAAA,IACA,EAAE,WAAW;AAAA,EACf;AACJ;AAcO,MAAM,uBAAuB;AAAA,EAClC,UAAU,CACR,YACA,OACA,UAA8B,UAE9B,SAIG,8BAA8B;AAAA,IAC/B,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC;AAAA,IACvC;AAAA,EACF,CAAC;AAAA,EAEH,QAAQ,CAAC,YAAoB,OAAe,SAC1C;AAAA,IACE;AAAA,IACA;AAAA,MACE,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU,EAAE,OAAO,KAAK,CAAC;AAAA,MACpC;AAAA,IACF;AAAA,EACF;AACJ;","names":[]}

package/dist/api/connect.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Connect, reached the only way it should be: through potter-api.
+ *
+ * The signing key that authenticates Box to Connect lives on the API
+ * server. The dashboard never holds it, and never asserts which workspace it
+ * is acting for — potter-api resolves that from the session, so a merchant
+ * cannot reach another merchant's connection by editing an id.
+ */
+export interface ConnectStatus {
+    configured: boolean;
+}
+export interface ConnectAuthorization {
+    authorizationSessionId: string;
+    authorizationUrl: string;
+    connectionId: string;
+    expiresAt: string;
+}
+export interface ConnectConnectionInspection {
+    connectionDefinitionId: string;
+    connectionId: string;
+    deletedAt: string | null;
+    health: string;
+    revokedAt: string | null;
+    scopes: string[];
+    status: string;
+    tokenExpiresAt: string | null;
+    updatedAt: string;
+}
+export interface ConnectorRequestInput {
+    family: string;
+    outcome: string;
+    productId?: string;
+    provider: string;
+}
+export interface ConnectorRequestRecord {
+    createdAt: string;
+    family: string;
+    id: string;
+    outcome: string;
+    productId: string | null;
+    provider: string;
+}
+export declare const connectApi: {
+    /**
+     * Whether this deployment is wired to Connect at all.
+     *
+     * A workspace on a deployment without it is not broken; it has no
+     * connections. Asking first is what lets the screen say that rather than
+     * showing an error a merchant cannot act on.
+     */
+    status: (tenantSlug: string) => Promise<ConnectStatus>;
+    /**
+     * Ask for a connection Box does not offer yet.
+     *
+     * This used to be a `setTimeout` and a toast in the dialog itself, so the
+     * merchant was told "we will come back to you" against nothing at all.
+     * Connector work is scored on named demand, and this is where the demand
+     * becomes a row somebody can read.
+     */
+    requestConnector: (tenantSlug: string, data: ConnectorRequestInput) => Promise<ConnectorRequestRecord>;
+    listConnectorRequests: (tenantSlug: string) => Promise<ConnectorRequestRecord[]>;
+    authorize: (tenantSlug: string, data: {
+        connectionDefinitionId: string;
+        connectionId: string;
+        redirectUri: string;
+        requestedScopes: string[];
+    }) => Promise<ConnectAuthorization>;
+    inspect: (tenantSlug: string, connectionId: string) => Promise<ConnectConnectionInspection>;
+    refresh: (tenantSlug: string, connectionId: string) => Promise<ConnectConnectionInspection>;
+    revoke: (tenantSlug: string, connectionId: string) => Promise<ConnectConnectionInspection>;
+    disconnect: (tenantSlug: string, connectionId: string) => Promise<ConnectConnectionInspection>;
+};

package/dist/api/connect.js

@@ -0,0 +1,50 @@
+import { apiFetch } from "./core";
+const connectApi = {
+  /**
+   * Whether this deployment is wired to Connect at all.
+   *
+   * A workspace on a deployment without it is not broken; it has no
+   * connections. Asking first is what lets the screen say that rather than
+   * showing an error a merchant cannot act on.
+   */
+  status: (tenantSlug) => apiFetch("/connect/status", { tenantSlug }),
+  /**
+   * Ask for a connection Box does not offer yet.
+   *
+   * This used to be a `setTimeout` and a toast in the dialog itself, so the
+   * merchant was told "we will come back to you" against nothing at all.
+   * Connector work is scored on named demand, and this is where the demand
+   * becomes a row somebody can read.
+   */
+  requestConnector: (tenantSlug, data) => apiFetch("/connect/requests", {
+    body: JSON.stringify(data),
+    method: "POST",
+    tenantSlug
+  }),
+  listConnectorRequests: (tenantSlug) => apiFetch("/connect/requests", { tenantSlug }),
+  authorize: (tenantSlug, data) => apiFetch("/connect/connections/authorize", {
+    body: JSON.stringify(data),
+    method: "POST",
+    tenantSlug
+  }),
+  inspect: (tenantSlug, connectionId) => apiFetch(
+    `/connect/connections/${connectionId}/inspect`,
+    { method: "POST", tenantSlug }
+  ),
+  refresh: (tenantSlug, connectionId) => apiFetch(
+    `/connect/connections/${connectionId}/refresh`,
+    { method: "POST", tenantSlug }
+  ),
+  revoke: (tenantSlug, connectionId) => apiFetch(
+    `/connect/connections/${connectionId}/revoke`,
+    { method: "POST", tenantSlug }
+  ),
+  disconnect: (tenantSlug, connectionId) => apiFetch(
+    `/connect/connections/${connectionId}/delete`,
+    { method: "POST", tenantSlug }
+  )
+};
+export {
+  connectApi
+};
+//# sourceMappingURL=connect.js.map

package/dist/api/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/connect.ts"],"sourcesContent":["import { apiFetch } from './core';\n\n/**\n * Connect, reached the only way it should be: through potter-api.\n *\n * The signing key that authenticates Box to Connect lives on the API\n * server. The dashboard never holds it, and never asserts which workspace it\n * is acting for — potter-api resolves that from the session, so a merchant\n * cannot reach another merchant's connection by editing an id.\n */\nexport interface ConnectStatus {\n  configured: boolean;\n}\n\nexport interface ConnectAuthorization {\n  authorizationSessionId: string;\n  authorizationUrl: string;\n  connectionId: string;\n  expiresAt: string;\n}\n\nexport interface ConnectConnectionInspection {\n  connectionDefinitionId: string;\n  connectionId: string;\n  deletedAt: string | null;\n  health: string;\n  revokedAt: string | null;\n  scopes: string[];\n  status: string;\n  tokenExpiresAt: string | null;\n  updatedAt: string;\n}\n\nexport interface ConnectorRequestInput {\n  family: string;\n  outcome: string;\n  productId?: string;\n  provider: string;\n}\n\nexport interface ConnectorRequestRecord {\n  createdAt: string;\n  family: string;\n  id: string;\n  outcome: string;\n  productId: string | null;\n  provider: string;\n}\n\nexport const connectApi = {\n  /**\n   * Whether this deployment is wired to Connect at all.\n   *\n   * A workspace on a deployment without it is not broken; it has no\n   * connections. Asking first is what lets the screen say that rather than\n   * showing an error a merchant cannot act on.\n   */\n  status: (tenantSlug: string) =>\n    apiFetch<ConnectStatus>('/connect/status', { tenantSlug }),\n\n  /**\n   * Ask for a connection Box does not offer yet.\n   *\n   * This used to be a `setTimeout` and a toast in the dialog itself, so the\n   * merchant was told \"we will come back to you\" against nothing at all.\n   * Connector work is scored on named demand, and this is where the demand\n   * becomes a row somebody can read.\n   */\n  requestConnector: (tenantSlug: string, data: ConnectorRequestInput) =>\n    apiFetch<ConnectorRequestRecord>('/connect/requests', {\n      body: JSON.stringify(data),\n      method: 'POST',\n      tenantSlug,\n    }),\n\n  listConnectorRequests: (tenantSlug: string) =>\n    apiFetch<ConnectorRequestRecord[]>('/connect/requests', { tenantSlug }),\n\n  authorize: (\n    tenantSlug: string,\n    data: {\n      connectionDefinitionId: string;\n      connectionId: string;\n      redirectUri: string;\n      requestedScopes: string[];\n    },\n  ) =>\n    apiFetch<ConnectAuthorization>('/connect/connections/authorize', {\n      body: JSON.stringify(data),\n      method: 'POST',\n      tenantSlug,\n    }),\n\n  inspect: (tenantSlug: string, connectionId: string) =>\n    apiFetch<ConnectConnectionInspection>(\n      `/connect/connections/${connectionId}/inspect`,\n      { method: 'POST', tenantSlug },\n    ),\n\n  refresh: (tenantSlug: string, connectionId: string) =>\n    apiFetch<ConnectConnectionInspection>(\n      `/connect/connections/${connectionId}/refresh`,\n      { method: 'POST', tenantSlug },\n    ),\n\n  revoke: (tenantSlug: string, connectionId: string) =>\n    apiFetch<ConnectConnectionInspection>(\n      `/connect/connections/${connectionId}/revoke`,\n      { method: 'POST', tenantSlug },\n    ),\n\n  disconnect: (tenantSlug: string, connectionId: string) =>\n    apiFetch<ConnectConnectionInspection>(\n      `/connect/connections/${connectionId}/delete`,\n      { method: 'POST', tenantSlug },\n    ),\n};\n"],"mappings":"AAAA,SAAS,gBAAgB;AAiDlB,MAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQxB,QAAQ,CAAC,eACP,SAAwB,mBAAmB,EAAE,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAU3D,kBAAkB,CAAC,YAAoB,SACrC,SAAiC,qBAAqB;AAAA,IACpD,MAAM,KAAK,UAAU,IAAI;AAAA,IACzB,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AAAA,EAEH,uBAAuB,CAAC,eACtB,SAAmC,qBAAqB,EAAE,WAAW,CAAC;AAAA,EAExE,WAAW,CACT,YACA,SAOA,SAA+B,kCAAkC;AAAA,IAC/D,MAAM,KAAK,UAAU,IAAI;AAAA,IACzB,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AAAA,EAEH,SAAS,CAAC,YAAoB,iBAC5B;AAAA,IACE,wBAAwB,YAAY;AAAA,IACpC,EAAE,QAAQ,QAAQ,WAAW;AAAA,EAC/B;AAAA,EAEF,SAAS,CAAC,YAAoB,iBAC5B;AAAA,IACE,wBAAwB,YAAY;AAAA,IACpC,EAAE,QAAQ,QAAQ,WAAW;AAAA,EAC/B;AAAA,EAEF,QAAQ,CAAC,YAAoB,iBAC3B;AAAA,IACE,wBAAwB,YAAY;AAAA,IACpC,EAAE,QAAQ,QAAQ,WAAW;AAAA,EAC/B;AAAA,EAEF,YAAY,CAAC,YAAoB,iBAC/B;AAAA,IACE,wBAAwB,YAAY;AAAA,IACpC,EAAE,QAAQ,QAAQ,WAAW;AAAA,EAC/B;AACJ;","names":[]}